2191
RCE on Telia Routers
Multiple vulnerabilities could allow running arbitrary code on an intranet server and gain root access on all the customers' routers
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
2192
OpenPGPjs v3.0
We're happy to announce a major new version of OpenPGPjs, the world's most widely used JavaScript PGP encryption library. Version 3.0 brings many enhancements to the hundreds of applications and millions of users who rely on OpenPGPjs.
2193
CodeMender: an AI agent for code security
Using advanced AI to fix critical software vulnerabilities
2194
Signal Desktop beta now publicly available
For the past few months, the Signal Desktop beta has been available through an invitation program. We’ve gotten a lot of feedback, made a lot of improvements, and are now ready to open the beta up for public access.
2195
An agent used DNS to reach an external chatbot
Research on aligning AI with human values and intent, and reports documenting model failures.
2196
Matrix.org Will Migrate to MAS
Matrix, the open protocol for secure decentralised communications
2197
VMs won't contain cyber-capable agents
You can no longer assume a mere VM will contain a sufficiently advanced AI agent.
2198
Pixel Security
Posted by Paul Crowley, Senior Software Engineer and Paul Lawrence, Senior Software Engineer [Cross-posted from the Android Developers Blog...
2199
Your Android Phone Is a Security Key
Now, your phone running Android 7+ can be your security key, protecting you against phishing. Use it to protect your personal and work Google Accounts.
2200
How to Escape a Container
Panoptica by Outshift delivers advanced cloud-native security insights to help teams protect modern applications and infrastructure at scale.
2201
2202
Emails a browser extension developer gets from scammers
SponsorBlock is a crowdsourced browser extension to skip sponsor segments in YouTube videos.
2203
90-year-old Cryptanalytic Efforts Must Stay Secret, says NSA
The National Security Agency is withholding 90-year-old information on early American cryptanalytic efforts against Russia and the Soviet Union from a 20-year-old document on the grounds that relea…
2204
Codecov Bash Uploader compromised
Update 4/29/2021 3PM PT : Through our investigation, we now have additional information concerning what environment variables may have been obtained without authorization and how they may have been used. Affected users can view details within the Codecov application. Additionally, we have posted our most up-to-date…
2205
TeleSign profiles half of the world’s mobile phone users
TeleSign generates a “reputation score” and sells it to various clients. TeleSign secretly received the mobile phone data from BICS, a Belgian company that provides interconnection services
2206
Supabase Vault
Today we're announcing Vault, a Postgres extension for managing secrets and encryption inside your database.
2207
No boundaries: Exfiltration of personal data by session-replay scripts
This is the first post in our “No Boundaries” series, in which we reveal how third-party scripts on websites have been extracting personal information in increasingly intrusive ways. [0] by Steven Englehardt, Gunes Acar, and Arvind Narayanan Update: we’ve released our data — the list of sites with session-replay…
2208
Understanding Docker Container Escapes
Trail of Bits recently completed a security assessment of Kubernetes, including its interaction with Docker. Felix Wilhelm’s recent tweet of a Proof of Concept (PoC) “container escape” sparked our interest, since we performed similar research and were curious how this PoC could impact Kubernetes. Quick and dirty way…
2209
Nazar: Analyzing malware that was uncovered in leaked NSA files
In mid-2017, The Shadow Brokers exposed NSA files in a leak known as "Lost In Translation".Recently, researcher uncovered "Nazar", a previously-unknown APT that was mentioned in the leak.We decided to dive into each and every one of the components and share our technical analysis. What we found out, is far from being…
2210
HTTPS as a ranking signal
Cross-posted from the Webmaster Central Blog Security is a top priority for Google. We invest a lot in making sure that our services us...
2211
Current MFA fatigue attack campaign targeting Microsoft Office 365 users
We provide around-the-clock threat detection and incident response, backed by expert consulting to keep your organization secure.
2212
Six day and IP address certificate options in 2025
Update: January 15, 2026 Six-day and IP address certificates are now generally available. See 6-day and IP Address Certificates are Generally Available for details. This year we will continue to pursue our commitment to improving the security of the Web PKI by introducing the option to get certificates with six-day…
2213
The golden age of scammers: AI-powered phishing
AI phishing is all over the headlines and that’s not going to change. Learn about the capabilities of the dark side of gen ai, and how to defend against it.
2214
AISLE’s autonomous analyzer found all CVEs in the January OpenSSL release
AISLE's autonomous analyzer found all 12 CVEs in the January 2026 coordinated release of OpenSSL, the open-source cryptographic library.
2215
Call for Participation to Chaos Computer Club’s 37C3
The Chaos Communication Congress is the Chaos Computer Club’s (CCC) annual symposium and hacker party.
2216
Targeted attack on our management with the Triangulation Trojan
So you’ve heard of blockchain. But how can you use it in your enterprise today? Vitaly Mzokov explores the benefits and security challenges.
2217
2218
Phasing Out SHA-1 on the Public Web
An algorithm we’ve depended on for most of the life of the Internet — SHA-1 — is aging, due to both mathematical and technological advances. Digital signatures incorporating the SHA-1 ...
2219
If David Cameron bans secure encryption he can't intercept
8:30 : Wake up and get out of bed. Open the curtains to see the sun shining, put a dressing gown on and go downstairs to make some coffee.
2220
How to delete your data from data brokers
Digital safety is public safety. We're building the knowledge, standards, and tools people need to face online harm — together.