1051
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1052
When root meets immutable: OpenBSD chflags vs. log tampering
Rafael Sadowski
1053
Fully homomorphic encryption and the dawn of a private internet
This article is archived on mirror.xyz , and attracted discussion on Hacker News Generated by this notebooklm Gene Spafford "Using encryption on the…
1054
My bank keeps on undermining anti-phishing education
TLDR: my bank sent out emails with websites which looked a lot like phishing mails, so much so that this similarity could potentially be used against them legally by potential phishing victims Discussion at hackernews: https://news.ycombinator.com/item?id=44592377 Chapter 1: You’ve got mail As I was writing my first…
1055
Upcoming coordinated security fix for all Matrix server implementations
Matrix, the open protocol for secure decentralised communications
1056
Code execution through email: How I used Claude to hack itself
This is the story of how I used a Gmail message to trigger code execution through Claude Desktop, and how Claude itself (!) helped me plan the attack.
1057
PyPI Prohibits inbox.ru email domain registrations
We have prohibited new registrations of accounts using inbox.ru email domains.
1058
OpenAI – vulnerability responsible disclosure
Update with OpenAI response added What happened? On 29 May 2025 I privately reported a vulnerability to the OpenAI disclosure mailbox using an encrypted email. The flaw allows peeking at chat responses intended for other users. This content may contain personal data, confidential business plans, …
1059
The FIPS 140-3 Go Cryptographic Module
Go now has a built-in, native FIPS 140-3 compliant mode.
1060
Code highlighting extension for Cursor AI used for $500k theft
Kaspersky GReAT experts uncover malicious extensions for Cursor AI that download the Quasar backdoor and a crypto stealer.
1061
DOGE Denizen Marko Elez Leaked API Key for xAI
Marko Elez , a 25-year-old employee at Elon Musk’s Department of Government Efficiency (DOGE), has been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury and Justice departments, and the Department of Homeland Security. So it should fill all Americans with a deep sense of…
1062
Encrypting files with passkeys and age
Encrypting files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.
1063
Data brokers are selling flight information to CBP and ICE
For many years, data brokers have existed in the shadows, exploiting gaps in privacy laws to harvest our information—all for their own profit. They sell our precise movements without our knowledge or meaningful consent to a variety of private and state actors, including law enforcement agencies....
1064
A technical look at Iran's internet shutdowns
This post is written by a human being (me).
1065
Bypassing Google's big anti-adblock update
Hello, I'm Derin!
1066
Supreme Court's ruling practically wipes out free speech for sex writing online
Am I now committing civil disobedience... just by keeping my personal literary website up as is?
1067
Malware found in official gravityforms plugin indicating supply chain breach
Update 7-12-2025 06:00 UTC: We have observed some activity in regard to one of the backdoors that involves a gf_api_token parameter. The IP address 193.160.101.
1068
Apple vs the Law
Apple & Google at the EU DMA compliance workshops, June 2025.
1069
Axon’s Draft One is designed to defy transparency
Axon Enterprise’s Draft One — a generative artificial intelligence product that writes police reports based on audio from officers’ body-worn cameras — seems deliberately designed to avoid audits that could provide any accountability to the public, an EFF investigation has found.Our review of...
1070
Why you should delete WhatsApp and install Signal
WhatsApp is not private or secure. Please consider using Signal instead.
1071
Would You Like an IDOR With That? Leaking 64m McDonald's Job Applications
When applying for a job at McDonald's, over 90% of franchises use "Olivia," an AI-powered chatbot. We discovered a vulnerability that could allow an attacker to access more than 64 million job applications. This data includes applicants' names, resumes, email addresses, phone numbers, and personality test results.
1072
Evolution Mail Users Easily Trackable
A dns-prefetch tag in an HTML email makes Evolution Mail do a DNS lookup on open, even with remote content blocked. The developers blame WebKitGTK.
1073
ESIM Security
In a result of its research investigation efforts, Security Explorations, a research lab of AG Security Research company, conducted security analysis of eSIM technology.
1074
Parse, Don’t Validate – Some C Safety Tips
“A good programmer is someone who looks both ways before crossing a one-way street.” – Doug Linder
1075
Breaking Git with a carriage return and cloning RCE
tl;dr: On Unix-like platforms, if you use git clone --recursive on an untrusted repo, it could achieve remote code execution. Update to a fixed version of Git and other software that embeds Git (including GitHub Desktop).
1076
Supabase MCP can leak your entire SQL database
Indirect prompt injection through support-ticket data lets an MCP-enabled assistant cross trust boundaries and query private tables with Supabase’s privileged service role.
1077
Running a Certificate Transparency log
Maybe you, yes you, should run a Certificate Transparency log. It’s cheaper, easier, and more important than ever.
1078
Belgium Is Unsafe for CVD
This post is about the reason I will probably never try to warn any organisation in Belgium about any vulnerability again. Recently I have been dealing with an attempt at coordinated vulnerability disclosure (CVD) with an organisation in Belgium. This post is not about that, because I’m not allowed to write about it…
1079
Incapacitating Google Tag Manager (2022)
Drilling beneath the hype to expose the truth
1080
Opening up ‘Zero-Knowledge Proof’ technology
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.