61
Critical Security Vulnerability in React Server Components
The library for web and native user interfaces
New
The latest blog posts to take off on Hacker News. 679 posts.
62
Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
A public and free DNS service for a better security and privacy
63
Understanding ECDSA
Exploring blockchain, math, and smart contracts through a security lens.
64
Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera
Claimed end-to-end privacy doesn’t fully conceal your rear-end data
65
4.3M Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
66
Decreasing Certificate Lifetimes to 45 Days
Let’s Encrypt will be reducing the validity period of the certificates we issue. We currently issue certificates valid for 90 days, which will be cut in half to 45 days by 2028. This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the…
67
AI agents find $4.6M in blockchain smart contract exploits
On a benchmark of real exploited contracts, AI agents found vulnerabilities worth a combined $4.6 million, underscoring the need for AI-powered defense.
68
Constructing the Word's First JPEG XL MD5 Hash Quine
A walk through of building an image that displays its own MD5 Hash
69
Stopping bad guys from using my open source project (feedback wanted)
I maintain a sorta-popular open source package, and I want to prevent big corporations and "bad guys" from using it. I want feedback on how to do this.
70
Landlock-Ing Linux
Landlock is a Linux API that lets applications explicitly declare which resources they are allowed to access. Its philosophy is similar to OpenBSD’s unveil() and (less so) pledge() : programs can make a contract with the kernel stating, “I only need these files or resources — deny me everything else if I’m…
71
GitLab discovers widespread NPM supply chain attack
Malware driving attack includes "dead man's switch" that can harm user data.
72
Protect Public School Students from Surveillance of Off-Campus Speech
EFF filed an amicus brief in Arizona federal court arguing that public school students need private digital spaces beyond their school’s reach to speak freely, without the specter of constant school surveillance and punishment.
73
Mixpanel Security Breach
Our response to a recent security incident The Signal Inside Mixpanel |
74
Running Unsupported iOS on Deprecated Devices
Earlier this year I demoed iOS 6 running on an iPod touch 3 - a device that Apple never gave iOS 6 to, making iOS 5.1.1 the latest build it can run
75
Counter Galois Onion: Improved encryption for Tor circuit traffic
Tor is upgrading its relay encryption algorithm for improved security. In upcoming releases, Arti and Tor will both support a new encryption algorithm called Counter Galois Onion (CGO). CGO prevents attackers from tampering with encrypted traffic, adds forward secrecy, and brings Tor's encryption up to modern…
76
Google Antigravity exfiltrates data via indirect prompt injection attack
An indirect prompt injection in an implementation blog can manipulate Antigravity to invoke a malicious browser subagent in order to steal credentials and sensitive code from a user’s IDE.
77
78
GrapheneOS migrates server infrastructure from France
The GrapheneOS project has announced on X that they are ceasing all operations in France, asserting that the country is no longer safe for "open source projects"
79
X Just Accidentally Exposed a Covert Influence Network Targeting Americans
How a new X feature led to the most sweeping public exposure of covert foreign activity on a major platform since 2016.
80
Shai Hulud launches second supply-chain attack
The threat actor behind “Shai Hulud 2.0” launched a new malware campaign compromising the supply chain of Zapier, ENS Domains and more — exposing secrets, injecting malicious code, and enabling widespread developer-environment takeover.
81
NSA and IETF, part 3: Dodging the issues at hand
Normal practice in deploying post-quantum cryptography is to deploy ECC+PQ. IETF's TLS working group is standardizing ECC+PQ. But IETF management is also non-consensually ramming a particular NSA-driven document through the IETF process, a "non-hybrid" document that adds just PQ as another TLS option.
82
Shai-Hulud Returns: Over 300 NPM Packages Infected
Over 1,000 NPM packages were infected using the same method as the previous attack, infecting with a fake Bun runtime. The attacker leveraged the `preinstall` script to download and execute a malicious payload, stealing sensitive information from the compromised machines.
83
Signal knows who you're talking to (2023)
Recently I got a friend to finally join me on Signal. He asked something about whether or not Signal is truly secure and private, like if it was safe from US government surveillance. I told him: “Well, it’s end-to-end encrypted, so they don’t know what we’re talking about, but they definitely know that we’re talking…
84
A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
1.0 The Silicon Root of Trust: Pre-Boot & Hardware Primitives The security of the macOS platform on Apple Silicon is not defined by the kernel; it is d...
85
The privacy nightmare of browser fingerprinting
If you were worried about tracking cookies, you really don’t want to know about browser fingerprinting.
86
Arduino Terms of Service and Privacy Policy update: setting the record straight
We’ve heard some questions and concerns following our recent Terms of Service and Privacy Policy updates. We are thankful our community cares enough to
87
Flock Safety and Texas Sheriff Claimed License Plate Search Was for a Missing Person. It Was an Abortion Investigation.
New documents and court records obtained by EFF show that Texas deputies queried Flock Safety's surveillance data in an abortion investigation, contradicting the narrative promoted by the company and the Johnson County Sheriff that she was “being searched for as a missing person,” and that “it was about her safety.”…
88
How Cops Are Using Flock's ALPR Network to Surveil Protesters and Activists
Through an analysis of 10 months of nationwide searches on Flock Safety's servers, we discovered that more than 50 federal, state, and local agencies ran hundreds of searches through Flock's national network of surveillance data in connection with protest activity. In some cases, law enforcement specifically targeted…
89
Gmail can read your emails and attachments to train its AI, unless you opt out
Did you know that Gmail can use your emails and attachments for its smart features? Here's how to check your settings.
90
Data-at-Rest Encryption in DuckDB
DuckDB 1.4 ships database encryption capabilities. In this blog post, we dive into the implementation details of the encryption, show how to use it, and demonstrate its performance implications.