181
Windows BitLocker – Screwed Without a Screwdriver
Breaking up-to-date Windows 11 BitLocker encryption -- on-device but software-only
182
Did Semgrep Just Get a Lot More Interesting?
Documentation and guides from the team at Fly.io.
183
JTAG 'Hacking' the Original Xbox in 2023
Released in November 2001, the original Xbox was Microsoft’s first venture into the game console industry. With its hardware closely resembling a cheap but v...
184
Signal – An Ethical Replacement for WhatsApp
Moving from WhatsApp to Signal is an important action, right now. WhatsApp’s parent company, Meta, has been involved in several cases of election interference: America in 2016, Trinidad and Tobago …
185
Fake VS Code Extension on NPM Spreads Multi-Stage Malware
The Mend research team uncovered a fake VS-code extension—truffelvscode—typosquatting the popular truffle for VS-code extension. Read the post for more details.
186
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication
Starting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack campaigns were highly targeted and carried out in a variety of ways. The majority of these attacks originated via…
187
Hardening the Firefox Front End with Content Security Policies
Most of the Firefox User Interface (UI), including the address bar and the tab strip, are implemented using standard web technologies like HTML, CSS and JavaScript plus some additional custom components like XUL. One of the advantages of using web technologies for the front end is that it allows rendering the frontend…
188
Certificate Transparency in Firefox
Certificate Transparency (CT) has been one of the biggest advancements in web security, keeping users safe from threats such as certificate fraud and…
189
How we reduced the impact of zombie clients
Every night, right around midnight (mainly UTC), a horde of zombies wakes up and clamors for … digital certificates! The zombies in question are abandoned or misconfigured Internet servers and ACME clients that have been set to request certificates from Let’s Encrypt. As our certificates last for at most 90 days…
190
Removing XSLT for a more secure browser
Prepare for Chrome deprecating and removing XSLT from the browser.
191
An attacker’s blunder gave us a look into their operations
An attacker installed Huntress onto their operating machine, giving us a detailed look at how they’re using AI to build workflows, searching for tools like Evilginx, and researching targets like software development companies.
192
Hidden risk in Notion 3.0 AI agents: Web search tool abuse for data exfiltration
CodeIntegrity research on Notion AI security, Notion 3.0 AI Agents, lethal trifecta risk, indirect prompt injection, web search tool abuse, and data exfiltration.
193
Code highlighting extension for Cursor AI used for $500k theft
Kaspersky GReAT experts uncover malicious extensions for Cursor AI that download the Quasar backdoor and a crypto stealer.
194
LetsEncrypt – Expiration Notification Service Has Ended
Since its inception, Let’s Encrypt has been sending expiration notification emails to subscribers that have provided an email address to us via the ACME API. This service ended on June 4, 2025. The decision to end the service is the result of the following factors: Over the past 10 years more and more of our…
195
Auth.js is now part of Better Auth
Auth.js, formerly known as NextAuth.js, is now being maintained and overseen by Better Auth team
196
Digital ID, a new way to create and present an ID in Apple Wallet
Digital ID is a new way for users to create an ID in Apple Wallet using their U.S. passport, and present it with the privacy of iPhone or Apple Watch.
197
Decreasing Certificate Lifetimes to 45 Days
Let’s Encrypt will be reducing the validity period of the certificates we issue. We currently issue certificates valid for 90 days, which will be cut in half to 45 days by 2028. This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the…
198
What It Takes to Defend a Cybersecurity Company from Today's Adversaries
This report highlights a rarely-discussed but crucially important attack surface: security vendors themselves.
199
Kaspersky exposes hidden malware on GitHub stealing personal data
Kaspersky Global Research & Analysis Team (GReAT) discovered hundreds of open source repositories with multistaged malware targeting gamers and cryptoinvestors within a new campaign that was dubbed by Kaspersky as GitVenom. The infected projects include an automation instrument for interacting with Instagram accounts…
200
Bitcoin's big secret: How cryptocurrency became law enforcement's secret weapon
WIRED's Andy Greenberg discusses a revelation that turned his decades-long reporting on its head: Bitcoin became a criminal's worst nightmare.
201
Upcoming coordinated security fix for all Matrix server implementations
Matrix, the open protocol for secure decentralised communications
202
A kernel stack use-after-free: Exploiting Nvidia's GPU Linux drivers
This article details two bugs discovered in the NVIDIA Linux Open GPU Kernel Modules and demonstrates how they can be exploited. The bugs can be triggered by an attacker controlling a local unprivileged process. Their security implications were confirmed via a proof of concept that achieves kernel read and write…
203
Rustls Server-Side Performance
In past years, the Rustls project has been happy to receive substantial investments from the ISRG. One of our goals has been to improve performance without compromising on safety. We last posted about our performance improvements in October of 2024, and we're back to talk about another round of improvements. What is…
204
Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity
A subtle G++ bug from 2012, C++20’s new comparison rules, and legacy Boost code can collide to crash Solidity’s compiler on valid code. We unpack the surprising chain reaction and how to fix it.
205
Privacy Is Not Dead: Beware the All-or-Nothing Mindset
Privacy is only dead if we let it die. Be careful about the all-or-nothing mindset in data privacy, it can do more damage than good to the cause. While striving for improvements, do not forget to cheer and celebrate each small win.
206
My Mac contacted 63 different Apple owned domains in an hour, while not is use
During a one hour period today, my computer contacted 63 different Apple domains while i was not logged on and using it. I have been trying to minimize to the extent possible the reach of big tech into my life. A full 25% of the DNS queries from one of my computers (M2 MBA with macOS 15.4) are to Apple owned domains …
207
Online Behavioral Ads Fuel the Surveillance Industry
Each time you see a targeted ad, your personal information is exposed to thousands of advertisers and data brokers through a process called “real-time bidding” (RTB). This process does more than deliver ads—it fuels government surveillance, poses national security risks, and gives data brokers easy access to your…
208
Cryptographic Issues in Cloudflare's Circl FourQ Implementation (CVE-2025-8556)
The vulnerabilities we found in Cloudflare's CIRCL FourQ implementation: invalid-point attacks, Edwards-curve edge cases, and the disclosure that fixed them.
209
Finding thousands of exposed Ollama instances using Shodan
We uncovered 1,100+ exposed Ollama LLM servers—20% with open models—revealing critical security gaps and the need for better LLM threat monitoring.
210
Criminal complaint against facial recognition company Clearview AI
Clearview AI is known for scraping billions of photos of people around the world on the internet – and selling its facial recognition system to law enforcement and state actors