211
AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
Wiz Red Agent finds its way into Snowflake's internal Jira through a flaw in a GitHub Copilot–Assisted PR.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 717 posts.
212
Frontier AI has broken the open CTF format
Why frontier AI has broken the open CTF format, hollowed out the scoreboard, and made competitive CTF performance a weaker signal than it used to be.
213
GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebu that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in…
214
Google Cloud fraud defense, the next evolution of reCAPTCHA
Today at Next ‘26, we’re launching Google Cloud Fraud Defense, the trust platform for the agentic web and the next evolution of reCAPTCHA.
215
A walking tour of surveillance infrastructure in Seattle (2020)
coveillance.org
216
An American Privacy Emergency
Scott’s foreword: Cynthia Dwork is Gordon McKay Professor of Computer Science at Harvard, and a pioneer in the fields of differential privacy and algorithmic fairness. On my recent travels to…
217
A case study in PDF forensics: The Epstein PDFs
The recent release of a tranche of files by the US Department of Justice (DoJ) under the “Epstein Files Transparency Act (H.R.4405)” has once again prompted many people to closely examine redacted and sanitized PDF documents. Our previous articles on the Manafort papers and the Mueller report , as well as a study by…
218
How I got over 300 Tor exit nodes removed
On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible.
219
I found a WordPress RCEs with GPT5.6 and $25
Adam Kues used a $200 GPT5.6 Sol Ultra subscription to discover a pre-authentication SQL injection and full RCE exploit chain in WordPress Core – a chain that chains a batch API desync, cache poisoning, changeset abuse, and hook injection into a complete takeover.
220
I built a vulnerable app and spent $1,500 seeing if LLMs could hack it
As a part of my work I do security research for various apps and websites. I wanted to see if LLMs could reproduce a common class of exploits I've found in multiple apps. So I built a deliberately vulnerable book review app and spent $1,500 finding out…
221
I think the military commissary's freezers were hacked
The frozen pizza aisle has become the national security risk du jour
222
A closer look at a BGP anomaly in Venezuela
There has been speculation about the cause of a BGP anomaly observed in Venezuela on January 2. We take a look at BGP route leaks, and dive into what the data suggests caused the anomaly in question.
223
GPT-6 Astra Solves a WWI German Radio Cipher
Scienceblogs.de, a German science blogging portal, includes a relatively famous list of 50 unsolved ciphers, which range from cryptograms published by serial killers to the famous Voynich manuscript.
224
Just the rumour of a bug is enough to find an exploit these days
Thinking through how the conventional OSS security embargoes no longer buy us time, and what open source maintainers might do instead to respond
225
Breaking Claude Code Opus 5 Auto Mode
In this post, we explore how a simple website summary request hijacks Claude Code Opus 5 in Auto Mode and achieves code execution with 60-80% attack success …
226
Claude Code VS Code extension with backdoor released on Cursor marketplace
Yesterday, Anthropic were compromised and used to stage a global supply chain attack.
227
228
Hacking Moltbook
Learn how a misconfigured Supabase database at Moltbook exposed 1.5M API keys, private messages, and user emails, enabling full AI agent takeover.
229
How Shamir's Secret Sharing Works
A visual explanation of how threshold secret sharing lets any k of n shares recover a secret.
230
Period tracking app, Flo, found to be selling user data to Meta
What does this vagueness by-design mean for how we choose to self monitor our biological markers?
231
The future of Flipper Zero development
We've seen the strong reaction from the community over the idea that we've stopped developing the Flipper Zero firmware. We want to address this and let you know that we've heard all your feedback and have decided to rethink our approach to maintaining the project and engaging with the community.
232
Tailscale SSH: Investigation and remediation update
Securely connect to anything on the internet with Tailscale. Built on WireGuard®️, Tailscale enables you to make finely configurable connections, secured end-to-end according to zero trust principles, between any resources on any infrastructure.
233
Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and hundreds…
234
Someone at BrowserStack is leaking users' email addresses
Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legitimately from a service, if a service is hacked the hackers can't go credential stuffing, and I instantly know who leaked my address. A few weeks ago I signed up…
235
Updates to GitHub Copilot interaction data usage policy
From April 24 onward, interaction data from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out.
236
237
What Happened to HackerOne?
The rise and fall of the largest bug bounty platform in the world
238
Hardening Firefox with Claude Mythos Preview
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
239
Vulnerability reports are not special anymore
We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?
240
Cloudflare targets 2029 for full post-quantum security
Recent advances in quantum hardware and software have accelerated the timeline on which quantum attack might happen. Cloudflare is responding by moving our target for full post-quantum security to 2029.