541
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 679 posts.
542
Firefox Forcing LLM Features
Mozilla forcing llm features and providing no gui for users to disable them
543
Toyota runs a car-hacking event to boost security (2024)
Toyota organizes a car-hacking event that captivates participating students. We uncovered the important purpose behind the event. #TOYOTATIMES
544
How did Facebook intercept competitor's encrypted mobile app traffic? (2024)
A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.
545
Critical RCE Vulnerabilities in React and Next.js
React2Shell (CVE-2025-55182) is a critical RCE vulnerability in React Server Components. Learn which versions are impacted and how to mitigate.
546
Reverse Engineering US Airline's PNR System and Accessing All Reservations
Timeline & Responsible Disclosure
547
Would You Like an IDOR With That? Leaking 64m McDonald's Job Applications
When applying for a job at McDonald's, over 90% of franchises use "Olivia," an AI-powered chatbot. We discovered a vulnerability that could allow an attacker to access more than 64 million job applications. This data includes applicants' names, resumes, email addresses, phone numbers, and personality test results.
548
There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman
When I first learned about Diffie-Hellman and especially elliptic curve Diffie-Hellman, I had one rather obvious question: Why elliptic curves? Why use this strange group that seems rather arbitrar…
549
PyPI Prohibits inbox.ru email domain registrations
We have prohibited new registrations of accounts using inbox.ru email domains.
550
Critical vulnerability in LangChain – CVE-2025-68664
Check Point's AI Security Solutions deliver AI-driven threat prevention and unified security management for advanced protection across enterprise networks.
551
Constructing the Word's First JPEG XL MD5 Hash Quine
A walk through of building an image that displays its own MD5 Hash
552
Parse, Don’t Validate – Some C Safety Tips
“A good programmer is someone who looks both ways before crossing a one-way street.” – Doug Linder
553
Decoding the 90s: Cryptography in Early Software Development (2023)
In August 2020 we were commissioned to recover a cache of locked QText documents from the mid-90s. This is the process of analyzing the encrypted documents and reverse engineering a DOS-era Hebrew-English word processor written in Turbo Pascal.
554
AirBorne: Wormable zero-click remote code execution (RCE) in AirPlay protocol
Oligo Security reveals AirBorne, a new set of vulnerabilities in Apple’s AirPlay protocol and SDK. Learn how zero-click RCEs, ACL bypasses, and wormable exploits could endanger Apple and IoT devices worldwide — and how to protect yourself.
555
A bit more on Twitter/X's new encrypted messaging
Update 6/10: Based on a short conversation with an engineering lead at X, some of the devices used at X are claimed to be using HSMs. See more further below. Matthew Garrett has a nice post about T…
556
Testing “Exotic” P2P VPN
My standard "everyday" solution when it comes to connecting computers into a single network is Wireguard. Wireguard is good, supports p2p, and generally has no downsides.
557
The $1.5B Bybit Hack
The $1.5B Bybit Hack demonstrates how the Era of Operational Security Failures has arrived, and most cryptocurrency companies are not prepared for its implications.
558
No Instagram, no privacy
This means that I am oblivious to all of my friends’ fun broadcasted on Instagram. I don’t feel pressured either to update the abstract audience of everyone I ever connected with online, on where I am, what I am doing or who I am hanging out with.
559
560
GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)
This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer’s machine in GitHub …
561
The dark side of account bans
I recently lost my Facebook account for two months, and was significantly cut off from certain aspects of society during that time. This is the dark side of account bans.
562
563
Reverse Engineering Apple's typedstream Format
imessage-exporter ’s goal is to provide the most comprehensive representation of iMessage data available. Message data is stored in a legacy format that appears to be a stream that represents objects.
564
Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass
Binarly uncovers CVE-2025-3052: a Secure Boot bypass affecting most UEFI devices, enabling attackers to run unsigned code before OS load.
565
Hiding secret codes in light protects against fake videos
A team of Cornell computer science researchers has developed a way to “watermark” light in videos, which they can use to detect if video is fake or has been manipulated, another potential tool in the fight against misinformation.
566
Top Secret: Automatically filter sensitive information
Automatically filter sensitive information before sending it to external services or APIs, such as chatbots and LLMs.
567
Achieving Great Privacy with Safari
Browsers have always been an arena for fighting and flaming over why your browser is the best and has the most features, while all others are inferior and un...
568
What is gVisor?
It has been a really long time since I last wrote something here as life happens, things get busier, etc etc. I am now trying to get back into writing things down and here we go! So, imagine a tool or a service that allows you to run some arbitrary code via a shell. Either through a ssh or more commonly, via a web…
569
CVE 2025 31200
Background On April 16, 2025, Apple released a patch for a bug in CoreAudio which they said was “Actively exploited in the wild.” This flew under the radar a bit. Epsilon’s blog has a great writeup of the other bug that was presumably exploited in this chain: a bug in RPAC. The only thing out there that I am aware of…
570
