2881
Poison everywhere: No output from your MCP server is safe
Protect your organization with Idira®. Modernize identity governance, automate access reviews, and secure every identity across your hybrid cloud environment.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
2882
CPanel and WHM Authentication Bypass – CVE-2026-41940
Hello! Yes, it's all a disaster again! Let's get this party started: 0:00 /0:12 1× No comments today, so imagine this: * We wrote something that we find very funny, * Nobody else gets it, * But everyone humors us Just like a typical watchTowr Labs blog introduction. As
2883
2884
Illinois General Assembly passes bill to ban citizens from recording police
The Illinois General Assembly just passed a bill that would prevent citizens from recording the police.
2885
Sandboxing and workload isolation
Documentation and guides from the team at Fly.io.
2886
Mitmproxy 9: WireGuard Mode
We’re excited to announce the release of mitmproxy 9, a free and open source interactive HTTPS proxy. This release brings support for raw UDP and DTLS, a new WireGuard proxy mode, and major usability improvements.
2887
EFF Dismayed by House's Gutted USA Freedom Act
EFF and Other Civil Liberties Organizations Call on Congress to Support Uncompromising Reform Since the introduction of the USA FREEDOM Act, a bill that has over 140 cosponsors, Congress has been clear about its intent: ending the mass collection of Americans' calling records. Many members of...
2888
EFF Challenges National Security Letter Statute in Landmark Lawsuit
Since the first national security letter statute was passed in 1986, the FBI has issued hundreds of thousands of such letters seeking private telecommunications and financial records of Americans without any prior approval from courts. Indeed, for the period between 2003 and 2006 alone, almost 200,...
2889
Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS
Modern web applications typically rely on chains of multiple servers, which forward HTTP requests to one another. The attack surface created by this forwarding is increasingly receiving more attention, including the recent popularisation of cache poisoning...
2890
Open-sourcing Sandboxed API
Posted by Christian Blichmann & Robert Swiecki, ISE Sandboxing team Many software projects process data which is externally generated, and...
2891
Uber Hacking: How we found out who you are, where you are and where you went
Here at Integrity we love to be challenged, so whenever there is some free time, there is encouragement to do research or to break some things ( https://labs.integrity.pt/advisories/ ) in addition to play foosball.
2892
EFF to Court: Government Must Inform People That It’s Accessing Their Data
Seattle, Washington—The Electronic Frontier Foundation (EFF) told a federal court today that the government is violating the U.S. Constitution when it fails to notify people that it has accessed or examined their private communications stored by Internet providers in the cloud. EFF is supporting...
2893
Why to not use JWT (2021)
We build advanced web apps
2894
HipChat Will Grant Employers Access To 1-to-1 Chat History
Atlassian and Slack have forged a new strategic partnership.
2895
Real vs. fake AirPods with industrial CT
CT scans of counterfeit AirPods Pro and MagSafe chargers reveal pouch cell batteries in circular cavities, internal weights, and a fake ground pin.
2896
Browser Fingerprinting Without JavaScript
Turning off JavaScript blocks ads but not device tracking. Discover how no-JavaScript fingerprinting works.
2897
Privacy Badger Is Changing to Protect You Better
Privacy Badger was created to protect users from pervasive non-consensual tracking, and to do so automatically, without relying on human-edited lists of known trackers. While our goals remain the same, our approach is changing. It is time for Privacy Badger to evolve.Thanks to disclosures from...
2898
Should We Chat, Too? Security Analysis of WeChat's Mmtls Encryption Protocol
This report performs the first public analysis of MMTLS, the main network protocol used by WeChat, an app with over one billion users. The report finds that MMTLS is a modified version of TLS, however some of the modifications have introduced cryptographic weaknesses.
2899
2900
Spring Core on JDK9 is vulnerable to remote code execution
Update: March 31, 2022 A patch has officially been released. https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement https://tanzu.vmware.com/security/cve-2022-22965 Overview Spring Core on JDK9+ is vulnerable to remote code execution due to a bypass for CVE-2010-1622. At the time of writing, this…
2901
2902
An Analysis of WeChat’s Realtime Image Filtering in Chats
In this work, we study how Tencent implements image filtering on WeChat. We found that Tencent implements realtime, automatic censorship of chat images on WeChat based on what text is in an image and based on an image’s visual similarity to those on a blacklist. Tencent facilitates this realtime filtering by…
2903
Threema apps are Open Source
In Celebration of Becoming Open Source, Threema is 50% Off
2904
Technology Preview for secure value recovery
At Signal, we want to make privacy simple. From the beginning, we’ve designed Signal so that your information is in your hands rather than ours. Technologies like Signal Protocol secure your messages so that they are never visible by anyone but you and the intended recipients. Technologies like p...
2905
The Mystery of the Encrypted Gauss Payload
The Securelist blog houses Kaspersky’s threat intelligence reports, malware research, APT analysis and statistics
2906
Two More Cases of Third-Party Facebook App Data Exposure
Third-party Facebook apps gather Facebook data about the people who use them. While Facebook struggles to contain these exposures, insecure third-party data practices & misconfigured cloud systems continue to leak Facebook data to the internet. See how UpGuard discovered and secured two such cases.
2907
Senator Wants to Make the Computer Fraud and Abuse Act Even Easier to Abuse
This summer, Senator Sheldon Whitehouse introduced an amendment to the flawed Cyber Information Sharing Act (CISA) that would make it even worse, by expanding the broken Computer Fraud and Abuse Act (CFAA). EFF has proposed common sense changes to this federal anti-hacking law, many of which were...
2908
Facebook Doubles Down on Misusing Your Phone Number
When we publicly demanded that Facebook stop messing with users’ phone numbers last week, we weren’t expecting the social network to double down quite like this: By default, anyone can use the phone number that a user provides for two-factor authentication (2FA) to find that user’s profile. For...
2909
How RubyGems.org protects OSS infrastructure
Recently, Socket.dev published research highlighting malicious gems designed to steal social media credentials. We wanted to use this as an opportunity to share more about how RubyGems.org security...
2910
OWASP Non-Human Identities Top 10
A list of OWASP's Non-Human Identities Top 10 risks for 2025