Every blog post that took off on Hacker News, ranked by the votes of its best submission. 718 posts.
this has been bothering me for a while now, so I want to write down my thoughts so I can get it out of my head and move on. we’re gonna talk about how Deno approaches security, specifically with its permissions system, and why I think this approach is fundamentally insecure and misleading.
Leak show feds tracking anti-ICE Reddit users like "Budget-Chicken-2425"
Every end-to-end encrypted messenger ships a fingerprint UI. Almost nobody opens it. A note on what's actually missing.
Part 1 of a series that takes an unprivileged Android app to root on Samsung, Xiaomi, and Oppo/OnePlus/Realme devices, with a single strategy.
… optional, that is. I’ve been working on an NSFW filter for Marginalia Search, as that is something some people have asked for, primarily API consumers. The search engine has had some domain based filtering for a while, based on the UT1 lists, but that isn’t a very comprehensive approach. We’ll land on a single…
When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflare's security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation.
Yes, I do—and probably more than I should admit. But a few things led to this situation. For one, I’d gotten too used to relying on Touch ID. As a result, if my muscle memory failed me, I was stuck. On top of that, I kept entering my office Active Directory (AD) password instead of my Mac password—again, muscle memory…
A vulnerability in Broadcom’s proprietary WPS implementation enables unauthenticated attackers within WiFi range to leak memory and achieve unauthenticated remote code execution on millions of routers. This post covers its discovery through agentic vulnerability research, exploitation across eCos and Linux platforms…
The following is a summary of an internal research project conducted by Hudson H. and Andrew G.
OpenAI responds to the Axios supply chain attack by rotating macOS code signing certificates, updating apps, and confirming no user data was compromised.
Show issues fixed only in OpenSSL 4.0 , 3.6 , 3.5 , 3.4 , 3.3 , 3.2 , 3.1 , 3.0 , 1.1.1 , 1.1.0 , 1.0.2 , 1.0.1 , 1.0.0 , 0.9.8 , 0.9.7 , 0.9.6 .
Data-only attacks, those that do not affect a program’s control flow, have long been considered too sophisticated and niche to pose a practical threat. With our research, however, we have built a tool that automatically generates them with surprising ease. We explain how such attacks work, and why our tool, Einstein…
On the irony of cameras built to police Iranians becoming the regime’s Achilles’ heel
Series: I read it so you don't have to
Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this
For the past week, the massive “Internet of Things” (IoT) botnet known as Kimwolf has been disrupting The Invisible Internet Project (I2P), a decentralized, encrypted communications network designed to anonymize and secure online communications. I2P users started reporting disruptions in the network around the same…
Published: 10-04-2026 19:37 | Author: Remy van Elst | Text only version of this article
Extracting my gym’s QR check-in from its Flutter app, with a rooted phone and a lot of ripgrep.
TL;DR: is your refrigerator running malware? If so, you better catch it!
We turned zkao (our AI auditor) on OpenVM, a state-of-the-art zkVM, and it found a critical soundness bug: the pairing check accepted a prover-supplied witness without proper subfield checking, which lets a malicious prover forge any pairing equality. It is fixed in OpenVM 1.6.0 and tracked as CVE-2026-46669. This is…
The PGP problem
We identified coordinated distillation attacks using ~24,000 fraudulent accounts to extract Claude's capabilities.
Future Claude models will generate text that contains a watermark to comply with the EU AI Act. We answer questions about how it works and whether it affects outputs.
We’ve trained a large-scale unsupervised language model which generates coherent paragraphs of text, achieves state-of-the-art performance on many language modeling benchmarks, and performs rudimentary reading comprehension, machine translation, question answering, and summarization—all without task-specific training.
Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.
A tale of two PHP remote vulnerabilities
Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version. Successful exploits of the…
