271
Exposing Russian EFF Impersonators: The Inside Story on Stealc and Pyramid C2
Discover how an open directory exposed a threat actor impersonating EFF to target gamers and how we mapped their infrastructure to Stealc & Pyramid C2.
272
No Leak, No Problem – Bypassing ASLR with a ROP Chain to Gain RCE
After my previous post on ARM exploitation, where we crafted an exploit for a known vulnerability, I decided to continue the research on a more modern IoT target. In this follow-up post, I will take you through building a considerably more complex binary exploit. We will explore the path from firmware extraction and…
273
XZ Utils Backdoor Still Lurking in Docker Images
In this blog, we share a new finding in the XZ Utils saga: several Docker images built around the time of the compromise contain the backdoor. At first…
274
Gmail can read your emails and attachments to train its AI, unless you opt out
Did you know that Gmail can use your emails and attachments for its smart features? Here's how to check your settings.
275
EFF to court: The Supreme Court must rein in secondary copyright liability
If the Supreme Court doesn’t reverse a lower court’s ruling, internet service providers (ISPs) could be forced to terminate people’s internet access based on nothing more than mere accusations of copyright infringement. This would threaten innocent users who rely on broadband for essential aspects...
276
Privacy Harm Is Harm
Every day, corporations track our movements through license plate scanners, building detailed profiles of where we go, when we go there, and who we visit. When they do this to us in violation of data privacy laws, we’ve suffered a real harm—period. We shouldn’t need to prove we’ve suffered...
277
Dear Mr. Vice President, Please Take Off Your Apple Watch
An Open Letter To JD Vance From A Former CIA Officer On The Counterintelligence Risks Of Smartwatches Mr. Vice President, Congratulations on your ascendancy to the Vice President of the United States of America. While we are an apolitical platform, we wish you nothing but success, the country depends on you. In a rec
278
About KeePassXC's Code Quality Control
KeePassXC Password Manager
279
Exploiting zero days in abandoned hardware
We successfully exploited two discontinued network devices at DistrictCon’s inaugural Junkyard competition in February, winning runner-up for Most Innovative Exploitation Technique. Our exploit chains demonstrate why end-of-life hardware poses persistent security risks.
280
Weaponizing Dependabot: Pwn Request at its finest
Your trusty Dependabot (and other GitHub bots) might be an unwitting accomplice. Through "Confused Deputy" attacks, they can be tricked into merging malicious code. This doesn't stop here. It can escalate to full command injection via crafted branch names and even bypass branch protection rules. Plus, we disclose two…
281
Free the Internet: The Tor Project's annual fundraiser
This year we are calling to FREE THE INTERNET. Your donation will help break the chains of censorship and surveillance. If you give now during the campaign, your donation will be matched by our supporters at Power Up Privacy. This means a $25 donation will have a $50 impact.
282
Google Wallet launches new age and identity verification features (ZK proofs)
Learn more about new Google Wallet updates, including new ways to use your digital ID for age and identity verification.
283
SynthID – A tool to watermark and identify content generated through AI
SynthID is a tool to watermark and identify AI-generated content, helping to foster transparency and trust in generative AI.
284
Teen safety, freedom, and privacy
Explore OpenAI’s approach to balancing teen safety, freedom, and privacy in AI use.
285
Answering questions about Android developer verification
News and insights on the Android platform, developer tools, and events.
286
MongoDB Server Security Update, December 2025
The following is an update on the security vulnerability identified in December 2025.
287
Arduino Terms of Service and Privacy Policy update: setting the record straight
We’ve heard some questions and concerns following our recent Terms of Service and Privacy Policy updates. We are thankful our community cares enough to
288
Texas Is Enforcing Its State Data Privacy Law. So Should Other States
States need to have and use data privacy laws to bring privacy violations to light and hold companies accountable for them. So, we were glad to see that the Texas Attorney General’s Office has filed its first lawsuit under Texas Data Privacy and Security Act (TDPSA) to take the Allstate Corporation...
289
290
Defeating KASLR by doing nothing at all
IntroductionI’ve recently been researching Pixel kernel exploitation and as part of this research...
291
Anonymous credentials: rate-limit bots and agents without compromising privacy
As AI agents change how the Internet is used, they create a challenge for security. We explore how Anonymous Credentials can rate limit agent traffic and block abuse without tracking users or compromising their privacy.
292
Counter Galois Onion: Improved encryption for Tor circuit traffic
Tor is upgrading its relay encryption algorithm for improved security. In upcoming releases, Arti and Tor will both support a new encryption algorithm called Counter Galois Onion (CGO). CGO prevents attackers from tampering with encrypted traffic, adds forward secrecy, and brings Tor's encryption up to modern…
293
Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
A public and free DNS service for a better security and privacy
294
Using bubblewrap to add sandboxing to NetBSD
As of the time of writing, there is no real sandboxing technique available to NetBSD. There is chroot , which can be considered a weak sandbox because it modifies the root directory of the process, effectively restricting the process' view of the file system, but it doesn't isolate anything else, so all networking…
295
Azure API vulnerability and roles misconfiguration compromise corporate networks
Over-privileged Azure Key Vault roles & API vulnerabilities let attackers steal credentials silently. Learn how Token Security detects & remediates these critical exposure paths.
296
DNS4EU for Public Is Available
The free DNS4EU resolver, for everyone in Europe. Get the addresses, set it up in minutes, and block malware and phishing with no tracking.
297
COM Like a Bomb: Rust Outlook Add-in
One of legal tech's clichés is that "lawyers live in Word". This is demonstrably incorrect. I, for example, am a lawyer and in fact live in London, England…
298
We built a resource hub to fight back against age verification
Age verification laws are proliferating fast across the United States and around the world, creating a dangerous and confusing tangle of rules about what we’re all allowed to see and do online. That's why today, we're launching EFF.org/Age, a one-stop shop for users seeking to understand what these laws actually do…
299
Agentic Misalignment: How LLMs could be insider threats
New research on simulated blackmail, industrial espionage, and other misaligned behaviors in LLMs.
300
Protect Public School Students from Surveillance of Off-Campus Speech
EFF filed an amicus brief in Arizona federal court arguing that public school students need private digital spaces beyond their school’s reach to speak freely, without the specter of constant school surveillance and punishment.