Some time ago, we were contacted by a group fighting against online CSAM, demanding that AdGuard DNS blocks the Archive.today website. This was only the beginning of a much larger story…
EFF is deeply saddened to learn of the passing of Mark Klein, a bona fide hero who risked civil liability and criminal prosecution to help expose a massive spying program that violated the rights of millions of Americans.Mark didn’t set out to change the world. For 22 years, he was a...
How Google actively breaks Immich deployments, an open-source Google Photos alternative.
The popular packages debug and chalk on npm have been compromised with malicious code
News and insights on the Android platform, developer tools, and events.
Securely connect to anything on the internet with Tailscale. Built on WireGuard®️, Tailscale enables you to make finely configurable connections, secured end-to-end according to zero trust principles, between any resources on any infrastructure.
Anthropic research on data poisoning attacks shows a few hundred malicious documents can "backdoor" large language models of any size.
In a moment of clarity after initially moving forward a deeply flawed piece of legislation, the French National Assembly has done the right thing: it rejected a dangerous proposal that would have gutted end-to-end encryption in the name of fighting drug trafficking.
Over 1,000 NPM packages were infected using the same method as the previous attack, infecting with a fake Bun runtime. The attacker leveraged the `preinstall` script to download and execute a malicious payload, stealing sensitive information from the compromised machines.
In the past, if you broke or lost your phone, your Signal message history was gone. This has been a challenge for people whose most important conversations happen on Signal. Think family photos, sweet messages, important documents, or anything else you don’t want to lose forever. This explains wh...
Eight Sleep smart bed found to contain an exposed AWS key and a likely backdoor that allowed engineers to remotely access users' beds
Today we are announcing a new privacy feature coming to Kagi Search. Privacy Pass is an authentication protocol first introduced by Davidson et al., in [1], and recently standardized by the IETF as RFCs [2—4]. Our...
Indirect prompt injection through support-ticket data lets an MCP-enabled assistant cross trust boundaries and query private tables with Supabase’s privileged service role.
In recent months, we have received numerous reports from users across West Asia and North Africa (WANA) expressing alarm over a little-known but deeply intrusive bloatware application—AppCloud—pre-installed on Samsung’s A and M series smartphones. Without users’ knowledge or consent, this bloatware collects sensitive…
Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
We discoverd a vulnerability in Microsoft 365 Copilot that allows users to access files without getting detected or appearing in the audit log.
On September 14, 2015, our first publicly-trusted certificate went live. We were proud that we had issued a certificate that a significant majority of clients could accept, and had done it using automated software. Of course, in retrospect this was just the first of billions of certificates. Today, Let’s Encrypt is…
Chat Control is back to undermine everyone's privacy. There's an important deadline on October 14th, 2025. We must act now to stop it!
An indirect prompt injection in an implementation blog can manipulate Antigravity to invoke a malicious browser subagent in order to steal credentials and sensitive code from a user’s IDE.
A publicly accessible database belonging to DeepSeek allowed full control over database operations, including the ability to access internal data. The exposure includes over a million lines of log streams with highly sensitive information.
It's unfortunately no longer enough to force websites to check your government-issued ID before you can access certain content, because politicians have now discovered that people are using Virtual Private Networks (VPNs) to protect their privacy and bypass these invasive laws. Their solution? Entirely ban the use of…
The Latest News from Research at Kudelski Security
Who owns the major VPN companies like Express, Nord, and Surfshark? We take you through an interactive map of the murky world of VPNs.
Leaked Google's internal google3 source and confidential security protos out of Gemini's Python sandbox by exfiltrating a 579 MB binary in 10 MB chunks.
I’m old enough to remember when age verification bills were pitched as a way to ‘save the kids from porn’ and shield them from other vague dangers lurking in the digital world (like…“the transgender”). We have long cautioned about the dangers of these laws, and pointed out why they are likely to...
We are excited to announce a significant advancement in the security of the Signal Protocol: the introduction of the Sparse Post Quantum Ratchet (SPQR). This new ratchet enhances the Signal Protocol’s resilience against future quantum computing threats while maintaining our existing security guar...
GotaTun is a WireGuard® implementation written in Rust aimed at being fast, efficient and reliable.
