931
Scream cipher
You've probably heard of stream ciphers, but what about a scream cipher 😱? Today I learned there are more “Latin capital letter A” Unicode characters than there are letters in the English alphabet....
New
The latest blog posts to take off on Hacker News. 8,769 posts.
932
One Token to rule them all – Obtaining Global Admin in every Entra ID tenant
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin…
933
Tinycolor supply chain attack post-mortem
Lessons learned from becoming the unexpected face of a npm supply-chain attack.
934
Firefox 143 for Android to introduce DoH
All web browsing starts with a DNS query to find the IP address for the desired service or website. For much of the internet’s history, this query is sen
935
PureVPN IPv6 Leak
Two findings in PureVPN on Ubuntu 24.04. After a reconnect the system takes a default IPv6 route outside the tunnel, and the ip6tables OUTPUT policy is still ACCEPT, so traffic leaves in the clear while the client reports connected.
936
Oh no, not again a meditation on NPM supply chain attacks
For enterprise software, the software supply chain presents some of the biggest risks today to data privacy and security.
937
Scammed out of $130K via fake Google call, spoofed Google email and auth sync
On June 19th, my life changed with a phone call.
938
Teen safety, freedom, and privacy
Explore OpenAI’s approach to balancing teen safety, freedom, and privacy in AI use.
939
940
Wanted to spy on my dog, ended up spying on TP-Link
I recently bought a cheap Tapo indoor camera to see what my dog gets up to when I am out of the house.
941
OCSP Service Has Reached End of Life
Today we turned off our Online Certificate Status Protocol (OCSP) service, as announced in December of last year. We stopped including OCSP URLs in our certificates more than 90 days ago, so all Let’s Encrypt certificates that contained OCSP URLs have now expired. Going forward, we will publish revocation information…
942
EPA Seeks to Eliminate Critical PFAS Drinking Water Protections
The move continues to expose communities across the country to toxic forever chemicals in tap water
943
EFF to court: The Supreme Court must rein in secondary copyright liability
If the Supreme Court doesn’t reverse a lower court’s ruling, internet service providers (ISPs) could be forced to terminate people’s internet access based on nothing more than mere accusations of copyright infringement. This would threaten innocent users who rely on broadband for essential aspects...
944
Geedge and MESA leak: Analyzing the great firewall’s largest document leak
The Great Firewall of China (GFW) experienced the largest leak of internal documents in its history on Thursday September 11, 2025. Over 500 GB of source code, work logs, and internal communication records were leaked, revealing details of the GFW's research, development, and operations.
945
946
Crates.io phishing attempt
Earlier this week, an npm supply chain attack. It’s turn for crates.io, the main public repository for Rust crates (packages). The phishing e-mail looks like this: And it leads to a GitHub login pa...
947
Bulletproof host Stark Industries evades EU sanctions
In May 2025, the European Union levied financial sanctions on the owners of Stark Industries Solutions Ltd. , a bulletproof hosting provider that materialized two weeks before Russia invaded Ukraine and quickly became a top source of Kremlin-linked cyberattacks and disinformation campaigns. But new findings show those…
948
NT OS Kernel Information Disclosure Vulnerability
Bidding farewell to one of the last kernel address leaks, CVE-2025-53136. Even patches can open new doors for exploitation.
949
Introduction to GrapheneOS
In this blog post, you will learn about the security oriented smartphone operating system GrapheneOS
950
Kerberoasting
I learn about cryptographic vulnerabilities all the time, and they generally fill me with some combination of jealousy (“oh, why didn’t I think of that”) or else they impress me w…
951
Memory Integrity Enforcement
Memory Integrity Enforcement (MIE) is the culmination of an unprecedented design and engineering effort spanning half a decade that combines the unique strengths of Apple silicon hardware with our advanced operating system security to provide industry-first, always-on memory safety protection across our devices …
952
An attacker’s blunder gave us a look into their operations
An attacker installed Huntress onto their operating machine, giving us a detailed look at how they’re using AI to build workflows, searching for tools like Evilginx, and researching targets like software development companies.
953
Chat Control Must Be Stopped
Chat Control is back to undermine everyone's privacy. There's an important deadline on October 14th, 2025. We must act now to stop it!
954
Signal Secure Backups
In the past, if you broke or lost your phone, your Signal message history was gone. This has been a challenge for people whose most important conversations happen on Signal. Think family photos, sweet messages, important documents, or anything else you don’t want to lose forever. This explains wh...
955
NPM debug and chalk packages compromised
The popular packages debug and chalk on npm have been compromised with malicious code
956
Clankers Die on Christmas
I’m sorry, but I can’t help with that. We acheived AGI. The clankers died on Christmas. This post is scheduled to automatically publish: 2025-12-25. Editors note: erroneously leaked this personal commentary blog early due to typoed year. Since it's erroneous early publication, this leak has remained on the hackernews…
957
ICEBlock handled my vulnerability report in the worst possible way
Last week, I wrote about how Joshua Aaron's ICEBlock app, which allows people to anonymously report ICE sightings within a 5-mile radius, is – unfortunately, and despite apparent good intentions – activism theater. This was based on Joshua's talk at HOPE where he made it clear that he isn'
958
Keeping secrets out of logs (2024)
There's no silver bullet, but if we put some "lead" bullets in the right places, we have a good shot at keeping sensitive data out of logs.
959
How the “Kim” dump exposed North Korea's credential theft playbook
A rare and revealing breach attributed to a North Korean-affiliated actor, known only as “Kim” as named by the hackers who dumped the data, has delivered a new insight into Kimsuky (APT43) tactics, techniques, and infrastructure. This actor's operational profile showcases credential-focused intrusions targeting South…
960