841
Defeating KASLR by doing nothing at all
IntroductionI’ve recently been researching Pixel kernel exploitation and as part of this research...
New
The latest blog posts to take off on Hacker News. 8,769 posts.
842
New prompt injection papers: Agents rule of two and the attacker moves second
Two interesting new papers regarding LLM security and prompt injection came to my attention this weekend. Agents Rule of Two: A Practical Approach to AI Agent Security The first is …
843
Alleged Jabber Zeus Coder 'MrICQ' in U.S. Custody
A Ukrainian man indicted in 2012 for conspiring with a prolific hacking group to steal tens of millions of dollars from U.S. businesses was arrested in Italy and is now in custody in the United States, KrebsOnSecurity has learned.
844
Notes by djb on using Fil-C
I'm impressed with the level of compatibility of the new memory-safe C/C++ compiler Fil-C (filcc, fil++). Many libraries and applications that I've tried work under Fil-C without changes, and the exceptions haven't been hard to get working.
845
You Don't Need Anubis
don't use anubis just to block llm scrapers
846
Anonymous credentials: rate-limit bots and agents without compromising privacy
As AI agents change how the Internet is used, they create a challenge for security. We explore how Anonymous Credentials can rate limit agent traffic and block abuse without tracking users or compromising their privacy.
847
Czech police forced to turn off facial recognition cameras at the Prague airport
The shutdown of the facial recognition cameras at the Václav Havel Airport in Prague came after years of criticism from EDRi member IuRe.
848
Claude Code can debug low-level cryptography
Surprisingly (to me) Claude Code debugged my new ML-DSA implementation faster than I would have, finding the non-obvious low-level issue that was making Verify fail.
849
Chat Control proposal fails again after public opposition
The European Union’s controversial Chat Control proposal has been withdrawn once again following intense public pressure. This marks another defeat for legislation that would have mandated scanning of encrypted messages across the EU.
850
851
The cryptography behind electronic passports
This blog post describes how electronic passports work, the threats within their threat model, and how they protect against those threats using cryptography. It also discusses the implications of using electronic passports for novel applications, such as zero-knowledge identity proofs.
852
Hacking India's largest automaker: Tata Motors
Tata Motors gave away the keys to their infrastructure and customer data on their public websites.
853
Keeping the Internet fast and secure: introducing Merkle Tree Certificates
Cloudflare is launching an experiment with Chrome to evaluate fast, scalable, and quantum-ready Merkle Tree Certificates, all without degrading performance or changing WebPKI trust relationships.
854
Tor Browser 15.0
Tor Browser 15.0 is now available, featuring an update to Firefox ESR 140, improvements to tab management and the address bar on desktop, and screen lock for Android.
855
HTTPS by default
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Ch…
856
Understanding the Worst .NET Vulnerability
In this post I discuss request smuggling, the recent vulnerability in ASP.NET Core with a severity score of 9.9, and how attackers could exploit it
857
Criminal complaint against facial recognition company Clearview AI
Clearview AI is known for scraping billions of photos of people around the world on the internet – and selling its facial recognition system to law enforcement and state actors
858
Microsoft 365 Copilot – Arbitrary Data Exfiltration via Mermaid Diagrams
When Microsoft 365 Copilot (M365 Copilot) was asked to summarize a specially crafted Microsoft Office document, an indirect prompt injection payload triggered the execution of arbitrary instructions to fetch sensitive tenant data, such as “recent emails” and hex encode the fetched output. M365 Copilot then generated a…
859
Key IOCs for Pegasus and Predator Spyware Removed with iOS 26 Update
iVerify brings operating system-level telemetry, behavioral baselining, and AI-driven threat hunting to hundreds of thousands of mobile devices
860
FBI Agents Visit Anti-ICE Protester: "Your name was brought up."
“Your name was brought up.”
861
Disable AI in Firefox
Quick reference for how to turn off AI features in Firefox
862
Unlocking free WiFi on British Airways
Personal website talking about some stuff I've made and technology
863
Spinning Up an Onion Mirror Is Stupid Easy
I recently spun up a .onion mirror of this website.
864
Google flags Immich sites as dangerous
How Google actively breaks Immich deployments, an open-source Google Photos alternative.
865
Accessing Max Verstappen's passport and PII through FIA bugs
We found vulnerabilities in the FIA's Driver Categorisation platform, allowing us to access PII and password hashes of any racing driver with a categorisation rating.
866
Cryptographic Issues in Cloudflare's Circl FourQ Implementation (CVE-2025-8556)
The vulnerabilities we found in Cloudflare's CIRCL FourQ implementation: invalid-point attacks, Edwards-curve edge cases, and the disclosure that fixed them.
867
Linux Capabilities Revisited
Technical blog by Stephan Berger (@malmoeb)
868
The security paradox of local LLMs
Local LLMs prioritize privacy over security. Our research reveals a 95% backdoor injection success rate.
869
Introduction to reverse-engineering vintage synth firmware
A gentle introduction to reverse-engineering vintage synthesiser ROMs using the Ghidra disassembler.
870
Could the XZ backdoor been detected with better Git/Deb packaging practices?
The discovery of a backdoor in XZ Utils in the spring of 2024 shocked the open source community, raising critical questions about software supply chain security. This post explores whether better Debian packaging practices could have detected this threat, offering a guide to auditing packages and suggesting future…