Update with OpenAI response added What happened? On 29 May 2025 I privately reported a vulnerability to the OpenAI disclosure mailbox using an encrypted email. The flaw allows peeking at chat responses intended for other users. This content may contain personal data, confidential business plans, …
Google signed a definitive agreement to acquire Wiz. This deal will make it easier for companies to protect themselves across major clouds.
Earlier this year I demoed iOS 6 running on an iPod touch 3 - a device that Apple never gave iOS 6 to, making iOS 5.1.1 the latest build it can run
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
All web browsing starts with a DNS query to find the IP address for the desired service or website. For much of the internet’s history, this query is sen
Build resilient GitHub Actions workflows with insights from real attacks, missteps to avoid, and security tips GitHub’s docs don’t fully cover.
When Microsoft 365 Copilot (M365 Copilot) was asked to summarize a specially crafted Microsoft Office document, an indirect prompt injection payload triggered the execution of arbitrary instructions to fetch sensitive tenant data, such as “recent emails” and hex encode the fetched output. M365 Copilot then generated a…
Today we turned off our Online Certificate Status Protocol (OCSP) service, as announced in December of last year. We stopped including OCSP URLs in our certificates more than 90 days ago, so all Let’s Encrypt certificates that contained OCSP URLs have now expired. Going forward, we will publish revocation information…
Through an analysis of 10 months of nationwide searches on Flock Safety's servers, we discovered that more than 50 federal, state, and local agencies ran hundreds of searches through Flock's national network of surveillance data in connection with protest activity. In some cases, law enforcement specifically targeted…
Or using lots of little tools to aggressively reject the bots
On a benchmark of real exploited contracts, AI agents found vulnerabilities worth a combined $4.6 million, underscoring the need for AI-powered defense.
lol. I minted a new TLS cert and it seems that OpenAI is scraping CT logs for what I assume are things to scrape from, based on the near instant response from ...
Cloudflare is launching an experiment with Chrome to evaluate fast, scalable, and quantum-ready Merkle Tree Certificates, all without degrading performance or changing WebPKI trust relationships.
The Open Source Technology Improvement Fund is proud to share the results of our security audit of Ruby on Rails . Ruby on Rails (or “Rails”) is an open source full stack web-application framework. Thanks to the help of X41 D-Sec , GitLab , and the Sovereign Tech Agency , Rails can provide more secure versions of the…
The Legit research team unearthed vulnerabilities in GitLab Duo.
Technical blog by Stephan Berger (@malmoeb)
A Jitsi feature allows an attacker to transmit user's microphone and camera in the background without their consent.
DEF CON has alienated many hackers by officially aligning its geopolitics with those of the U.S. military and announcing partnerships with the authoritarian countries of Bahrain and Singapore.
Drilling beneath the hype to expose the truth
oddlama's personal web page and blog
Encryption is not a crime, encryption protects us all. Encryption, and especially end-to-end encryption, is an essential tool to protect everyone online. Attempts to undermine encryption are an attack to our fundamental right to privacy and an attack to our inherent right to security and safety.
An indie project for early 2010s internet addicts
In May 2025, the European Union levied financial sanctions on the owners of Stark Industries Solutions Ltd. , a bulletproof hosting provider that materialized two weeks before Russia invaded Ukraine and quickly became a top source of Kremlin-linked cyberattacks and disinformation campaigns. But new findings show those…
One of my weirder hobbies is trying to convince people that the idea that companies are listening to you through your phone’s microphone and serving you targeted ads is a …
From April 2026, only verified devices can send or receive end-to-end encrypted message on Element.
Quick reference for how to turn off AI features in Firefox
Discover how AWS’s Account Assessment tool introduced a serious security risk through its default deployment guidance & key steps to detect & remediate it.
