571
Norway Fining Meta $98,500 per Day for User Privacy Breach
Norway’s DPA Datatilsynet is penalizing Meta over alleged data privacy breaches, with profound implications across Europe. Learn more in the full news story!
572
TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
Analysis of PDD’s app software by multiple experts is showing all the signs of red-flag concern. The calls to outside device data and functions that violate users’ privacy are far more aggressive than any well-known consumer shopping app.
573
Enable ARMv9 Memory Tagging Extension (MTE) on Pixel 8
The Pixel 8 hardware ( Tensor G3 ) supports the ARM Memory Tagging Extension (MTE) , and software support is available both in Android userspace and the Linux kernel. This feature is a powerful defense against linear buffer overflows and many types of use-after-free flaws. I’m extremely happy to see this hardware…
574
575
CJEU declares Meta's GDPR approach illegal
In today's decision, the CJEU declared Meta/Facebook's GDPR approach largely illegal - similar to noyb's previous litigation before the EDPB leading to a fine of € 390 million.
576
RCE on MikroTik routers with IPv6 RA enabled
MikroTik makes networking hardware and software, which is used in nearly all countries of the world. Our mission is to make existing Internet technologies faster, more powerful and affordable to wider range of users.
577
HTTP/2 Rapid Reset: deconstructing the record-breaking attack
This post dives into the details of the HTTP/2 protocol, the feature that attackers exploited to generate the massive Rapid Reset attacks
578
Concrete: A fully homomorphic encryption compiler
An introduction on how to use the Zama Concrete open source TFHE compiler
579
TOFU: Do You Check?
Let’s say you’re on a fresh machine. Maybe you’ve just started a new job or you’ve wiped your machine. You’re about to push some code you’ve written and you get this: $ git push The authenticity of host 'github.com (140.82.121.4)' can't be established. ED25519 key fingerprint is…
580
Windows 11: TPMs and Digital Sovereignty
The problem with enforcing TPMs on consumers
581
We Were Wrong About the GPLs
an unsurprising admission in Conservancy v. Vizio
582
EU Digital Identity framework (eIDAS) another kind of chat control?
The proposed EU Digital Identity framework (eIDAS) aims to meddle with the process around internet certificates and will undermine the independence and security assurances of the basis for website security:
583
When does an old iPhone become unsafe to use?
When Apple stops issuing security updates for older iPhones, they become unsafe to use. But exactly how long can you safely keep using an old iPhone, and when should you upgrade?
584
Trust-based moderation systems
master's thesis research into subjective, trust-based moderation systems
585
Information about a recent security incident at Mailchimp
Maintaining our security commitment to our customers
586
iOS Single App Mode Escape
This blogpost, written by WithSecure’s STINGR Group, presents the analysis of a security incident that happened in February 2026 and was investigated by the WithSecure Incident Response team.
587
Deobfuscating World of Warships' Python Scripts
An in-depth analysis of how World of Warships obfuscates its game scripts and how to mostly deobfuscate them automatically.
588
Seized Genesis Market data is now searchable in Have I Been Pwned
A quick summary first before the details: This week, the FBI in cooperation with international law enforcement partners took down a notorious marketplace trading in stolen identity data in an effort they've named "Operation Cookie Monster". They've provided millions of impacted email addresses and passwords to Have I
589
590
Supply Chain Attack Using PyPI Packages “Colorslib”, “Httpslib”, and “Libhttps”
The FortiGuard Labs team discovered an attack embedded in three PyPI packages called ‘colorslib’, ‘httpslib’, and “libhttps”. Read our blog to learn more.…
591
Vulnerabilities in the TPM 2.0 reference implementation code
In this blog post we discuss the details of two vulnerabilities we discovered in the Trusted Platform Module (TPM) 2.0 reference implementation code. These two vulnerabilities, an out-of-bounds write (CVE-2023-1017) and an out-of-bounds read (CVE-2023-1018), affected several TPM 2.0 software implementations (such as…
592
Can I remove my personal data from GenAI training datasets?
Short answer: Practically-speaking, probably not.
593
OpenAI Begins Tackling ChatGPT Data Leak Vulnerability
OpenAI seems to have implemented some mitigation steps for a well-known data exfiltration vulnerability in ChatGPT. Attackers can use image markdown rendering …
594
An investigation into Apple’s new Relay network
Guest Post: Analysing Apple Private Relay’s effects on the Internet and future measurement-based research.
595
596
Letting users block injected third-party DLLs in Firefox
Users can now block poorly behaving third-party DLLs in Firefox to improve stability and performance.
597
Introduction to sysclean(8)
sysclean(8) is a system tool designed for help system administrator to keep their OpenBSD clean after upgrade.
598
Glitching a microcontroller to unlock the bootloader
Back in the summer I was lucky enough to finagle my boss into letting me take Dmitry Nedospasov ( @nedos )’s hardware hacking training . In it I cut my teeth on using an FPGA to interface with target hardware. After implementing a UART we implemented a module that could parse part of Apple’s OneWire, used to negotiate…
599
Colorado Supreme Court Upholds Keyword Search Warrant
Today, the Colorado Supreme Court became the first state supreme court in the country to address the constitutionality of a keyword warrant—a digital dragnet tool that allows law enforcement to identify everyone who searched the internet for a specific term or phrase. In a weak and ultimately...
600
Phishing Darknet Users for Bitcoins
Writeup of a tool for creating bitcoin stealing phishing clones of onion services on large scale