151
Cryptographic Issues in Cloudflare's Circl FourQ Implementation (CVE-2025-8556)
The vulnerabilities we found in Cloudflare's CIRCL FourQ implementation: invalid-point attacks, Edwards-curve edge cases, and the disclosure that fixed them.
New
The latest blog posts to take off on Hacker News. 679 posts.
152
Linux Capabilities Revisited
Technical blog by Stephan Berger (@malmoeb)
153
The security paradox of local LLMs
Local LLMs prioritize privacy over security. Our research reveals a 95% backdoor injection success rate.
154
Introduction to reverse-engineering vintage synth firmware
A gentle introduction to reverse-engineering vintage synthesiser ROMs using the Ghidra disassembler.
155
Could the XZ backdoor been detected with better Git/Deb packaging practices?
The discovery of a backdoor in XZ Utils in the spring of 2024 shocked the open source community, raising critical questions about software supply chain security. This post explores whether better Debian packaging practices could have detected this threat, offering a guide to auditing packages and suggesting future…
156
Improving PixelMelt's Kindle Web Deobfuscator
A few days ago, someone called PixelMelt published a way for Amazon's customers to download their purchased books without DRM. Well… sort of. In their post "How I Reversed Amazon's Kindle Web Obfuscation Because Their App Sucked" they describe the process of spoofing a web browser, downloading a bunch of JSON files…
157
4Chan Lawyer publishes Ofcom correspondence
Ofcom — driven by the letter of British law that they are bound to follow, but still Ofcom — are quietly making Britain look (a) very silly and (b) as if we haven’t yet shucked-off the Americ…
158
Free the Internet: The Tor Project's annual fundraiser
This year we are calling to FREE THE INTERNET. Your donation will help break the chains of censorship and surveillance. If you give now during the campaign, your donation will be matched by our supporters at Power Up Privacy. This means a $25 donation will have a $50 impact.
159
How I bypassed Amazon's Kindle web DRM
As it turns out they don't actually want you to do this (and have some interesting ways to stop you)
160
161
A kernel stack use-after-free: Exploiting Nvidia's GPU Linux drivers
This article details two bugs discovered in the NVIDIA Linux Open GPU Kernel Modules and demonstrates how they can be exploited. The bugs can be triggered by an attacker controlling a local unprivileged process. Their security implications were confirmed via a proof of concept that achieves kernel read and write…
162
Pwning the Nix ecosystem
ptrpaws's blog on reverse engineering, programming, vr finds and miscellaneous stuff.
163
I almost got hacked by a 'job interview'
I was 30 seconds away from running malware, Here's how a sophisticated scam operation almost got me, and why every developer needs to read this.
164
Bots are getting good at mimicking engagement
Click fraud protection in one tool: DataCops flags bot clicks, blocks repeat bots at your Cloudflare edge, keeps them out of the conversions 8 ad platforms learn from, and exports Google refund evidence.
165
Europe's Digital Sovereignty Paradox – "Chat Control" Update
Can you build tech independence while breaking encryption?
166
AppLovin nonconsensual installs
Mobile adtech juggernaut AppLovin recently faced multiple allegations of misconduct . Allegations run the gamut—privacy, ad targeting, even national security and ties to China. I was among the researchers consulted by skeptical investors this spring, and I was quoted in one of their reports, explaining my concerns…
167
A modern approach to preventing CSRF in Go
My new book guides you through the start-to-finish build of a real world web application in Go — covering topics like how to structure your code, manage dependencies, create dynamic database-driven pages, and how to authenticate and authorize users securely .
168
Let's Not Encrypt (2019)
Let's Discuss the organization providing a false sense of security at an unbeatable price.
169
DDoS Botnet Aisuru Blankets US ISPs in Record DDoS
The world’s largest and most disruptive botnet is now drawing a majority of its firepower from compromised Internet-of-Things (IoT) devices hosted on U.S. Internet providers like AT&T , Comcast and Verizon , new evidence suggests. Experts say the heavy concentration of infected devices at U.S. providers is…
170
Countering Trusting Trust Through Diverse Double-Compiling (DDC)
David A. Wheeler's Page on Countering 'Trusting Trust' through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers
171
GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)
This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer’s machine in GitHub …
172
Three ways formally verified code can go wrong in practice
"Correct" doesn't mean "correct" when correctly using "correct"
173
CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code
Get details on our discovery of a critical vulnerability in GitHub Copilot Chat.
174
Google Safe Browsing incident
For approximately six hours on 25.9.2025, the entire statichost.eu domain was flagged as deceptive by Google Safe Search. This meant that anyone using Google Safe Search was shown a very aggressive warning or outright blocked when trying to access any site on the statichost.eu domain. In some cases even custom domains…
175
A story about bypassing air Canada's in-flight network restrictions
1 Prologue A while ago, I took a flight from Canada back to Hong Kong - about 12 hours in total with Air Canada. Interestingly, the plane actually had WiFi: However, the WiFi had restrictions. For Aeroplan members who hadn’t paid, it only offered Free Texting, meaning you could only use messaging apps like WhatsApp…
176
The RubyGems "Security Incident"
Ruby Central posted an extremely concerning “Incident Response Timeline” today, in which they make a number of exaggerated or purely misleading claims. Here’s my effort to set the record straight. First, and most importantly: I was a primary operator of RubyGems.org, securely and successfully, for over ten years. Ruby…
177
Rubygems.org AWS Root Access Event – September 2025
As part of standard incident-response practice, Ruby Central is publishing the following post-incident review to the public. This document summarizes the September 2025 AWS root-access event, what occurred, what we verified, and the actions we’ve taken to strengthen our security processes.
178
A small number of samples can poison LLMs of any size
Anthropic research on data poisoning attacks shows a few hundred malicious documents can "backdoor" large language models of any size.
179
The weaponization of travel blacklists
[A Federal Air Marshal (FAM) tasked with surveillance of an airline passenger targeted by Quiet Skies lists and/or rules followed the traveler out to the curb and recorded the license plate number of the vehicle in which she left the airport, so that her airline reservations could be integrated with license plate…
180
Become unbannable from your email
You don't own your email; you rent it. This vulnerability leaves your entire digital life at risk. Read how to seize back control of your most critical online asset by switching providers and setting up your own unbannable email server.