241
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 362 posts.
242
120 days until Google restricts side-loading, declaring war on Android freedom
Starting 2027, Google will block apps on Android devices whose developers have not registered with Google, paid, and given their ID. It’s fair to say that Google is becoming Apple: Your device, their rules.
243
Six curl CVEs after OpenAI and Anthropic came back with zero
After frontier AI systems came up empty, AISLE surfaced six CVEs in curl, one of the world's most audited codebases. Its maintainers patched all six.
244
The agent harness belongs outside the sandbox
Two architectures for running agent harnesses, the tradeoffs between them, and how we make skills and memories work when the harness isn't local.
245
Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)
A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how we addressed the issue.
246
Malicious skills targeting Claude Code and Moltbot users
Malicious ClawdBot skills target ByBit, Polymarket, Axiom, Reddit and LinkedIn, installing malware on unsuspecting OpenClaw user machines.
247
Expanding Project Glasswing
We’re extending Project Glasswing to approximately 150 new organizations in more than fifteen countries
248
GrapheneOS recommended for domestic abuse victims
Looking for a DV safe phone in Australia? This 2026 guide covers tech abuse on normal phones, what a privacy phone can and cannot do, and where to get help.
249
Even 'uncensored' models can't say what they want
A safety-filtered pretrain can duck a charged word without refusing. It puts a fraction of the probability an open-data pretrain puts there. We call that...
250
Path to Astra: critical capabilities and frontier safeguards
Astra is the first OpenAI model to meet the Critical cybersecurity capability threshold under the Preparedness Framework, with stronger safeguards for release.
251
1-Click RCE to steal your Moltbot data and keys
A technical teardown of a 1-click RCE against OpenClaw (formerly Moltbot/ClawdBot), a viral open-source AI assistant trusted by 100,000+ developers with high-privilege access. See how a settings logic flaw and a WebSocket pivot turn a single webpage visit into token exfiltration, safety-control bypass, and arbitrary…
252
Memory Safe Inline Assembly
Since Fil-C 0.685, memory-safe inline assembly is supported on both X86_64 and ARM64.
253
AISLE Discovers 38 CVEs in OpenEMR Healthcare Software
38 zero-day security vulnerabilities, three critical, and the shift from disclosure to prevention in healthcare software
254
DeepSeek v4.1 Flash Is Now Our Best Hacking Model
DeepSeek’s 11/11 result showed why advanced agent benchmarks need to check both the outcome and the attack path: our audit confirmed six planned exploits and found five unexpected routes.
255
Infomaniak transitions to a foundation model to protect user data privacy
Infomaniak transfers the majority of its voting rights to a Swiss public-benefit foundation. Your cloud remains sovereign, independent, and true to its values. Forever.
256
Post-Mythos Cybersecurity: Keep calm and carry on
As some of those fears, uncertainties, and doubts about Mythos are starting to feel real, what can we do about it? Paradoxically, I believe that little needs to change in what we’ve been doing for years.
257
Hacker leaks 281 GB of data from Germany's far-right AfD party
Germany's far-right AfD (Alternative für Deutschland) party has confirmed that it has suffered a security breach, after a hacker published what appear to be hundreds of thousands of the controversial political party's internal emails.
258
Briar is in maintenance mode
This is a quick update about the status of Briar. Short version: the project is still active but we’re only making essential security updates and bugfixes for now. Long version: For several years we’ve been trying to find solutions to some of the longstanding issues with Briar, such as high battery usage and…
259
Restaurant Delivery Payment-Skimming Campaign
InfoHawk research has uncovered a network of 820 suspicious restaurant domains impersonating major US chains, including Jersey Mike's, Jimmy John's, Firehouse Subs, Chipotle, and Dave's Hot Chicken. Some are running sophisticated payment-skimming attacks that capture credit card information and ask customers for their…
260
261
America's Cyber Defense Agency Is Burning Down and Nobody's Coming to Put It Out
CISA lost a third of its staff and its acting leader uploaded sensitive docs to public ChatGPT, while China sits inside U.S. critical infrastructure.
262
Cooldown Support for Ruby Bundler
Most supply-chain attacks against RubyGems exploit a narrow window: an account is compromised, a malicious version ships, and any bundle install in the minutes that follow resolves straight to it. ...
263
Pacing model development in an era of cyber-critical capabilities
OpenAI is strengthening monitoring, alignment, and security for frontier AI models. See how new safeguards are guiding the pace of model development.
264
265
1,741 "informed" consents with one click? GDPR complaint filed
dict.cc requests users to consent to the tracking by 1,741 "partner" companies. This makes it impossible for people to know what happens to their data
266
San Francisco: Don't Fall for Industry Defense of Surveillance Pricing
The concept of “surveillance pricing” is just one part of a much larger problem and business model: corporations maximizing their profits by invading our privacy. The all-too-common business model is to systematically harvest, collate, and store as much of our personal data as possible, and then...
267
Trigger.dev customer environment variables exposed
An attacker gained unauthorized access to environment variables for a subset of organizations. We've blocked the exploit and emailed all impacted account owners with steps to mitigate.
268
Improving C# Memory Safety
The `unsafe` keyword is being redesigned to mark caller-facing contracts rather than just syntax. Safety obligations between callers and callees become visible and reviewable. The model is motivated by the rise of AI-assisted code generation and arrives as a preview in .NET 11.
269
Route leak incident on January 22, 2026
An automated routing policy configuration error caused us to leak some Border Gateway Protocol prefixes unintentionally from a router at our Miami data center. We discuss the impact and the changes we are implementing as a result.
270
Developing provably correct Rust code with Verus
How the Verus "program verifier", which automatically checks code against a mathematical specification of its functionality, helps increase security assurance in software projects.