4891
State of Industrial Control Systems in Poland and Switzerland
TL;DR New update for Kamerka allows to map Industrial Control Systems of whole country. As in previous version, interactive map is created…
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,771 posts.
4892
The Kimwolf botnet is stalking your local network
The story you are reading is a series of scoops nestled inside a far more urgent Internet-wide security advisory. The vulnerability at issue has been exploited for months already, and it’s time for a broader awareness of the threat. The short version is that everything you thought you knew about the security of the…
4893
Hidden risk in Notion 3.0 AI agents: Web search tool abuse for data exfiltration
CodeIntegrity research on Notion AI security, Notion 3.0 AI Agents, lethal trifecta risk, indirect prompt injection, web search tool abuse, and data exfiltration.
4894
4895
TLS 1.2 Session Tickets
Session Tickets, specified in RFC 5077 , are a technique to resume TLS sessions by storing key material encrypted on the clients. In TLS 1.2 they speed up the handshake from two to one round-trips.
4896
The Rise of Synthetic Audio Deepfakes
Nisos Resources Library is full of interesting case studies, client success stories, infographics, videos and more. Click to see what we do.
4897
Projects: hijack (Hijacking the iPhone earphone jack)
Hijacking power and bandwidth from the mobile phone's audio interface. Creating a cubic-inch peripheral sensor ecosystem for the mobile phone.
4898
4899
IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay
WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic…
4900
How Torch broke ls and made me vulnerable
If used incorrectly, LD_LIBRARY_PATH can cause a plethora of issues
4901
The Beginner's Guide to Visual Prompt Injections (2023)
Learn about visual prompt injections, their appearance, and top defense strategies against these attacks.
4902
Finding Ticketbleed
Ticketbleed (CVE-2016-9244) is a software vulnerability in the TLS stack of certain F5 products that allows a remote attacker to extract up to 31 bytes of uninitialized memory at a time, which can contain any kind of random sensitive information, like in Heartbleed.
4903
Open Source Security Tools
Explore open source cloud security tools that help teams improve visibility, automate detections, and strengthen modern cloud-native security operations workflows.
4904
4905
4906
The cost of the “new way to message on instagram” (2020)
If you are on Instagram, you have been probably bombarded by Instagram Stories and notifications about new features like emojis, chat themes, selfie stickers, and “cross-platform messaging” that will allow you to exchange direct messages with, and search for, friends who are on Facebook. But the...
4907
Code highlighting extension for Cursor AI used for $500k theft
Kaspersky GReAT experts uncover malicious extensions for Cursor AI that download the Quasar backdoor and a crypto stealer.
4908
4909
When it comes to composition and length, passwords mostly don't matter
When it comes to composition and length, your password (mostly) doesn’t matter.
4910
Kubernetes Exposed: One YAML Away from Disaster
We found two main misconfigurations in Kubernetes clusters belonging to more than 350 organizations openly accessible and largely unprotected.
4911
Guarding My Git Forge Against AI Scrapers
A summary of the techniques in place to protect my git forge
4912
Using GDPR to obtain one’s data as JSON
TL;DR: If you live in the EU or are a EU citizen, companies must provide personal data you provided or they collected in a machine-readable format, following the article 20 of the GDPR.
4913
The agent harness belongs outside the sandbox
Two architectures for running agent harnesses, the tradeoffs between them, and how we make skills and memories work when the harness isn't local.
4914
Mozilla blogger bought 1 million Facebook entries (full name, e-mail) for $5
I have the bloody habit to look for cheap deals on some websites and today I’ve got the featured offer to buy more than 1 million Facebook entries containing Full Name, e-mail and Facebook profile URL. I make a quick check over the data and surprise, surprise: most of them are real and I even know some of those users.
4915
ProtonDrive Security Model
Learn how Proton Drive uses end-to-end encryption to protect your photos, documents, and other sensitive data.
4916
4917
Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)
A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how we addressed the issue.
4918
The epidemic of fraudulent DMCA takedowns
There’s an enormous and largely invisible campaign to use fraudulent notices under the US Digital Millennium Copyright Act to remove critical articles from the internet. We don’t know who is running…
4919
A brief Sony password analysis
So the Sony saga continues. As if the whole thing about 77 million breached PlayStation Network accounts [http://www.theage.com.au/digital-life/games/playstation-privacy-breach-77-million-customer-accounts-exposed-20110427-1dvhf.html] wasn’t bad enough, numerous other security breaches…
4920
Public Beta: December 3, 2015
Let’s Encrypt will enter Public Beta on December 3, 2015. Once we’ve entered Public Beta our systems will be open to anyone who would like to request a certificate. There will no longer be a requirement to sign up and wait for an invitation. Our Limited Beta started on September 12, 2015. We’ve issued over 11,000…