1231
Public secrets exposure leads to supply chain attack on GitHub CodeQL
An exposed GitHub token could have been used to launch a supply chain attack on GitHub CodeQL, resulting in source code exposure and repository tampering of CodeQL users.
New
The latest blog posts to take off on Hacker News. 8,770 posts.
1232
Everyone knows all the apps on your phone
Until a few years ago, any app you installed on an Android device could see all other apps on your phone without your permission.
1233
We hacked Gemini's Python sandbox and leaked its source code (at least some)
Leaked Google's internal google3 source and confidential security protos out of Gemini's Python sandbox by exfiltrating a 579 MB binary in 10 MB chunks.
1234
Blasting Past WebP - An analysis of the NSO BLASTPASS iMessage exploit
An analysis of the NSO BLASTPASS iMessage exploit Posted by Ian Beer, Google Project Zero On Se...
1235
How to Delete Your 23andMe Data
This week, the genetic testing company 23andMe filed for bankruptcy, which means the genetic data the company collected on millions of users is now up for sale. If you don't want your data included in any potential sale, it’s a good time to ask the company to delete it.
1236
Malware found on NPM infecting local package with reverse shell
For the first time, RL researchers discover malicious locally-installed npm packages infecting other legitimate packages.
1237
Hyperlight WASM: Fast, secure, and OS-free
We're announcing the release of Hyperlight Wasm: a Hyperlight virtual machine “micro-guest” that can run wasm component workloads written in many programming languages. Learn more.
1238
Whose code am I running in GitHub Actions?
I wanted to know what third-party code I was using in my GitHub Actions. I was able to use standard text processing tools and shell pipelines to get a quick tally.
1239
Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
OPKSSH (OpenPubkey SSH) is now open-sourced as part of the OpenPubkey project. This enables users and organizations to configure SSH to work with single sign-on technologies like OpenID Connect, removing the need to manually manage & configure SSH keys without adding a trusted party other than your IdP.
1240
Entropy Attacks
The conventional wisdom is that hashing more entropy sources can't hurt: if H is any modern cryptographic hash function then H(x,y,z) is at least as good a random number as H(x,y), no matter how awful z is. So we pile one source on top of another, hashing them all together and hoping that at least one of them is good.
1241
A Sneaky Phish Just Grabbed My Mailchimp Mailing List
You know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish has grabbed my credentials, logged into my account and exported
1242
I won't connect my dishwasher to your cloud
This weekend I had to buy a new dishwasher because our old GE died. I bought a Bosch 500 series because that's what Consumer Reports recommended, and more importantly, I could find one in stock. After my dad and I got it installed, I went to run a rinse cycle, only to find that that, along with features like delayed…
1243
Achieving Great Privacy with Safari
Browsers have always been an arena for fighting and flaming over why your browser is the best and has the most features, while all others are inferior and un...
1244
Heap-overflowing Llama.cpp to RCE
Retr0's Threat Research
1245
Next.js version 15.2.3 has been released to address a security vulnerability
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
1246
1247
NixOS and reproducible builds could have detected the xz backdoor
In March 2024, a backdoor was discovered in xz, a (de)-compression software that is regularly used at the core of Linux distributions to unpack source tarballs...
1248
When you deleted /lib on Linux while still connected via SSH (2022)
Let's first not talk about why this can happen, but deleting /lib, /usr/lib, or some other essential runtime files happens quite a lot (as you can see: here, here, here, and here). In this post, I will only discuss what happens when you delete /lib on Linux and how to recover from that. The easy
1249
France rejects backdoor mandate
In a moment of clarity after initially moving forward a deeply flawed piece of legislation, the French National Assembly has done the right thing: it rejected a dangerous proposal that would have gutted end-to-end encryption in the name of fighting drug trafficking.
1250
New USPTO Memo Makes Fighting Patent Trolls Even Harder
The U.S. Patent and Trademark Office (USPTO) just made a move that will protect bad patents at the expense of everyone else. In a memo released February 28, the USPTO further restricted access to inter partes review, or IPR—the process Congress created to let the public challenge invalid patents...
1251
Leaking Passwords and more on macOS
A security research blog.
1252
I fear for the unauthenticated web
LLM and AI companies seem to all be in a race to breathe the last breath of air in every room they stumble into. This practice started with larger websites, ones that already had protection from ma...
1253
Grease: An Open-Source Tool for Uncovering Hidden Vulnerabilities in Binary Code
We take pride in personally connecting with all interested partners, collaborators and potential clients. Please email us with a brief description of how you would like to be connected with Galois and we will do our best to respond within one business day.
1254
Block AI Scrapers with Anubis proof-of-work
I got tired with all the AI scrapers that were bullying my git server, so I made a tool to stop them for good.
1255
Doge to Fired CISA Staff: Email Us Your Personal Data
A message posted on Monday to the homepage of the U.S. Cybersecurity & Infrastructure Security Agency (CISA) is the latest exhibit in the Trump administration’s continued disregard for basic cybersecurity protections. The message instructed recently-fired CISA employees to get in touch so they can be rehired and then…
1256
1257
Memory safety for web fonts
Learn how and why the Chrome team has replaced FreeType with Skrifa.
1258
Trapping misbehaving bots in an AI Labyrinth
How Cloudflare uses generative AI to slow down, confuse, and waste the resources of AI Crawlers and other bots that don’t respect “no crawl” directives.
1259
1260
CVE-2024-9956 – PassKey Account Takeover in All Mobile Browsers
Phishing PassKeys credentials using browser intents