691
Homeland Security Spying on Reddit Users
Leak show feds tracking anti-ICE Reddit users like "Budget-Chicken-2425"
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 718 posts.
692
Are we self-sovereign PKI yet?
Every end-to-end encrypted messenger ships a fingerprint UI. Almost nobody opens it. A note on what's actually missing.
693
OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others
Part 1 of a series that takes an unprivileged Android app to root on Samsung, Xiaomi, and Oppo/OnePlus/Realme devices, with a single strategy.
694
I'm not a fan of Deno's security model (2024)
this has been bothering me for a while now, so I want to write down my thoughts so I can get it out of my head and move on. we’re gonna talk about how Deno approaches security, specifically with its permissions system, and why I think this approach is fundamentally insecure and misleading.
695
An NSFW filter for Marginalia search
… optional, that is. I’ve been working on an NSFW filter for Marginalia Search, as that is something some people have asked for, primarily API consumers. The search engine has had some domain based filtering for a while, based on the UT1 lists, but that isn’t a very comprehensive approach. We’ll land on a single…
696
How Cloudflare responded to the “Copy Fail” Linux vulnerability
When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflare's security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation.
697
Recover Apple Keychain
Yes, I do—and probably more than I should admit. But a few things led to this situation. For one, I’d gotten too used to relying on Touch ID. As a result, if my muscle memory failed me, I was stuck. On top of that, I kept entering my office Active Directory (AD) password instead of my Mac password—again, muscle memory…
698
One parser, two bugs, many routers: Exploiting Broadcom WiFi across eCos, Linux
A vulnerability in Broadcom’s proprietary WPS implementation enables unauthenticated attackers within WiFi range to leak memory and achieve unauthenticated remote code execution on millions of routers. This post covers its discovery through agentic vulnerability research, exploitation across eCos and Linux platforms…
699
Sending Data over Offline Finding Networks
The following is a summary of an internal research project conducted by Hudson H. and Andrew G.
700
OpenAI's response to the Axios developer tool compromise
OpenAI responds to the Axios supply chain attack by rotating macOS code signing certificates, updating apps, and confirming no user data was compromised.
701
OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
Show issues fixed only in OpenSSL 4.0 , 3.6 , 3.5 , 3.4 , 3.3 , 3.2 , 3.1 , 3.0 , 1.1.1 , 1.1.0 , 1.0.2 , 1.0.1 , 1.0.0 , 0.9.8 , 0.9.7 , 0.9.6 .
702
Data-only attacks are easier than you think (2024)
Data-only attacks, those that do not affect a program’s control flow, have long been considered too sophisticated and niche to pose a practical threat. With our research, however, we have built a tool that automatically generates them with surprising ease. We explain how such attacks work, and why our tool, Einstein…
703
Cameras built to police Iranians became the regime's Achilles' heel
On the irony of cameras built to police Iranians becoming the regime’s Achilles’ heel
704
UK intelligence censored report on global warming and homeland security
Series: I read it so you don't have to
705
CSS: The bomb inside your inbox
Gareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this
706
Kimwolf Botnet Swamps Anonymity Network I2P
For the past week, the massive “Internet of Things” (IoT) botnet known as Kimwolf has been disrupting The Invisible Internet Project (I2P), a decentralized, encrypted communications network designed to anonymize and secure online communications. I2P users started reporting disruptions in the network around the same…
707
Put your SSH keys in your TPM chip
Published: 10-04-2026 19:37 | Author: Remy van Elst | Text only version of this article
708
709
My gym forced a social media down my throat. So I reverse-engineered its app
Extracting my gym’s QR check-in from its Flutter app, with a rooted phone and a lot of ripgrep.
710
Probably check on your smart appliances
TL;DR: is your refrigerator running malware? If so, you better catch it!
711
AI Meets Cryptography 2: What AI Found in OpenVM's ZkVM
We turned zkao (our AI auditor) on OpenVM, a state-of-the-art zkVM, and it found a critical soundness bug: the pairing check accepted a prover-supplied witness without proper subfield checking, which lets a malicious prover forge any pairing equality. It is fixed in OpenVM 1.6.0 and tracked as CVE-2026-46669. This is…
712
713
Detecting and Preventing Distillation Attacks
We identified coordinated distillation attacks using ~24,000 fraudulent accounts to extract Claude's capabilities.
714
How Claude's text watermarking works
Future Claude models will generate text that contains a watermark to comply with the EU AI Act. We answer questions about how it works and whether it affects outputs.
715
Due to concerns about malicious applications, GPT2 will not be released (2019)
We’ve trained a large-scale unsupervised language model which generates coherent paragraphs of text, achieves state-of-the-art performance on many language modeling benchmarks, and performs rudimentary reading comprehension, machine translation, question answering, and summarization—all without task-specific training.
716
CVE-2026-98432: 9.8 CVE affecting all Ubuntu versions
Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.
717
PHP2Shell by Calif Research
A tale of two PHP remote vulnerabilities
718
Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
Team82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclosed the vulnerabilities to Danfoss, which addressed them in a new firmware version. Successful exploits of the…