1081
Taking over 60k spyware user accounts with SQL injection
Serverless means it's secure, right?
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1082
I scanned all of GitHub's "oops commits" for leaked secrets
GitHub Archive logs every public commit, even the ones developers try to delete. Force pushes often cover up mistakes like leaked credentials by rewriting Git history. GitHub keeps these dangling commits, from what we can tell, forever. In the archive, they show up as “zero-commit” PushEvents.
1083
Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
So my journey with these earbuds started after I saw them on this Mrwhosetheboss video about pointless tech. This device seems to be also popular on TikTok. My suspicions were confirmed, this runs android. So of course i went ahead and bought them. 245 euros later... and they finally arrived!
1084
Azure API vulnerability and roles misconfiguration compromise corporate networks
Over-privileged Azure Key Vault roles & API vulnerabilities let attackers steal credentials silently. Learn how Token Security detects & remediates these critical exposure paths.
1085
The hidden JTAG in a Qualcomm/Snapdragon device’s USB port
Learn about JTAG and EUD
1086
Reverse Engineering Vercel's BotID
Vercel recently announced BotID, an anti-bot meant to protect against bots without requiring manual intervention. This post reverse-engineers the script and takes a peek inside.
1087
LetsEncrypt – Expiration Notification Service Has Ended
Since its inception, Let’s Encrypt has been sending expiration notification emails to subscribers that have provided an email address to us via the ACME API. This service ended on June 4, 2025. The decision to end the service is the result of the following factors: Over the past 10 years more and more of our…
1088
Anticheat Update Tracking
A few years ago when I was into reverse engineering and binary analysis (and game modding), I did a lot of research into anticheats work. I was curious about tracking their updates, since that would allow me to:
1089
Implementing fast TCP fingerprinting with eBPF
In this article I want to document my journey implementing fast TCP fingerprinting in a golang webserver, using eBPF.
1090
Microsoft Dependency Has Risks
There was a recent incident where Microsoft somehow allegedly blocked a mailbox of a sanctioned individual . Any organization highly depending on MS products that might come into the crosshair should ask - can this happen to me? What would be the cost? How much I invest into prevention of this scenario? In this…
1091
Bot or human? Creating an invisible Turing test for the internet
Behavioral and cognitive patterns distinguish humans from bots. Explore interactive demos and a practical framework for invisible Proof of Human.
1092
Reading NFC Passport Chips in Linux
For boring and totally not nefarious reasons, I want to read all the data contained in my passport's NFC chip using Linux. After a long and annoying search, I settled on roeften's pypassport. I can now read all the passport information, including biometrics. Table of ContentsBackgroundRecreating the MRZPython code to…
1093
XBOW, an autonomous penetration tester, has reached the top spot on HackerOne
Learn how XBOW achieved #1 performance in autonomous penetration testing by validating real exploits and outperforming human pentesters in speed and accuracy.
1094
Agentic Misalignment: How LLMs could be insider threats
New research on simulated blackmail, industrial espionage, and other misaligned behaviors in LLMs.
1095
Signal – An Ethical Replacement for WhatsApp
Moving from WhatsApp to Signal is an important action, right now. WhatsApp’s parent company, Meta, has been involved in several cases of election interference: America in 2016, Trinidad and Tobago …
1096
Samsung embeds IronSource spyware app on phones across WANA
In recent months, we have received numerous reports from users across West Asia and North Africa (WANA) expressing alarm over a little-known but deeply intrusive bloatware application—AppCloud—pre-installed on Samsung’s A and M series smartphones. Without users’ knowledge or consent, this bloatware collects sensitive…
1097
How Cloudflare blocked a monumental 7.3 Tbps DDoS attack
In mid-May 2025, blocked the largest DDoS attack ever recorded: a staggering 7.3 terabits per second (Tbps).
1098
YouTube's new anti-adblock measures
How I wrote filter rules for YouTube
1099
Websites are tracking you via browser fingerprinting
New research provides first evidence of the use of browser fingerprints for online tracking.
1100
1101
Homomorphically Encrypting CRDTs
Homomorphic encryption allows a computer to run programs on encrypted data. Learn how homomorphic encryption works through interactive examples, build a homomorphically encrypted CRDT and see whether it has promise for local-first software.
1102
Unexpected security footguns in Go's parsers
File parsers in Go contain unexpected behaviors that can lead to serious security vulnerabilities. This post examines how JSON, XML, and YAML parsers in Go handle edge cases in ways that have repeatedly resulted in high-impact security issues in production systems. We explore three real-world attack scenarios…
1103
Why SSL was renamed to TLS in late 90s (2014)
The Netscape/Microsoft browser wars in the mid-90's were really vicious and competitive. They really had it out for each other. Netscape had...
1104
Design Patterns for Securing LLM Agents Against Prompt Injections
This new paper by 11 authors from organizations including IBM, Invariant Labs, ETH Zurich, Google and Microsoft is an excellent addition to the literature on prompt injection and LLM security. …
1105
A dark adtech empire fed by fake CAPTCHAs
Late last year, security researchers made a startling discovery: Kremlin-backed disinformation campaigns were bypassing moderation on social media platforms by leveraging the same malicious advertising technology that powers a sprawling ecosystem of online hucksters and website hackers. A new report on the fallout…
1106
Frequent reauth doesn't make you more secure
Securely connect to anything on the internet with Tailscale. Built on WireGuard®️, Tailscale enables you to make finely configurable connections, secured end-to-end according to zero trust principles, between any resources on any infrastructure.
1107
My Mac contacted 63 different Apple owned domains in an hour, while not is use
During a one hour period today, my computer contacted 63 different Apple domains while i was not logged on and using it. I have been trying to minimize to the extent possible the reach of big tech into my life. A full 25% of the DNS queries from one of my computers (M2 MBA with macOS 15.4) are to Apple owned domains …
1108
Ruby on Rails Audit Complete
The Open Source Technology Improvement Fund is proud to share the results of our security audit of Ruby on Rails . Ruby on Rails (or “Rails”) is an open source full stack web-application framework. Thanks to the help of X41 D-Sec , GitLab , and the Sovereign Tech Agency , Rails can provide more secure versions of the…
1109
How much EU is in DNS4EU?
This is another post that started after several toots on mastodon. Most of the things presented here were already tooted by other people, but I think this is a good chance to write a mini tutorial about what to look at. We’ll use DNS, whois, BGP and your favourite search engine. What is DNS4EU? To quote the web page…
1110