271
Fixing a Buffer Overflow in Unix v4 Like It's 1973
This blog post shows how to fix a buffer overflow in the su progam of UNIX v4
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 362 posts.
272
MyFirst Kids Watch Hacked. Access to Camera and Microphone
The smartwatch for children that Gustaf Blomqvist hacked in his thesis turned out to be a security disaster. The watch had an insecure network service that anyone could access via the internet.
273
Running NanoClaw in a Docker Shell Sandbox
Learn how to run NanoClaw, a Claude-powered WhatsApp assistant, inside a Docker Sandboxes shell sandbox for stronger isolation and proxy-managed API keys.
274
Releasing rainbow tables to accelerate Net-NTLMv1 protocol deprecation
Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1.
275
CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root
The Qualys Threat Research Unit has identified a Local Privilege Escalation (LPE) vulnerability affecting default installations of Ubuntu Desktop version 24.04 and later. This flaw (CVE-2026-3888)…
276
GPT‑5.5 Bio Bug Bounty
Details about the OpenAI Bio Bounty program
277
CrowdSec Source Code Leak
CrowdSec update on a source code exposure that occurred in May 2026, including the scope, impact, investigation, and security measures taken.
278
Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console
Wiz Research discovered CodeBreach, a critical vulnerability that risked the AWS Console supply chain. Learn how to secure your AWS CodeBuild pipelines.
279
HardenedBSD Is Now Officially on Radicle
Over the past week, I have been working on bringing HardenedBSD's code repositories on Radicle (as most/all of you already know by now.) We are now at the point where Radicle is usable for us. There are still some sharp edges and some things to work out, but the core functionality is working.
280
281
CPanel and WHM Authentication Bypass – CVE-2026-41940
Hello! Yes, it's all a disaster again! Let's get this party started: 0:00 /0:12 1× No comments today, so imagine this: * We wrote something that we find very funny, * Nobody else gets it, * But everyone humors us Just like a typical watchTowr Labs blog introduction. As
282
A statement on the Tor Project's relationship with Mullvad
Recent concerns about a political donation by a Mullvad co-founder have raised questions about the Tor Project's funding relationship with the company. We are not terminating the relationship but are setting clear boundaries on our relationship with Mullvad.
283
New serious vulnerabilities spiked around release of Claude Mythos Preview
Notable organizations disclosed ~1,300 high- and critical-severity CVEs in June 2026, roughly 3.5× the pre-Mythos monthly record. Epoch AI's breakdown of vulnerability disclosures following Anthropic's Project Glasswing.
284
Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC
Desoldering a drone's flash chip and reconstructing the firmware from broken data.
285
Radicle: Disclosure of Vulnerability in the Network Protocol
Sovereign code infrastructure.
286
Locating a Photo of a Vehicle in 30 Seconds with GeoSpy
This is just a short description for your post which you can edit depending on your needs via the Framer CMS.
287
EFF letter to FTC on X consent order [pdf]
Strong safeguards on our information require eagle-eyed oversight when that data is abused and misused for profiteering ventures. X’s actions not only showed us this in the past, but continue to do so in the present day.
288
U of T researchers demonstrate AI worm could target any online device
A team of researchers at the University of Toronto has discovered a new class of cyberthreat that gives hackers more power and reach at far less cost. It can be built with free AI models. Every online device is a potential target. And current cyber defences are not yet ready for it.
289
Understanding Email Encryption (2025)
A comprehensive overview of how email is encrypted, the benefits, and the trade-offs.
290
Sleeper Shells: Attackers Are Planting Dormant Backdoors in Ivanti EPMM
A February 2026 campaign used a internal JSP path and in-memory Java class loaders to quietly seed persistent access across Ivanti EPMM deployments - then walked away. We break down the tradecraft.
291
Session is shutting down in 90 days
The Session Technology Foundation cannot continue without your support. Donate today to help Session in its fight for survival.
292
CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
If you run a server with cPanel or WHM, you need to read this carefully. On May 8, 2026 — just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware — cPanel quietly released a second emergency security patch. This one covers three new…
293
Ramp's Sheets AI Exfiltrates Financials
A vulnerability in Ramp's Sheets AI allowed the agent to insert formulas that made external network requests without user approval, creating the risk of data exfiltration via indirect prompt injection.
294
Securing our frontier model training environment
OpenAI explains how we strengthened containment for frontier model training and evaluation, including offline environments and high-compute red-teaming.
295
Making frontier cybersecurity capabilities available to defenders
Claude Code Security is one step towards our goal of more secure codebases and a higher security baseline across the industry.
296
Good Bad ISPs
Defend yourself against tracking and surveillance. Circumvent censorship. | Good Bad ISPs
297
California legislature agrees to upload driver's licenses to national database
Withdrawing its opposition under behind-the-scenes pressure from Gov. Gavin Newsom and lawless threats from the US Department of Homeland Security (DHS), the California legislature has agreed to fund and revise state law to authorize the upload of information about all driver’s licenses and ID cards issued by the…
298
Why does mathmain need an encrypted loader?
A math solver leads to encrypted code in npm packages. Follow the loader, the trigger matrix that unlocks it, the remote access payload, and the full indicators.
299
What DMARC Protects You From, and What It Does Not
DMARC verifies a domain owner authorised an email; it does not verify the email is safe. Where DMARC helps, where it falls short, and why authentication is not trust.
300
Prompt Injecting Contributing.md
How a hidden prompt injection in CONTRIBUTING.md revealed that 40% of pull requests to a popular GitHub repository were generated by AI bots