211
Cloudflare's AI Psychosis
There was a time Cloudflare just made the internet better by staying hidden like Batman’s identity: protect & fight the bad people, for the sake of the global city of the Gotham… err I mean the in
New
The latest blog posts to take off on Hacker News. 8,768 posts.
212
Going Dark, and the era of law enforcement hacking
I’m coming down from spending a few days at Usenix Security, right here in my hometown of Baltimore. This means that my days have been taken up with two kinds of conversation: first, explaini…
213
How Claude's text watermarking works
Future Claude models will generate text that contains a watermark to comply with the EU AI Act. We answer questions about how it works and whether it affects outputs.
214
Google is making private AI practical with homomorphic encryption
Today we're excited to showcase HEIR, the latest powerful tool added to our Private Computing Toolkit. HEIR is an open source compiler that unlocks cryptographically-sec…
215
How AI text watermarking works
A gentle visual guide to how a statistical mark hides inside generated text, and what erases it.
216
Text AI watermarks will always be trivial to remove
The European Union AI Act will begin to be enforceable in August 2026, one month from now. One of the biggest new requirements is Article 50, which requires all…
217
License plate reader searches should require a warrant
So while I work with police departments regularly, I think it is critically important that technology be used reasonably. While this may be off-putting to some of my clients, I worked with the Inst…
218
Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot
A continuously updating analysis of bot vs. human traffic, AI training, fetching, search indexing, browsing, robots.txt compliance, and AI chat referrals across 5,000+ websites.
219
220
GPT 5.6 Cyber
Meet GPT-5.6-Cyber, OpenAI’s cybersecurity-specific model available through Daybreak Red for authorized vulnerability research, exploit validation, and security testing.
221
Tl;dv: Over 180k meetings left wide open
How a missing Firestore security rule on tl;dv exposed 181,874 meetings from 84,312 users across 35,003 domains, including live calls I could join uninvited, and how six months of disclosure got me nothing but seen receipts.
222
What Happened to HackerOne?
The rise and fall of the largest bug bounty platform in the world
223
CSS: The bomb inside your inbox
Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this
224
Timeline of the OpenAI accidental attack against Hugging Face
OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about “the Hugging Face Incident” (previously on this blog). The video was published yesterday. It’s short and information …
225
Responding to the next frontier of critical cyber capabilities
OpenAI is sharing preliminary cybersecurity evaluations for Astra and the steps we’re taking to strengthen safeguards and security controls.
226
Welcoming the Nepalese Government to Have I Been Pwned
Today, we welcome the 47th government onboarded to Have I Been Pwned’s free gov service: Nepal. Their National Cyber Security Centre now has access to monitor Nepalese government domains against the data in HIBP. This gives the NCSC the ability to identify exposure across government email addresses and respond
227
Can you reverse engineer an ASIC?
Earlier this year we published a puzzle that handed you a complete neural network and asked you to figure out what it did. The response was great, so we’ve made another one! This time, we’re going much deeper down the tech stack.
228
Humans missed 1 in 3 threats approving AI agent commands across 40k game runs
Results from AI agent permission game: which attacks beat human reviewers, and which safe commands got blocked instead.
229
Atlassian Rovo Exfiltrates Data, Bypassing Controls
Atlassian AI ‘Rovo’ is susceptible to zero-click data exfiltration via indirect prompt injection, bypassing organization-level web search controls.
230
IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay
WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic…
231
Web Security is Too Hard
It started innocently enough. I saw a tweet about a new product offering from one of my favorite companies, Cloudflare. Neat! I clicked through to the site and there it is: And huzzah!, my preferre…
232
Mistral's Shieldstral: 3B open-weights model for multimodal moderation
Shieldstral introduces a 3B open-weights multimodal safety classifier that outperforms models up to 7x its size.
233
Online ad giant Adform was hacked, proving once again why ad blockers are needed
The hacked digital advertiser was caught serving malicious ads that allowed hackers to steal a victim's cryptocurrency.
234
Keyv and friends compromised in active Shai-Hulud supply chain attack
Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account
235
SQLite Critical CVEs or LLM Slop?
The JFrog security research team recently identified a supply chain attack targeting the `xinference` package on PyPI. Versions 2.6.0, 2.6.1, and 2.6.2 were compromised and yanked by maintainers after users reported suspicious behavior. If you installed or imported these versions, you must assume your environment is…
236
What DMARC Protects You From, and What It Does Not
DMARC verifies a domain owner authorised an email; it does not verify the email is safe. Where DMARC helps, where it falls short, and why authentication is not trust.
237
Rooting, firmware analysis and persistent credentials of TP-Link TL-841N
round 2: rooting & analysing firmware of the TP-Link TL-WR841N
238
A Surveillance Treaty in Disguise: Canada Signs UN Cybercrime Convention
Last week, the government announced that Canada has signed the United Nations Convention against Cybercrime, with Ministers Anita Anand, Gary Anandasangaree and Sean Fraser touting the treaty’s child protection provisions and human rights safeguards, which were described as “among the strongest found in an…
239
Tailscale didn't stop the Hugging Face intrusion
An AI agent used a stolen Tailscale auth key at Hugging Face. Workload identity federation, flow logs, and safer defaults could have reduced the risk.
240
Authorize, don't authenticate
Hold on to your data by keeping it in your own database