1351
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,440 posts.
1352
1353
1354
Python malware on the rise
The vast majority of serious malware over the past 30 years has been written in Assembly or compiled languages such as C, C++, and Delphi. However,…
1355
1356
Put an io_uring on it: Exploiting the Linux kernel
How much do you know about system calls and how they introduce security risks? We shed light on these interactions and how security teams monitor them.
1357
Popular GitHub Action tj-actions/changed-files is compromised
Popular GitHub Action tj-actions/changed-files has been compromised with a payload that appears to attempt to dump secrets, impacting thousands of CI pipelines.
1358
European govt air-gapped systems breached using custom malware
ESET Research analyzed two separate toolsets for breaching air-gapped systems, used by a cyberespionage threat actor known as GoldenJackal.
1359
1360
PIA open-sources and announces audit plans
The VPN industry looks just like the world of religion - everyone has their different beliefs on who to trust. However, even the diamond in the rough lied
1361
White House Deletes TSA Petition
At approximately 11:30 am EDT, the White House removed a petition about the TSA airport screening procedures from the White House
1362
Big no on Big Sur: Mullvad disallows Apple apps to bypass firewall
Despite Apple’s changes to macOS with the release of Big Sur, we can confirm that the Mullvad app still performs as intended by not allowing Apple’s own apps to bypass our VPN firewall.
1363
1364
Creative usernames and Spotify account hijacking
Spotify supports unicode usernames which we are a bit proud of (not many services allow you to have ☃, the unicode snowman, as a username). However, it has also been a reliable source of pain over the years. This is the story of one time when it bit us pretty badly and how we spent Easter dealing with it.
1365
CISA passes Senate
CISA passed the Senate today in a 74-21 vote. The bill is fundamentally flawed due to its broad immunity clauses, vague definitions, and aggressive spying authorities. The bill now moves to a conference committee despite its inability to address problems that caused recent highly publicized...
1366
Attack campaign involving stolen OAuth tokens issued to third-party integrators
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our…
1367
EFF: Show Support for the Fourth Amendment
This Fourth of July, EFF will be demonstrating our commitment to your Constitutional right of privacy from government surveillance by displaying the text of the Fourth Amendment on our website. This demonstration is a visual symbol of our opposition to the illegal and unconstitutional surveillance...
1368
Yubico and Microsoft Introduce Passwordless Login
The Security Key by Yubico with FIDO2 enables passwordless login for Windows 10 devices and Microsoft Azure Active Directory.
1369
Microsoft actions following attack by nation state actor Midnight Blizzard
Microsoft Security Response Center Blog
1370
How we protect our most sensitive secrets from the most determined attackers
As a bank, we have a lot of secrets we need to protect to keep our customers and ourselves safe. These include private keys that only we know, which we use to digitally sign requests as coming from us (sort of like a private password). These private keys are super important and are used all over Monzo and when…
1371
Someone is impersonating us in a recruiting scam
Our startup was recently the center of an elaborate recruiting scam. What do other companies do if they realize that someone is impersonating them to attack vulnerable job seekers? This article gives advice to job seekers and shares our story.
1372
Rubygems.org AWS Root Access Event – September 2025
As part of standard incident-response practice, Ruby Central is publishing the following post-incident review to the public. This document summarizes the September 2025 AWS root-access event, what occurred, what we verified, and the actions we’ve taken to strengthen our security processes.
1373
Young people in 13 EU countries refuse surveillance of online communication
Poll: the 80% would not feel comfortable being politically active or exploring their sexuality if authorities can monitor their communication.
1374
Task_t considered harmful
Posted by Ian Beer, Project ZeroThis post discusses a design issue at the core of the XNU kernel ...
1375
The Mirai Botnet Is Proof the Security Industry Is Broken
Appcanary makes sure you never run vulnerable software on your servers. Like our blog? Subscribe to our newsletter or podcast . Browse the archive , or follow us on twitter , github or rss .
1376
SHA-1 'fully and practically broken' by new collision (2020)
Independent security journalism: news and analysis on intrusions, vulnerabilities, AI, policy and the software supply chain, plus video and podcasts.
1377
Passwordless authentication: Secure, simple, and fast to deploy
Passwordless is an authentication middleware for Node.js that improves security for your users while being fast and easy to deploy. The last months were very exciting for everyone interested in ...
1378
The V8 Sandbox
V8 features a lightweight, in-process sandbox to limit the impact of memory corruption bugs
1379
Police Documents on License Plate Scanners Reveal Mass Tracking
Automatic license plate readers are the most widespread location tracking technology you’ve probably never heard of. Mounted on patrol cars or stationary objects like bridges, they snap photos of every passing car, recording their plate numbers, times, and locations. At first the captured plate data was used just to…
1380
The Many Possibilities of iMessage File Vulnerability
Posted by Natalie Silvanovich, Project ZeroCVE-2019-8646 is a somewhat unusual vulnerability I re...