481
482
Poison everywhere: No output from your MCP server is safe
Protect your organization with Idira®. Modernize identity governance, automate access reviews, and secure every identity across your hybrid cloud environment.
483
Mind the encryptionroot: How to save your data when ZFS loses its mind
While ZFS has a well-earned reputation for data integrity and reliability, OpenZFS native encryption has some incredibly sharp edges that will cut you if you don't know where to be careful. Unfortunately, I learned this the hard way, standing in a pool of my own blood and tears after thoroughly lacerating myself…
484
FBI, Dutch police disrupt 'Manipulaters' phishing gang
The FBI and authorities in The Netherlands this week seized dozens of servers and domains for a hugely popular spam and malware dissemination service operating out of Pakistan. The proprietors of the service, who use the collective nickname “ The Manipulaters ,” have been the subject of three stories published here…
485
How RubyGems.org protects OSS infrastructure
Recently, Socket.dev published research highlighting malicious gems designed to steal social media credentials. We wanted to use this as an opportunity to share more about how RubyGems.org security...
486
OWASP Non-Human Identities Top 10
A list of OWASP's Non-Human Identities Top 10 risks for 2025
487
Passkeys are just passwords that require a password manager
You reset your passkey the same way you reset your password. But you’ll find that passkeys make it harder to switch between password…
488
Crates.io phishing attempt
Earlier this week, an npm supply chain attack. It’s turn for crates.io, the main public repository for Rust crates (packages). The phishing e-mail looks like this: And it leads to a GitHub login pa...
489
Cloudflare scrubs Aisuru botnet from top domains list
For the past week, domains associated with the massive Aisuru botnet have repeatedly usurped Amazon , Apple , Google and Microsoft in Cloudflare’s public ranking of the most frequently requested websites. Cloudflare responded by redacting Aisuru domain names from their top websites list. The chief executive at…
490
Hacking the call records of millions of Americans
Imagine if anyone could punch in a phone number from the largest U.S. cell carrier and instantly retrieve a list of its recent incoming calls—complete with timestamps—without compromising the device, guessing a password, or alerting the user. Now imagine that number belongs to a journalist, a police officer, a…
491
Cross-Site Request Forgery
Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.
492
Windows 10 spies on your use of System Settings (2021)
Windows 10 spies on your use of System Settings
493
494
Shifting Cyber Norms: Microsoft security POST-ing to you
tl;dr: Microsoft and other email security scanners will visit the links in email you transmit, and run the JavaScript in those links, including calls that lead to POSTs going out. This used to be unacceptable, since POSTs have side effects. Yet here we are. This breaks even somewhat sophisticated single-use sign-on /…
495
Fun with gzip bombs and email clients
I served a 10MB gzip bomb as an image in HTML email. Most clients and proxies coped, iOS Mail crashed and Evolution wrote 100GB of cache to my disk.
496
Why not use DNS over HTTPS (DoH)?
DoH is not about protecting your DNS queries from peepers. That is a big lie. It is about making sure only one peeper can see all of your queries.
497
What, if anything, should I do about using Mozilla's Firefox
I have used it for a long time - 20 years now, including for a while the IceWeasel variant - and I like it as a browser.
498
When root meets immutable: OpenBSD chflags vs. log tampering
Rafael Sadowski
499
Sam Altman Wants Your Eyeball
Last week, OpenAI's CEO Sam Altman announced in San Francisco that the World project he co-founded, formerly known as Worldcoin, is opening six stores across the United States, allowing users of the project's app to scan their eyeballs. This is worrisome, to say the least.
500
The "Take It Down" Act
We've opposed the Take It Down Act because it could be easily manipulated to take down lawful content that powerful people simply don't like. Last night, President Trump demonstrated he has a similar view on the bill. He wants to sign the bill into law, then use it to remove content about — him....
501
ESIM Security
In a result of its research investigation efforts, Security Explorations, a research lab of AG Security Research company, conducted security analysis of eSIM technology.
502
Xcode Constantly Phones Home
Building StopTheMadness Pro in Xcode is usually very fast, because my project doesn't use any Swift. It's a combination of Objective-C, which compiles much more quickly than Swift, and JavaScript, which doesn't need to be compiled. However, sometimes the builds were very slow for some strange reason. Checking the…
503
The State of SSL Stacks
The SSL landscape has shifted dramatically. In this paper, we examine OpenSSL 3.x, BoringSSL, LibreSSL, WolfSSL, and AWS-LC with HAProxy.
504
How much EU is in DNS4EU?
This is another post that started after several toots on mastodon. Most of the things presented here were already tooted by other people, but I think this is a good chance to write a mini tutorial about what to look at. We’ll use DNS, whois, BGP and your favourite search engine. What is DNS4EU? To quote the web page…
505
Susctl CVE-2024-54507: A particularly 'sus' sysctl in the XNU kernel
A very sus sysctl in the XNU kernel.
506
From MCP to shell: MCP auth flaws enable RCE in Claude Code, Gemini CLI and more
How MCP authentication flaws enable RCE in Claude Code, Gemini CLI, and more.
507
Trust Me, I'm Local: Chrome Extensions, MCP, and the Sandbox Escape
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
508
Pump the Brakes on Your Police Department's Use of Flock Safety
Even if you can’t stop Flock’s use entirely, you can still help protect civil liberties in your community.
509
Decompiling 2024: A Year of Resurgance in Decompilation Research
The year 2024 was a resurgent year for decompilation. Academic publications from that year made up nearly 30% of all top publications ever made in decompilation. In this post, I do a summarization and retrospective of both the academic and ideological progress of decompilation in 2024. Hint: decompilation research is…
510
Acronis True Image costs performance when not used
Over two years ago I installed Acronis True Image for Crucial in order to migrate my data to a new SSD I had just purchased. It worked. I then left True Image installed “just in case”, and what har…