31
Checkout.com hacked, refuses ransom payment, donates to security labs
Our statement detailing an incident concerning a legacy system. We outline our commitment to transparency, accountability, and planned investment in cyber security research.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 308 posts.
32
The patent office is about to make bad patents untouchable
The U.S. Patent and Trademark Office (USPTO) has proposed new rules that would effectively end the public’s ability to challenge improperly granted patents at the Patent Office itself. We need EFF supporters to file public comments opposing these rules this week. The USPTO is moving quickly, and staying silent will…
33
Flock and Cyble Inc. weaponize “cybercrime” takedowns to silence critics
When a government contractor pays a company for "Takedown Services" to prevent transparency in government
34
Say No to Palantir in the NHS
NHS England is rolling out software to run our health records from Palantir - fight back
35
An update on Mozilla's terms of use for Firefox
On Wednesday we shared that we’re introducing a new terms of use (TOU) and privacy notice for Firefox. Since then, we’ve been listening to some of our
36
By default, Signal doesn't recall
Signal Desktop now includes support for a new “Screen security” setting that is designed to help prevent your own computer from capturing screenshots of your Signal chats on Windows. This setting is automatically enabled by default in Signal Desktop on Windows 11. If you’re wondering why we’re on...
37
Pi-hole v6
We’ve integrated a new REST API and embedded web server directly into the pihole-FTL binary. This eliminates the need for lighttpd and PHP , reducing the installation footprint and boosting performance. The new API also offers server-side pagination for the query log, ensuring a faster and more responsive interface.
38
California law enforcement misused state databases more than 7k times in 2023
The Los Angeles County Sheriff’s Department (LACSD) committed wholesale abuse of sensitive criminal justice databases in 2023, violating a specific rule against searching the data to run background checks for concealed carry firearm permits.The sheriff’s department’s 6,789 abuses made up a majority...
39
Sign in with Google in Chrome
Many websites such as Yelp show an annoying “Sign in with Google” banner when you visit.
40
Data brokers are selling flight information to CBP and ICE
For many years, data brokers have existed in the shadows, exploiting gaps in privacy laws to harvest our information—all for their own profit. They sell our precise movements without our knowledge or meaningful consent to a variety of private and state actors, including law enforcement agencies....
41
Less is safer: Reducing the risk of supply chain attacks
Supply chain attacks are malicious updates that sneak into open source code used by many apps. Here’s how we design Obsidian to ensure that the app is a secure and private environment for your thoughts.
42
Memory Integrity Enforcement
Memory Integrity Enforcement (MIE) is the culmination of an unprecedented design and engineering effort spanning half a decade that combines the unique strengths of Apple silicon hardware with our advanced operating system security to provide industry-first, always-on memory safety protection across our devices …
43
TLS certificate lifetimes will officially reduce to 47 days
The CA/Browser Forum has officially voted to amend the TLS Baseline Requirements to set a schedule for shortening both the lifetime of TLS certificates.
44
GitHub MCP exploited: Accessing private repositories via MCP
We showcase a critical vulnerability with the official GitHub MCP server, allowing attackers to access private repository data. The vulnerability is among the first discovered by Invariant's security analyzer for detecting toxic agent flows.
45
What went wrong inside recalled Anker PowerCore 10000 power banks?
Investigate Anker’s recalled power banks. See how CT scanning uncovers battery defects and improves safety in lithium-ion designs.
46
Google’s OAuth login doesn’t protect against purchasing a failed startup domain
Millions of Americans can have their data stolen right now because of a deficiency in Google’s “Sign in with Google” authentication flow. If you’ve worked for a startup in the past - especially one that has since shut down - you might be vulnerable.
47
Weaponizing image scaling against production AI systems
In this blog post, we’ll detail how attackers can exploit image scaling on Gemini CLI, Vertex AI Studio, Gemini’s web and API interfaces, Google Assistant, Genspark, and other production AI systems. We’ll also explain how to mitigate and defend against these attacks, and we’ll introduce Anamorpher, our open-source…
48
Nx compromised: malware uses Claude code CLI to explore the filesystem
What is s1ngularity-repository? Nx is compromised and the malware steals wallets and API keys using Claude CLI or Gemini.
49
VPN location claims don't match real traffic exits
17 out of 20 popular VPNs exit traffic from different countries than they claim. Dig into what that means and why it matters in our VPN report.
50
The protester's guide to smartphone security
Your phone is an essential tool, but it also represents a huge risk to your privacy and security. Understanding these best practices when it comes to securing your smartphone will help keep you and your data safe.
51
Nevada court shuts down police use of federal loophole for civil forfeiture
RENO, Nev.—In a major victory for property rights, today a Washoe County judge ruled that Nevada law enforcement cannot use a federal program to bypass […]
52
Privacy doesn't mean anything anymore, anonymity does
Privacy is when they promise to protect your data. Anonymity is when they never had your data to begin with.
53
54
Seven diabetes patients die due to undisclosed bug in Abbott's glucose monitors
I wrote last month about my diabetes diagnosis this year and my difficult choice to wear a proprietary device (called a CGM) on my arm 24/7 to continuously monitor my glucose levels. Like my friend and colleague, Karen M. Sandler — who previously made a much higher-stakes choice to receive a proprietary implanted…
55
OpenSSH Post-Quantum Cryptography
OpenSSH post quantum cryptography
56
Geedge and MESA leak: Analyzing the great firewall’s largest document leak
The Great Firewall of China (GFW) experienced the largest leak of internal documents in its history on Thursday September 11, 2025. Over 500 GB of source code, work logs, and internal communication records were leaked, revealing details of the GFW's research, development, and operations.
57
Backdooring Your Backdoors – Another $20 Domain, More Governments
After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process for verifying domain ownership to give ourselves the ability to issue valid and trusted TLS/
58
Google restricts Android sideloading
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
59
Branch Privilege Injection: Exploiting branch predictor race conditions
Branch Privilege Injection ( CVE-2024-45332 ) brings back the full might of branch target injection attacks (Spectre-BTI) on Intel. Intel’s hardware mitigations against these types of attacks have held their ground for almost 6 years. In our work, we demonstrate how these mitigations can be broken due to a race…
60
GitLab discovers widespread NPM supply chain attack
Malware driving attack includes "dead man's switch" that can harm user data.