271
If you care about security you might want to move the iPhone Camera app
There's a quirk in the iPhone Camera app that can drive a security conscious iPhone owner crazy: if you touch your finger on the Camera app ...
272
MongoBleed Explained Simply
CVE-2025-14847 allows attackers to read any arbitrary data from the database's heap memory. It affects all MongoDB versions since 2017, here's a simple explanation:
273
Decrypting encrypted files from Akira ransomware using a bunch of GPUs
I recently helped a company recover their data from the Akira ransomware without paying the ransom. I'm sharing how I did it, along with the full source code. Update: since this article was written, a new version of Akira ransomware has appeared that can't be decrypted with this method The c
274
Axon’s Draft One is designed to defy transparency
Axon Enterprise’s Draft One — a generative artificial intelligence product that writes police reports based on audio from officers’ body-worn cameras — seems deliberately designed to avoid audits that could provide any accountability to the public, an EFF investigation has found.Our review of...
275
A technical look at Iran's internet shutdowns
This post is written by a human being (me).
276
The order of files in /etc/ssh/sshd_config.d/ matters
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
277
"Privacy preserving age verification" is bullshit
I don't think that it's impossible for politicians, even nontechnical politicians, to make good tech policy. After all, the fact that no one in Congress is a microbiologist doesn't stop federal standards from delivering potable water (and it doesn't excuse the ghastly failures, such as Flint, MI):
278
NSA and IETF: Can an attacker purchase standardization of weakened cryptography?
It's normal for post-quantum cryptography to be rolled out as an extra layer of security on top of traditional pre-quantum cryptography, rather than as a replacement .
279
Keeping secrets out of logs (2024)
There's no silver bullet, but if we put some "lead" bullets in the right places, we have a good shot at keeping sensitive data out of logs.
280
Congress passes Take It Down act despite major flaws
It would give the powerful a dangerous new route to manipulate platforms into removing lawful speech that they simply don't like, with President Trump himself saying that he would use the law to censor his critics. The bill passed the Senate in February, and it now heads to the president's desk.
281
Behind the 6-digit code: Building HOTP and TOTP from scratch
Personal website of Doğaç Eldenk.
282
Heap-overflowing Llama.cpp to RCE
Retr0's Threat Research
283
Bypassing GitHub Actions policies in the dumbest way possible
TL;DR : GitHub Actions provides a policy mechanism for limiting the kinds of actions and reusable workflows that can be used within a repository, organization, or entire enterprise. Unfortunately, this mechanism is trivial to bypass . GitHub has told me that they don’t consider this a security issue (I disagree), so…
284
Going Through Snowden Documents, Part 1
We are building a comprehensive archive and analysis project examining published documents leaked by Edward Snowden. Our methodology involves systematically reviewing each available document with particular attention to small details and information that has received little or no public attention since the initial…
285
A brief history of code signing at Mozilla
Shipping large software to end-user devices is a complicated process. Shipping large software securely to end-user devices is even more complicated. Signing the things that ship to end-user devices is
286
Key IOCs for Pegasus and Predator Spyware Removed with iOS 26 Update
iVerify brings operating system-level telemetry, behavioral baselining, and AI-driven threat hunting to hundreds of thousands of mobile devices
287
Mixpanel Security Breach
Our response to a recent security incident The Signal Inside Mixpanel |
288
289
Lumo: Privacy-first AI assistant
Lumo gives you the power to solve problems big and small, while keeping your personal data confidential. Try it now.
290
xAI dev leaks API key for private SpaceX, Tesla LLMs
An employee at Elon Musk’s artificial intelligence company xAI leaked a private key on GitHub that for the past two months could have allowed anyone to query private xAI large language models (LLMs) which appear to have been custom made for working with internal data from Musk’s companies, including SpaceX , Tesla and…
291
Next.js version 15.2.3 has been released to address a security vulnerability
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
292
CVE-2024-9956 – PassKey Account Takeover in All Mobile Browsers
Phishing PassKeys credentials using browser intents
293
Become unbannable from your email
You don't own your email; you rent it. This vulnerability leaves your entire digital life at risk. Read how to seize back control of your most critical online asset by switching providers and setting up your own unbannable email server.
294
Ten years of JSON Web Token and preparing for the future
Ten years ago this week, in May 2015, the JSON Web Token (JWT) became RFC 7519 . This was the culmination of a 4.5 year journey to create a simple JSON-based security token format and underlying JSON-based cryptographic standards. The full set of RFCs published together was:
295
The hidden JTAG in a Qualcomm/Snapdragon device’s USB port
Learn about JTAG and EUD
296
Taking over 60k spyware user accounts with SQL injection
Serverless means it's secure, right?
297
How to turn off Apple Intelligence
Learn how to turn off Apple Intelligence on iPhone, iPad, or Mac. Asurion Experts show you step-by-step how to manage your Apple devices’ smart features.
298
Google Safe Browsing incident
For approximately six hours on 25.9.2025, the entire statichost.eu domain was flagged as deceptive by Google Safe Search. This meant that anyone using Google Safe Search was shown a very aggressive warning or outright blocked when trying to access any site on the statichost.eu domain. In some cases even custom domains…
299
Exploring the Paramilitary Leaks
In January, Distributed Denial of Secrets published over 200 gigabytes of chat logs and recordings from paramilitary groups and militias, including American Patriots Three Percent (APIIII) and the Oath Keepers. The files were obtained by John Williams, a wilderness survival trainer who spent years deep undercover…
300
Kernel-hack-drill and exploiting CVE-2024-50264 in the Linux kernel
Some memory corruption bugs are much harder to exploit than others. They can involve race conditions, crash the system, and impose limitations that make a researcher's life difficult. Working with such fragile vulnerabilities demands significant time and effort. CVE-2024-50264 in the Linux kernel is one such hard bug…