The latest blog posts to take off on Hacker News. 716 posts.
I've always had a soft spot for this particular car brand. Our family has owned a few of them over the years, and they've served us incredibly well. In 2023, I bought a new four wheel drive/SUV from them, and it was the first time I had
Since November 5, Outlook.com and Hotmail have been bouncing mail from domains with no DMARC record, small senders included. What changed, and the one-record fix.
Secure everything coding agents build, use, and ship - prevent risk before code exists, AutoFix the backlog, and protect the coding agents and supply chain.
Every Mac since macOS 13 (2022) ships a pair of daemons whose only purpose in life is to build a graph about who you are, who you know, how those people are related to you and to each other, how you communicate with them, where you go, what you do and when. In this post, we look into how this system works and give you…
Firecracker is supposed to keep untrusted code inside a microVM. We escaped it and achieved code execution as root on the host.
InfoHawk research has uncovered a network of 820 suspicious restaurant domains impersonating major US chains, including Jersey Mike's, Jimmy John's, Firehouse Subs, Chipotle, and Dave's Hot Chicken. Some are running sophisticated payment-skimming attacks that capture credit card information and ask customers for their…
We've identified 15,579 websites that are currently infected with malicious JavaScript and between them, we conservatively estimate that they receive more than 135 million visits every month. We know they're infected, and we have the evidence to back that up, but there's a problem: how on
Extracting my gym’s QR check-in from its Flutter app, with a rooted phone and a lot of ripgrep.
Meet motorola signature 27, Motorola's most advanced flagship smartphone ever with next-gen AI, industry-leading tech, & a distnctive design.
OpenSSH release notes
Research on aligning AI with human values and intent, and reports documenting model failures.
OpenAI built an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel.
Improving the Xbox 360 Bad Update exploit to trigger nearly instantaneously with near 100% success rate.
My ISP was tampering with my DNS queries and handing back bogus IP addresses. Here are the misconceptions about DoH, DoT and DNSSEC that followed, and the setup I actually run.
macOS ships a VulgarWordUsage.db and a dictionary that rates every word as vulgar, offensive or sensitive. Dumped for 199,000 English words and a dozen other languages.
No patched kernels are available yet for 22.04, 24.04, or 26.04 despite a CVSS 9.8 rating.
I shouldn't have to be doing any of this, but at least it's fun.
An attacker gained unauthorized access to environment variables for a subset of organizations. We've blocked the exploit and emailed all impacted account owners with steps to mitigate.
Two lawyers hid a white-on-white instruction inside a court filing telling the AI to go easy on their case. The court's AI caught it. The fine was $16,000.
CVE-2026-98432 is a CVSS 9.8 remote use-after-free in Linux's IPv4 TCP handshake, fixed upstream Oct 15. RHEL has fixes; Ubuntu's are still in testing.
The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets.
By bypassing ChatGPT's sandbox and content security policy, our research team was able to take over anyone's account simply by sending them a link.
A comprehensive overview of how email is encrypted, the benefits, and the trade-offs.
Yesterday, Anthropic were compromised and used to stage a global supply chain attack.
In my previous blog posts, Azure’s Weakest Link? and Azure’s Weakest Link - Full Cross-Tenant Compromise, I gave an overview of the severely insecure architecture behind API Connections in Azure, a part of Azure Logic Apps, and an instance of a full cross-tenant compromise using these inherent flaws. Now I am back…
Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up …
Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.
