241
Google fixed more Chrome bugs in June than over the past two years, thanks to AI
Chrome uses Gemini AI to automate vulnerability discovery, triage, and patching, accelerating updates to match modern security risks.
New
The latest blog posts to take off on Hacker News. 8,768 posts.
242
Investigating three real-world incidents in our cybersecurity evaluations
We found three cases where a Claude model reached the internet from an evaluation environment and accessed real systems. We share what happened and what we're changing.
243
Read this before you buy that TV streaming stick
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user’s Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof…
244
245
1,741 "informed" consents with one click? GDPR complaint filed
dict.cc requests users to consent to the tracking by 1,741 "partner" companies. This makes it impossible for people to know what happens to their data
246
Some thoughts about Anthropic's new cryptanalysis results
Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAW…
247
San Francisco: Don't Fall for Industry Defense of Surveillance Pricing
The concept of “surveillance pricing” is just one part of a much larger problem and business model: corporations maximizing their profits by invading our privacy. The all-too-common business model is to systematically harvest, collate, and store as much of our personal data as possible, and then...
248
Document-borne AI worms can self-propagate through Copilot for Word
I would like to thank Microsoft product teams and Microsoft Security Response Center (MSRC) for collaborating with me on this technical analysis and mitigation of the disclosed vulnerabilities. The editorial opinions reflected below are solely the author’s and do not necessarily reflect those of the organizations I…
249
Discovering Cryptographic Weaknesses with Claude
Anthropic researchers find weaknesses in cryptographic algorithms with Claude Mythos Preview
250
Italy Blocks Reproductive Health Websites Women on Web and Women Help Women
This report documents the blocking of Women on Web (WoW) and Women Help Women (WHW) domains in Italy based on OONI data.
251
DMARC has been public since 2012 but most company domains still don't enforce it
DMARC has been public since 2012. We checked 67,336 domains: 68.4% still have no policy or one that does not enforce it.
252
Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles
VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.
253
What does GitHub's security team even do?
Right now, there are thousands of repositories on GitHub distributing malware. Any of you can find these repositories, and you don’t need any special knowledge to do so. All you have to do is use the standard search function on the GitHub website. These repositories have been around for
254
255
The relay market powering token resellers and fraud
A look inside the gray-market reseller economy that gives mainland China cheap, structured, B2B-grade access to OpenAI, Anthropic, Google, and beyond
256
257
Memory safety absolutists
When seeing the title of this post, I bet in some people's minds, the first thought was "Rust devs!". This connection is not unfounded. Rust devs tend to be passionate about memory safety. Some of it, I'm sure, may have been caused by a classic language wars attitude: my language is better than yours, and here is why…
258
Android may soon restrict on-device ADB
Changes proposed for ADB could kill an entire ecosystem of open-source power-user apps, mobile developer setups, and rootless privacy tools based on Shizuku.
259
My security camera shipped a GitHub admin token in its login page
i dissected some firmware for a Hanwha Wisenet XNP-9300RW and found that it had github admin tokens in it, also miltech is weird
260
Introducing selfie for sign-in: a new way to access your Google Account
Selfie video gives you more options if you’re ever locked out or don’t have access to your usual phone or computer.
261
Securing Services with Rootless Containers
Some tips to improve security in applications deployed as containers.
262
OpenAI’s accidental attack against Hugging Face is science fiction that happened
This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model’s guardrail features turned off. Rather than solve the test, the …
263
I Inspected My Take-Home Interview Project. It Was a Whole Operation
Appaji, a Computer Science graduate from IIT Patna and former intern at Arista Networks, is a Software Engineer at Infinite Reality. Passionate about building innovative web experiences, with a strong interest in sustainable and customer-focused startups.
264
LG to ban residential proxies from smart TV apps
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s…
265
OpenAI and Hugging Face address security incident during model evaluation
OpenAI and Hugging Face share early findings from a security incident during AI model evaluation, highlighting advanced cyber capabilities and lessons for defenders.
266
Firefox Containers Preview
Today, we’re excited to announce the Preview of Containers in Firefox version 153, which lets you keep separate parts of your online life (work, shopping
267
Apple defeats liability for not scanning iCloud for CSAM
This case involves Apple’s handling of user-uploaded files hosted in private iCloud storage. Instead of adopting PhotoDNA to scan hosted files for CSAM, Apple created its own proprietary alternative, NeuralHash, which apparently wasn’t as good. So Apple U-turned on its...
268
GDID Windows – Cut the tracker that follows you even under VPN
The GDID helped catch a hacker despite his VPN. I set up a VM to see if it can be neutralized: what works, what doesn't, and the scripts to stop it from ...
269
Flock Credibility Lost as It Repeatedly Lies to City Councils, Police, & Public
ACLU documents how surveillance camera company Flock has lied to local officials about its operations
270
The EU is about to sell our most sensitive data to the US for visa-free travel
The leaked draft text suggests that the Commission significantly caved in to US’s excessive demands for unfettered information access.