241
Reverse Engineering Google Colab
Take a peek into the internals of Google Colab, and discover how we can bend the rules of Colab a little in order to adapt it to our MLOps workflow
242
Tencent WeChat is now a GitHub secret scanning partner
GitHub secret scanning protects users by searching repositories for known types of secrets. By identifying and flagging these secrets, our scans help prevent data leaks and fraud. We have partnered…
243
The curious tale of a fake Carrier.app
Posted by Ian Beer, Google Project Zero NOTE: This issue was CVE-2021-30983 was fixed in iOS 15...
244
Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography
We are honored to be recognized for the impact on the field of cryptography.
245
De-anonymizing ransomware domains on the dark web
* We have developed three techniques to identify ransomware operators' dark websites hosted on public IP addresses, allowing us to uncover previously unknown infrastructure for the DarkAngels, Snatch, Quantum and Nokoyawa ransomware groups. * The methods we used to identify the public internet IPs involved matching…
246
The AMD Branch (Mis)Predictor Part 2: Where No CPU Has Gone Before
In this blog post, OSS Security Researcher Pawel Wieczorkiewicz shares his journey from trying to save one byte of code to the discovery of two new cases of Straight-Line-Speculation (SLS) which affect the Zen1 and Zen2 microarchitectures of AMD CPUs. Using the findings presented in his earlier blog on the AMD branch…
247
Are blockchains decentralized?
A new Trail of Bits research report examines unintended centralities in distributed ledgers Blockchains can help push the boundaries of current technology in useful ways. However, to make good risk decisions involving exciting and innovative technologies, people need demonstrable facts that are arrived at through…
248
Hardening attack surfaces with formally proven binary format parsers
With an eye toward performance, interoperability, or legacy concerns, low-level system software often must parse binary encoded data formats. Few tools are available for this task, especially since the formats involve a mixture of arithmetic and data dependence, beyond what can be handled by typical parser generators…
249
Cloudflare to acquire Area 1 Security for $162M
Earlier today we announced that Cloudflare has agreed to acquire Area 1 Security
250
Racing against the clock – hitting a tiny kernel race window
TL;DR: How to make a tiny kernel race window really large even on kernels without CONFIG_PREEMPT...
251
Linux Kernel Ksmbd Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable.
252
Tailscale Authentication for Nginx
Use Tailscale's nginx-auth for secure Single Sign-On (SSO) to internal services, reducing the need for internal account systems.
253
254
Microsoft Office 365 Message Encryption Insecure Mode of Operation
This blogpost, written by WithSecure’s STINGR Group, presents the analysis of a security incident that happened in February 2026 and was investigated by the WithSecure Incident Response team.
255
Google open sourced PSP (hardware cryptographic offload)
We’re making the PSP Security Protocol for offloading encryption to network interface cards open source today. Here’s why.
256
Python malware starting to employ anti-debug techniques
First time anti-debug techniques are discovered in PyPI malware. Read how these techniques are implemented, including analysis and tips from JFrog Security Research.
257
Privacy Friendly Apps – improved privacy protection on the smartphone
We use our smartphone for private conversations, store our contacts and organise our meetings with it. The access to all this sensitive data is handled with the so-called permissions. It means, for example, that each app that requires the smartphone camera needs to get the corresponding permission first. Many of the…
258
The clever reason scammers can’t spell (2019)
Anybody who doesn’t fall off their chair laughing is exactly who they want to talk to – Cormac Herley, Microsoft computer scientist.
259
Multi-Account Containers Add-on on Mozilla VPN
At Mozilla, online privacy has always been one of our top priorities. Recently we announced Total Cookie Protection on Firefox Focus to combat cross-site t
260
Investigating a backdoored PyPI package targeting FastAPI applications
In this post, we analyze a malicious PyPI package attempting to backdoor FastAPI applications.
261
Should notes be end-to-end encrypted?
A comprehensive guide about the different types of encryption, the upsides and downsides, and how to make decisions about how much encryption you need for note-taking, passwords, or anything else.
262
Why We’re Suing NSO
Some of the most courageous journalists in the world write for El Faro, a Salvadoran news organization whose fearless, independent reporting about corruption, violence, and human rights abuses in Central America has earned it the gratitude of readers all over the world—and the enmity of criminal gangs and…
263
Yahoo Japan's password-free authentication reduced inquiries, sped up sign-in
Yahoo! JAPAN achieved a passwordless identity system. Learn their approach and the consequences of the effort.
264
Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild
Syslogk Rootkit Revealed: Analysis
265
Indian threat actor Patchwork APT caught in its own web
ThreatDown Patchwork Apt Caught In Its Own Web: threat intelligence on Patchwork APT tactics, targets, and how to detect and stop this threat.
266
Briar has been removed from Google Play
Status update Update (February 28, 13:20 UTC): Briar is available on Google Play again. Briar was briefly removed from Google Play because we didn’t provide Google’s review team with a username and password for testing the app. We provided Google with a username and password for testing and the app is now available…
267
Dozens of high-traffic websites vulnerable to ‘account pre-hijacking’, study
We enable the world to secure the web. Burp Suite, the Web Security Academy, and world-leading research from PortSwigger — the AppSec community’s home.
268
MoonBounce: The dark side of UEFI firmware
At the end of 2021, we inspected UEFI firmware that was tampered with to embed a malicious code we dub MoonBounce. In this report we describe how the MoonBounce implant works and how it is connected to APT41.
269
Protecting Against Browser-Language Fingerprinting
Brave has further strengthened its fingerprinting protections by preventing users from being identified based on preferred browser language. Starting with version 1.39, Brave randomizes how your browser informs sites of what language(s) you’ve set as default, and what fonts you have installed on your system.
270