151
Google announces agreement to acquire Wiz
Google signed a definitive agreement to acquire Wiz. This deal will make it easier for companies to protect themselves across major clouds.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 308 posts.
152
Firefox 143 for Android to introduce DoH
All web browsing starts with a DNS query to find the IP address for the desired service or website. For much of the internet’s history, this query is sen
153
How to harden GitHub Actions
Build resilient GitHub Actions workflows with insights from real attacks, missteps to avoid, and security tips GitHub’s docs don’t fully cover.
154
OCSP Service Has Reached End of Life
Today we turned off our Online Certificate Status Protocol (OCSP) service, as announced in December of last year. We stopped including OCSP URLs in our certificates more than 90 days ago, so all Let’s Encrypt certificates that contained OCSP URLs have now expired. Going forward, we will publish revocation information…
155
How Cops Are Using Flock's ALPR Network to Surveil Protesters and Activists
Through an analysis of 10 months of nationwide searches on Flock Safety's servers, we discovered that more than 50 federal, state, and local agencies ran hundreds of searches through Flock's national network of surveillance data in connection with protest activity. In some cases, law enforcement specifically targeted…
156
157
158
AI agents find $4.6M in blockchain smart contract exploits
On a benchmark of real exploited contracts, AI agents found vulnerabilities worth a combined $4.6 million, underscoring the need for AI-powered defense.
159
Keeping the Internet fast and secure: introducing Merkle Tree Certificates
Cloudflare is launching an experiment with Chrome to evaluate fast, scalable, and quantum-ready Merkle Tree Certificates, all without degrading performance or changing WebPKI trust relationships.
160
Ruby on Rails Audit Complete
The Open Source Technology Improvement Fund is proud to share the results of our security audit of Ruby on Rails . Ruby on Rails (or “Rails”) is an open source full stack web-application framework. Thanks to the help of X41 D-Sec , GitLab , and the Sovereign Tech Agency , Rails can provide more secure versions of the…
161
Remote Prompt Injection in Gitlab Duo Leads to Source Code Theft
The Legit research team unearthed vulnerabilities in GitLab Duo.
162
Encryption Is Not a Crime
Encryption is not a crime, encryption protects us all. Encryption, and especially end-to-end encryption, is an essential tool to protect everyone online. Attempts to undermine encryption are an attack to our fundamental right to privacy and an attack to our inherent right to security and safety.
163
Verifying your Matrix devices is becoming mandatory
From April 2026, only verified devices can send or receive end-to-end encrypted message on Element.
164
AWS Built a Security Tool. It Introduced a Security Risk
Discover how AWS’s Account Assessment tool introduced a serious security risk through its default deployment guidance & key steps to detect & remediate it.
165
Cloudflare incident on August 21, 2025
On August 21, 2025, an influx of traffic directed toward clients hosted in AWS us-east-1 caused severe congestion on links between Cloudflare and us-east-1. In this post, we explain what the failure was, why it occurred, and what we’re doing to make sure this doesn’t happen again.
166
EFF statement on U.S. Supreme Court's decision to uphold TikTok ban
Shutting down a communications platform or forcing its reorganization based on concerns of foreign propaganda and anti-national manipulation is an eminently anti-democratic tactic, one that the US has previously condemned globally.
167
How Thai authorities use online doxxing to suppress dissent
A sustained, coordinated social media harassment and doxxing campaign – which we codenamed JUICYJAM – targeting the pro-democracy movement in Thailand has run uninterrupted, and unchallenged, since at least August 2020. Through our analysis of public social media posts we determined that the campaign was not only…
168
Subliminal learning: Models transmit behaviors via hidden signals in data
We study subliminal learning , a surprising phenomenon where language models learn traits from model-generated data that is semantically unrelated to those traits. For example, a "student" model learns to prefer owls when trained on sequences of numbers generated by a "teacher" model that prefers owls. This same…
169
Rights groups urge UK PM Starmer to abandon plans for mandatory digital ID
Big Brother Watch and other human rights, civil liberties, digital rights, and racial justice organisations have written to the Prime Minister urging him to abandon plans for a mandatory digital ID. The letter comes just days before an expected statement from Keir Starmer announcing the rollout of a mandatory digital…
170
CAPTCHAs are over (in ticketing)
Behind the scenes blog of pretix, your friendly ticketing system from next door.
171
Who Owns, Operates, and Develops Your VPN Matters
New research: Eight popular, commercial VPN apps operate deceptively and put more than 700 million users at risk of authoritarian surveillance.
172
Scamlexity: When agentic AI browsers get scammed
We Put Agentic AI Browsers to the Test - They Clicked, They Paid, They Failed
173
I scanned all of GitHub's "oops commits" for leaked secrets
GitHub Archive logs every public commit, even the ones developers try to delete. Force pushes often cover up mistakes like leaked credentials by rewriting Git history. GitHub keeps these dangling commits, from what we can tell, forever. In the archive, they show up as “zero-commit” PushEvents.
174
Price of a bot army revealed across online platforms
The first global index tracking real-time prices for buying fake account verifications on 500+ online platforms in every country has been launched by a team at the University of Cambridge.
175
The cryptography behind electronic passports
This blog post describes how electronic passports work, the threats within their threat model, and how they protect against those threats using cryptography. It also discusses the implications of using electronic passports for novel applications, such as zero-knowledge identity proofs.
176
Oniux: Kernel-level Tor isolation for any Linux app
Introducing oniux: Kernel-level Tor isolation for any Linux app. This torsocks alternative uses namespaces to isolate Linux applications over the Tor network and eliminate data leaks.
177
CodeMender: an AI agent for code security
Using advanced AI to fix critical software vulnerabilities
178
Matrix.org Will Migrate to MAS
Matrix, the open protocol for secure decentralised communications
179
Six day and IP address certificate options in 2025
Update: January 15, 2026 Six-day and IP address certificates are now generally available. See 6-day and IP Address Certificates are Generally Available for details. This year we will continue to pursue our commitment to improving the security of the Web PKI by introducing the option to get certificates with six-day…
180
The FIPS 140-3 Go Cryptographic Module
Go now has a built-in, native FIPS 140-3 compliant mode.