1
Motorola Signature 27 with GrapheneOS support
Meet motorola signature 27, Motorola's most advanced flagship smartphone ever with next-gen AI, industry-leading tech, & a distnctive design.
New
The latest blog posts to take off on Hacker News. 8,762 posts.
2
3
OpenSSH 10.6p2 Critical workaround for alpine without PAM
OpenSSH release notes
4
GPT-6 Astra covertly underperforms on safety research
Research on aligning AI with human values and intent, and reports documenting model failures.
5
A thousand fewer paths to root
OpenAI built an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel.
6
Hacking the Xbox 360 Hypervisor Part 3: Bad Update Improvements
Improving the Xbox 360 Bad Update exploit to trigger nearly instantaneously with near 100% success rate.
7
8
So my ISP was hijacking my DNS
My ISP was tampering with my DNS queries and handing back bogus IP addresses. Here are the misconceptions about DoH, DoT and DNSSEC that followed, and the setup I actually run.
9
I dumped Apple’s word list
macOS ships a VulgarWordUsage.db and a dictionary that rates every word as vulgar, offensive or sensitive. Dumped for 199,000 English words and a dozen other languages.
10
Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks
No patched kernels are available yet for 22.04, 24.04, or 26.04 despite a CVSS 9.8 rating.
11
Jailbreaking my car's navigation system just so I can change the time
I shouldn't have to be doing any of this, but at least it's fun.
12
Trigger.dev customer environment variables exposed
An attacker gained unauthorized access to environment variables for a subset of organizations. We've blocked the exploit and emailed all impacted account owners with steps to mitigate.
13
Brazilian Court Sanctions Lawyers for Prompt Injection in Court Filing
Two lawyers hid a white-on-white instruction inside a court filing telling the AI to go easy on their case. The court's AI caught it. The fine was $16,000.
14
TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
CVE-2026-98432 is a CVSS 9.8 remote use-after-free in Linux's IPv4 TCP handshake, fixed upstream Oct 15. RHEL has fixes; Ubuntu's are still in testing.
15
Malware uses LLMs to rank victims by how much they're worth
The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets.
16
Do the math: How we took over ChatGPT accounts
By bypassing ChatGPT's sandbox and content security policy, our research team was able to take over anyone's account simply by sending them a link.
17
Understanding Email Encryption (2025)
A comprehensive overview of how email is encrypted, the benefits, and the trade-offs.
18
19
Claude Code VS Code extension with backdoor released on Cursor marketplace
Yesterday, Anthropic were compromised and used to stage a global supply chain attack.
20
Azure's Weakest Link – Five Full Cross-Tenant Compromises
In my previous blog posts, Azure’s Weakest Link? and Azure’s Weakest Link - Full Cross-Tenant Compromise, I gave an overview of the severely insecure architecture behind API Connections in Azure, a part of Azure Logic Apps, and an instance of a full cross-tenant compromise using these inherent flaws. Now I am back…
21
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up …
22
CVE-2026-98432: 9.8 CVE affecting all Ubuntu versions
Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.
23
Chained PHP2Shell exploit roots 25 servers, including US Government servers
Custom PHP2Shell Exploit Chained with Kernel LPE to Root Versions of Palo Alto Networks PAN-OS Firewalls in the Wild
24
Forging a Microsoft Edge Full Chain with Logic Bugs Only
This is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥
25
26
The case of the 9 bit AES key
Several PDF implementations advertise AES-256, but generate the 256-bit key from either a very small state space, or from insecure random sources.
27
Why is this fingerprinting script creating bioweapons?
I've always had a fascination with reverse-engineering browser fingerprinting scripts. Most of my time has been spent looking at the usual suspects (popular fingerprinting libraries like FingerprintJS and more sophisticated scripts used by anti-bots like Cloudflare Turnstile, Akamai, and others).
28
Apple's git still trusts the compromised eMudhra certificates
Eleven days after Apple was notified of the eMudhra CA compromise, the git, curl and python3 that Apple ships with macOS still trust the compromised certificates.
29
Tips for more effective fuzz testing with AFL++
Fuzz testing is incredibly effective for mechanically discovering software defects, yet remains underused and neglected. Pick any program that must gracefully accept complex input, written in any language , which has not yet been been fuzzed, and fuzz testing usually reveals at least one bug. At least one program…
30
Tailscale SSH: Investigation and remediation update
Securely connect to anything on the internet with Tailscale. Built on WireGuard®️, Tailscale enables you to make finely configurable connections, secured end-to-end according to zero trust principles, between any resources on any infrastructure.