121
Just the rumour of a bug is enough to find an exploit these days
Thinking through how the conventional OSS security embargoes no longer buy us time, and what open source maintainers might do instead to respond
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 356 posts.
122
Breaking Claude Code Opus 5 Auto Mode
In this post, we explore how a simple website summary request hijacks Claude Code Opus 5 in Auto Mode and achieves code execution with 60-80% attack success …
123
Claude Code VS Code extension with backdoor released on Cursor marketplace
Yesterday, Anthropic were compromised and used to stage a global supply chain attack.
124
Period tracking app, Flo, found to be selling user data to Meta
What does this vagueness by-design mean for how we choose to self monitor our biological markers?
125
Someone at BrowserStack is leaking users' email addresses
Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legitimately from a service, if a service is hacked the hackers can't go credential stuffing, and I instantly know who leaked my address. A few weeks ago I signed up…
126
What Happened to HackerOne?
The rise and fall of the largest bug bounty platform in the world
127
Vulnerability reports are not special anymore
We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?
128
On caring for user data: NeoVim caused Vim undo files to be deleted
A blog about software craft and quality
129
Document-borne AI worms can self-propagate through Copilot for Word
I would like to thank Microsoft product teams and Microsoft Security Response Center (MSRC) for collaborating with me on this technical analysis and mitigation of the disclosed vulnerabilities. The editorial opinions reflected below are solely the author’s and do not necessarily reflect those of the organizations I…
130
131
What happened after 2k people tried to hack my AI assistant
I built hackmyclaw.com , where anyone could email Fiu, my OpenClaw assistant, and try to make it leak the contents of a secrets.env file.
132
Email obfuscation: What works in 2026?
Here are some of the best techniques for keeping email addresses hidden from spammers—along with the statistics on how likely they are to be broken.
133
The RCE that AMD won't fix
After reporting a RCE in AMD's auto-update software, they decided to not patch it due to it requiring a man-in-the-middle attack to perform.
134
Wanted to download an ISO, ended up writing a kernel exploit
My TP-Link EAP770 v1 corrupts downloads over Wi-Fi and TP-Link EOL'd it before I unboxed it. The fix is two zeros in sysfs. TP-Link's shell won't let me write them, so I wrote a kernel exploit for my own fucking access point.
135
My Google Workspace account suspension
As the title suggests, I have finally become the victim of Google’s account suspension.
136
How kernel anti-cheats work
Modern kernel anti-cheat systems are, without exaggeration, among the most sophisticated pieces of software running on consumer Windows machines. They operate at the highest privilege level available to software, they intercept kernel callbacks that were designed for legitimate security products, they scan memory…
137
Archive.today is directing a DDoS attack against my blog
Around January 11, 2026, archive.today (aka archive.is, archive.md, etc) started using its users as proxies to conduct a distributed denial of service (DDOS) attack against Gyrovague, my personal b…
138
Humiliating IIS servers for fun and jail time
cybersecurity, tech, and personal annoyance log
139
Large-Scale Online Deanonymization with LLMs
We measure the capabilities of LLMs to deanonymize users online.
140
We installed a single turnstile to feel secure
After the acquisition by a much larger company, security became a top priority. Our company occupied three tall buildings, each at least 13 stories high. Key card readers were installed next to every
141
EU Age Control: The trojan horse for digital IDs
A technical look at the EU age verification reference app — the gap between marketed and shipped cryptography, relay attacks the protocol can't stop, and why the 'privacy-preserving' system is a trojan horse for digital ID infrastructure.
142
I asked Meta’s Muse for its filesystem and it sent me 6.8GB
I asked Muse to archive the files it could see and send them to my Google Drive. It did.
143
Self-Hosting on the Dark Web
This site is now reachable over Tor as a hidden service, at a .onion address that resolves only inside the Tor network. Tor relays and encrypts your traffic as …
144
145
This year’s insane timeline of hacks
An archive of this year’s insane timeline of hacks few people are talking about
146
Inside ZCode: Silently uploading your Git history to the cloud
ZCode silently uploads full Git history to the cloud; this post provides a block rule and source review — checkpoint claims fall apart against the code.
147
Why aren't AI companies being charged for hacking?
AI companies claim their hacks were unpredictable accidents — but they follow foreseeably from deliberate design choices, and that establishes criminal intent.
148
Meta's ships facial recognition on smart glasses
Stella is the companion app for Meta's smart glasses. Inspecting version 273.0.0.21 of the Android build (com.facebook.stella), I found the entire computational and storage stack for on-device facial recognition: three face models, a local database schema, a cosine-similarity vector index dimensioned to
149
My audio interface has SSH enabled by default
I bought a Rodecaster Duo to solve some audio woes, and found that it has ssh enabled by default. I captured the firmware update process and created custom firmware to enable password authentication for ssh.
150
Bucketsquatting is finally dead
For a decade, I have been working with AWS and third-party security teams to resolve bucketsquatting / bucketsniping issues in AWS S3. Finally, I am happy to say AWS now has a solution to the problem, and it changes the way you should name your buckets.