3631
New Linux vulnerability affecting cgroups: can containers escape?
CVE-2022-0492 is the third recent kernel vulnerability that allows malicious containers to escape. We offer root cause analysis and mitigations.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
3632
Attackers exploit flaw in web’s security to steal $2M in cryptocurrency
By Henry Birge-Lee, Liang Wang, Grace Cimaszewski, Jennifer Rexford and Prateek Mittal On Thursday, Feb. 3, 2022, attackers stole approximately $2 million worth of cryptocurrency from users of the Korean crypto exchange KLAYswap. This theft, which was detailed in a Korean-language blog post by the security firm S2W…
3633
New PHP Vulnerability:?-s may expose source code for mod_cgi
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
3634
3635
Gambling and Adult content DNS blocking using Mullvad VPN
We have expanded our DNS blocking service with Gambling and Adult content filters!
3636
Handling App Transport Security in iOS 9
The rollout of iOS 9 is expected to come this Fall and will introduce a new privacy feature called App Transport Security (ATS) to enforce ...
3637
3638
Retrofitting Temporal Memory Safety on C++
Eliminating use-after-frees vulnerabilities in Chrome with heap scanning.
3639
Security flaws in an SSO plugin for Caddy (2023)
We identified 10 security vulnerabilities within the caddy-security plugin for the Caddy web server that could enable a variety of high-severity attacks in web applications, including client-side code execution, OAuth replay attacks, and unauthorized access to resources. During our evaluation, Caddy was deployed as a…
3640
BIMI and DMARC Can't Save You: The Overlooked DKIM Exploit
Analysts at Zone.eu, one the leading domain registrars and web hosting providers in Europe, have observed a vulnerability affecting the global e-mail ecosystem, stemming from unaddressed warnings in the DomainKeys Identified Mail (DKIM) standard that puts billions of users in risk. This is not an issue in a particular…
3641
Computer scientists develop 'mathematical jigsaw puzzles' to encrypt software
The "software obfuscation" system encrypts software so that it only allows someone to use a program as intended while preventing any deciphering of the code behind it.
3642
Adventures in Video Conferencing Part 1: The Wild World of WebRTC
Posted by Natalie Silvanovich, Project ZeroOver the past five years, video conferencing support i...
3643
3644
We found a phone with pre-installed malware via the Lifeline Assistance program
We discovered yet another phone model with pre-installed malware provided from the Lifeline Assistance program via Assurance Wireless by Virgin Mobile.
3645
Tor Browser 15.0
Tor Browser 15.0 is now available, featuring an update to Firefox ESR 140, improvements to tab management and the address bar on desktop, and screen lock for Android.
3646
Google Address Sanitizer ("compile-time valgrind") to be part of GCC 4.8
This is the mail archive of the gcc-patches@gcc.gnu.org mailing list for the GCC project .
3647
GhostRace: Exploiting and mitigating speculative race conditions
Exploiting and Mitigating Speculative Race Conditions GhostRace: CVE-2024-2193 Race conditions arise when multiple threads attempt to access a shared resource without proper synchronization, often leading to vulnerabilities such as concurrent use-after-free. To mitigate their occurrence, operating systems rely on…
3648
Executing non-alphanumeric JavaScript without parentheses
I decided to look into non-alphanumeric JavaScript again and see if it was possible to execute it without parenthesis. A few years ago I did a presentation on non-alpha code if you want some more info
3649
Early Cascade Injection: From Windows process creation to stealthy injection
Get an introdcution to Early Cascade, a novel process injection technique that is effective against top tier EDRs while avoiding detection.
3650
Zooming in on Zero-Click Exploits
Posted by Natalie Silvanovich, Project Zero Zoom is a video conferencing platform that has ...
3651
'Reptar', a new CPU vulnerability
A new CPU vulnerability, ‘Reptar,’ found by Google researchers, has been patched by Google and Intel. Here’s what you need to know.
3652
ChatGPT's image generator can be manipulated to produce violent, sexual content
Mindgard reveals how ChatGPT's image generation safety filters can be bypassed with minor prompt adjustments, producing graphic violent and sexual content without users directly asking for it. Here's what was found, and why it matters.
3653
Platforms systematically removed a user because he made "most wanted CEO" cards
On December 14, James Harr, the owner of an online store called ComradeWorkwear, announced on social media that he planned to sell a deck of “Most Wanted CEO” playing cards, satirizing the infamous “Most-wanted Iraqi playing cards” introduced by the U.S. Defense Intelligence Agency in 2003. Per the...
3654
Chrome and Edge are removing XSLT: what breaks and what does not
Chrome 158 stops running XSLT on 17 November 2026. What it does to your XML sitemap, your feeds and your crawling, with a before and after capture.
3655
TikTok and WeChat: Curating and controlling global information flows
Curating and controlling global information flows What’s the Problem? While most major international social media networks remain banned from the Chinese market in the People’s Republic of China (PRC), Chinese social media companies are expanding overseas and building up large global audiences. Some of those…
3656
Bitcoin Users Reveal More Private Information Than They Realize
Most people think bitcoin is anonymous. In fact, new technologies trace BTC transactions, attempting to identify bitcoin users.
3657
3658
Kaspersky: Poorly detected backdoor targeting governments and NGOs around globe
Kaspersky experts have brought to light a poorly detected SessionManager backdoor that was set up as a malicious module within the Internet Information Services (IIS), a popular web server edited by Microsoft. Once propagated, SessionManager enables a wide range of malicious activities, starting from collecting emails…
3659
Multiple 7-Zip Vulnerabilities Discovered
7-Zip vulnerabilities were discovered by Marcin Noga. Update 2016-05-12: Related advisories for the 7-Zip issues covered in this blog can be found here: http://www.talosintel.com/reports/TALOS-2016-0093/ http://www.talosintel.com/reports/TALOS-2016-0094/ 7-Zip is an open-source file
3660
New Java 0-day exploit spotted in the wild.
The latest cybersecurity trends, best practices, security vulnerabilities, and more.