451
Malvertising on Microsoft Edge's news feed pushes tech support scams
While Google Chrome still dominates as the top browser, Microsoft Edge, which is based on the Chromium source code, is gradually gaining more...
452
Reverse Engineering Google Colab
Take a peek into the internals of Google Colab, and discover how we can bend the rules of Colab a little in order to adapt it to our MLOps workflow
453
Outlook.com is silently discarding email messages (2015)
Outlook.com and hotmail.com is silently discarding email messages from our SMTP server.
454
Pwned, the book
The first time I ever wrote publicly about a company's security vulnerabilities, my boss came to have a word with me after seeing my name in the news headlines. One of the worst days I've ever had was right in the middle of the Have I Been Pwned
455
Tencent WeChat is now a GitHub secret scanning partner
GitHub secret scanning protects users by searching repositories for known types of secrets. By identifying and flagging these secrets, our scans help prevent data leaks and fraud. We have partnered…
456
Bring Your Own Password Manager: Portable BitWarden on a Pi Zero
BYOPM is a self hosted portable Password Manager implementation based on BitWarden and Raspberry PI Zero.
457
The curious tale of a fake Carrier.app
Posted by Ian Beer, Google Project Zero NOTE: This issue was CVE-2021-30983 was fixed in iOS 15...
458
An unexpected Redis sandbox escape affecting Debian-based distros
This post describes how I broke the Redis sandbox, but only for Debian and Debian-derived Linux distributions. Upstream Redis is not affected. That makes it a Debian vulnerability, not a Redis one. The culprit, if you will, is dynamic linking, but there will be more on that later.
459
Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography
We are honored to be recognized for the impact on the field of cryptography.
460
Hashing is not encryption
Encryption, encoding, and hashing are three related but distinct concepts. It’s important for you to understand all three.
461
'Zero trust’ security is a poor choice of words
Consider the user's perspective when naming a security initiative
462
A large collection of fraudulent web stores
It started simply enough...
463
De-anonymizing ransomware domains on the dark web
* We have developed three techniques to identify ransomware operators' dark websites hosted on public IP addresses, allowing us to uncover previously unknown infrastructure for the DarkAngels, Snatch, Quantum and Nokoyawa ransomware groups. * The methods we used to identify the public internet IPs involved matching…
464
The AMD Branch (Mis)Predictor Part 2: Where No CPU Has Gone Before
In this blog post, OSS Security Researcher Pawel Wieczorkiewicz shares his journey from trying to save one byte of code to the discovery of two new cases of Straight-Line-Speculation (SLS) which affect the Zen1 and Zen2 microarchitectures of AMD CPUs. Using the findings presented in his earlier blog on the AMD branch…
465
Are blockchains decentralized?
A new Trail of Bits research report examines unintended centralities in distributed ledgers Blockchains can help push the boundaries of current technology in useful ways. However, to make good risk decisions involving exciting and innovative technologies, people need demonstrable facts that are arrived at through…
466
“Privacy”.com–Yeah Right
At the behest of a friend of mine, I decided to get myself a Privacy.com account. I filled it out with my personal information, activated the account, and...
467
Explained from scratch: private information retrieval and homomorphic encryption
This is a from-scratch explanation of private information retrieval built using homomorphic encryption. I try to assume only a general math / computer science background. To simplify things, my explanations may not always match academic definitions. You can check out this paper or code for more.
468
Hardening attack surfaces with formally proven binary format parsers
With an eye toward performance, interoperability, or legacy concerns, low-level system software often must parse binary encoded data formats. Few tools are available for this task, especially since the formats involve a mixture of arithmetic and data dependence, beyond what can be handled by typical parser generators…
469
Cloudflare to acquire Area 1 Security for $162M
Earlier today we announced that Cloudflare has agreed to acquire Area 1 Security
470
Racing against the clock – hitting a tiny kernel race window
TL;DR: How to make a tiny kernel race window really large even on kernels without CONFIG_PREEMPT...
471
Gmail will call the cops on you based on the content of your emails
Correction: An earlier draft of this story misstated a technical detail; Mark didn’t email his photo to his doctor; rather, he took the photo with his phone and the image was automatically synched to his Google Photos account, triggering a scan .
472
Exploiting the Wii U's USB Descriptor parsing
In this write-up we're going to take a look at exploiting the Wii U's USB Host Stack. Over the past few months I spent a lot of time reverse...
473
Linux Kernel Ksmbd Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable.
474
475
Tailscale Authentication for Nginx
Use Tailscale's nginx-auth for secure Single Sign-On (SSO) to internal services, reducing the need for internal account systems.
476
477
Microsoft Office 365 Message Encryption Insecure Mode of Operation
This blogpost, written by WithSecure’s STINGR Group, presents the analysis of a security incident that happened in February 2026 and was investigated by the WithSecure Incident Response team.
478
Fuzzing ping(8) and finding a 24 year old bug
FreeBSD had a security fluctuation in their implementation of ping(8) the other day. As someone who has done a lot of work on ping(8) in OpenBSD this tickled my interests.
479
Extracting TLS keys from an unwilling application (2020)
I want to be able to inspect the traffic of programs running on my computer. I don’t really trust those programs and ideally I’d like to put nearly all of them into a high security jail. One of those programs is Oculus software. There are a few reasons why I want to be cautious about Oculus software.
480
Some notes on the Stable Diffusion safety filter
How deep learning models are moderated