121
Tailscale state file encryption no longer enabled by default
View changes to the Tailscale client and service.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 362 posts.
122
Obsidian plugin was abused to deploy a remote access trojan
A sophisticated campaign is abusing the Obsidian note-taking app to deliver a new RAT, PHANTOMPULSE, to targets in the finance and crypto sectors using...
123
Do the math: How we took over ChatGPT accounts
By bypassing ChatGPT's sandbox and content security policy, our research team was able to take over anyone's account simply by sending them a link.
124
Open source security at Astral
Insights and guidance from our engineering team on how Astral secures its tools.
125
We are retiring our bug bounty program
For almost a year now, Turso has had a program that pays $1,000 for any bug that can be demonstrated to lead to data corruption. Today, we are retiring this program.
126
SAML: A fractal of bad design
SAML, the XML-based authentication protocol that birthed the SSO industry, is fundamentally flawed due to XML complexity, canonicalization issues, enveloped signatures, and design ossification, making it vulnerable to signature wrapping attacks and parser differentials that persist despite decades of awareness…
127
Fast16: High-precision software sabotage 5 years before Stuxnet
A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results.
128
Brazilian Court Sanctions Lawyers for Prompt Injection in Court Filing
Two lawyers hid a white-on-white instruction inside a court filing telling the AI to go easy on their case. The court's AI caught it. The fine was $16,000.
129
Eye of Sauron: Long-Range Hidden Spy Camera Detection (2024)
Qibo Zhang and Daibo Liu, Hunan University; Xinyu Zhang, University of California San Diego; Zhichao Cao, Michigan State University; Fanzi Zeng, Hongbo Jiang, and Wenqiang Jin, Hunan University
130
Don't trust AI agents
AI agents need a security model that assumes things will go wrong. The right response isn't better permission checks, it's architecture that makes trust unnecessary.
131
GPT-6 Astra covertly underperforms on safety research
Research on aligning AI with human values and intent, and reports documenting model failures.
132
Humans missed 1 in 3 threats approving AI agent commands across 40k game runs
Results from AI agent permission game: which attacks beat human reviewers, and which safe commands got blocked instead.
133
Azure's Weakest Link – Five Full Cross-Tenant Compromises
In my previous blog posts, Azure’s Weakest Link? and Azure’s Weakest Link - Full Cross-Tenant Compromise, I gave an overview of the severely insecure architecture behind API Connections in Azure, a part of Azure Logic Apps, and an instance of a full cross-tenant compromise using these inherent flaws. Now I am back…
134
Concerning behavior from a popular open-weight AI model
Discover how untrusted open-weight AI models can potentially leak data, even when self-hosted. Learn the security risks and how to protect your enterprise.
135
The Hugging Face incident and the road ahead
OpenAI shares findings from the Hugging Face security incident and the steps we’re taking to strengthen AI model security, monitoring, and alignment.
136
Top downloaded skill in ClawHub contains malware
The same capabilities that make OpenClaw a groundbreaking tool also make it an urgent security risk. This blog contains confirmed examples of agent skills being used as malware vectors, and advice on how to protect yourself if you're experimenting with them.
137
OpenAI Adopts Google's SynthID Watermark for AI Images with Verification Tool
OpenAI advances AI content provenance with Content Credentials, SynthID, and a verification tool to help people identify and trust AI-generated media.
138
Chained PHP2Shell exploit roots 25 servers, including US Government servers
Custom PHP2Shell Exploit Chained with Kernel LPE to Root Versions of Palo Alto Networks PAN-OS Firewalls in the Wild
139
We got admin access to Baseten's production GitHub
We gave Strix a domain. In 25 minutes, it found a live token with admin access to Baseten's product, deployment, and CLI repos in a public Docker image.
140
Android Developer Verification
News and insights on the Android platform, developer tools, and events.
141
Assessing Claude Mythos Preview's cybersecurity capabilities
Technical details on how we tested Claude Mythos Preview, a model strikingly capable at computer security tasks, and what we found.
142
EY Canada published a cybersecurity report and most citations were hallucinated
An investigation into fabricated citations and broken references in EY's "Points of Attack" cybersecurity report on loyalty system fraud.
143
ChatGPT for Google Sheets exfiltrates workbooks
ChatGPT for Google Sheets is vulnerable to data exfiltration and phishing overlay attacks that affect workbooks across the victim’s account after an indirect prompt injection in a single sheet.
144
DNS-Persist-01: A New Model for DNS-Based Challenge Validation
When you request a certificate from Let’s Encrypt, our servers validate that you control the hostnames in that certificate using ACME challenges. For subscribers who need wildcard certificates or who prefer not to expose infrastructure to the public Internet, the DNS-01 challenge type has long been the only choice…
145
A Post-Quantum Future for Let's Encrypt
Let’s Encrypt is committed to a post-quantum-safe Web PKI. The path we’re planning to take is Merkle Tree Certificates (“MTCs”), a new approach that adds post-quantum authentication to the web without sacrificing the speed and reliability that have made TLS universal. This post is about these plans and why we believe…
146
How Monero’s proof of work works
Monero does not use a simple fixed hash like Bitcoin. Its proof of work, RandomX, turns mining into running random CPU-friendly programs over a large memory dataset, which is why it behaves so differently from ASIC-first systems.
147
"cat readme.txt" is not safe if you use iTerm2
Turning "cat readme.txt" into arbitrary code execution in iTerm2.
148
Can you reverse engineer our neural network?
A lot of “capture-the-flag” style ML puzzles give you a black box neural net, and your job is to figure out what it does. When we were thinking of creating o...
149
Countries are competing to see which can carry out mass surveillance the best
USA and their friends in the surveillance alliance Fourteen Eyes have demonstrated that they have the capacity, the desire and the experience to monitor who they want, when they want, anywhere in the world.
150
ICE Is Going on a Surveillance Shopping Spree
We need to have a hard look at the surveillance industry. It is a key enabler of vast and untold violations of human rights and civil liberties, and it continues to be used by aspiring autocrats to threaten our very democracy. As long as it exists, the surveillance industry, and the data it generates, will be an…