31
I almost got hacked by a 'job interview'
I was 30 seconds away from running malware, Here's how a sophisticated scam operation almost got me, and why every developer needs to read this.
32
Have I Been Pwned 2.0
This has been a very long time coming, but finally, after a marathon effort, the brand new Have I Been Pwned website is now live! Feb last year is when I made the first commit to the public repo for the rebranded service, and we soft-launched the new brand
33
Supabase MCP can leak your entire SQL database
Indirect prompt injection through support-ticket data lets an MCP-enabled assistant cross trust boundaries and query private tables with Supabase’s privileged service role.
34
Samsung embeds IronSource spyware app on phones across WANA
In recent months, we have received numerous reports from users across West Asia and North Africa (WANA) expressing alarm over a little-known but deeply intrusive bloatware application—AppCloud—pre-installed on Samsung’s A and M series smartphones. Without users’ knowledge or consent, this bloatware collects sensitive…
35
Root shell on a credit card terminal
In this project, I started to reverse engineer payment card terminals because they seemed to be an interesting target for security research, given the high stakes involved. Although I initially didn’t know much about this industry, I did expect a ton of security features and a very security-hardened device. And to…
36
Why are anime catgirls blocking my access to the Linux kernel?
Hey… quick question, why are anime catgirls blocking my access to the Linux kernel?
37
Multiple Russia-aligned threat actors actively targeting Signal Messenger
Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.
38
8M users' AI conversations sold for profit by "privacy" extensions
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
39
Copilot broke audit logs, but Microsoft won't tell customers
We discoverd a vulnerability in Microsoft 365 Copilot that allows users to access files without getting detected or appearing in the audit log.
40
Reverse engineering a $1B Legal AI tool exposed 100k+ confidential files
Update: This post received a large amount of attention on Hacker News — see the discussion thread.
41
Whistleblower: DOGE Siphoned NLRB Case Data
A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk ‘s Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB…
42
10 Years of Let's Encrypt
On September 14, 2015, our first publicly-trusted certificate went live. We were proud that we had issued a certificate that a significant majority of clients could accept, and had done it using automated software. Of course, in retrospect this was just the first of billions of certificates. Today, Let’s Encrypt is…
43
A German ISP changed their DNS to block my website
One of Germany's biggest ISPs changed how their DNS works, right after I exposed an organization that they’re part of.
44
Technical analysis of the Signal clone used by Trump officials
💡Update May 3, 2025: I have posted a follow-up, Here's the source code for the unofficial Signal app used by Trump officials. Update May 4, 2025: Another followup, and a big one: The Signal Clone the Trump Admin Uses Was Hacked Update May 6, 2025: I've written
45
Chat Control Must Be Stopped
Chat Control is back to undermine everyone's privacy. There's an important deadline on October 14th, 2025. We must act now to stop it!
46
Smuggling arbitrary data through an emoji
With ZWJ (Zero Width Joiner) sequences you could in theory encode an unlimited amount of data in a single emoji.
47
Google Antigravity exfiltrates data via indirect prompt injection attack
An indirect prompt injection in an implementation blog can manipulate Antigravity to invoke a malicious browser subagent in order to steal credentials and sensitive code from a user’s IDE.
48
The privacy nightmare of browser fingerprinting
If you were worried about tracking cookies, you really don’t want to know about browser fingerprinting.
49
The “S” in MCP Stands for Security
Spoiler: it doesn’t. But it should.
50
Nepenthes is a tarpit to catch AI web crawlers
Making web crawlers eat shit since 2023
51
Exposed DeepSeek database leaking sensitive information, including chat history
A publicly accessible database belonging to DeepSeek allowed full control over database operations, including the ability to access internal data. The exposure includes over a million lines of log streams with highly sensitive information.
52
Supreme Court's ruling practically wipes out free speech for sex writing online
Am I now committing civil disobedience... just by keeping my personal literary website up as is?
53
Lawmakers want to ban VPNs
It's unfortunately no longer enough to force websites to check your government-issued ID before you can access certain content, because politicians have now discovered that people are using Virtual Private Networks (VPNs) to protect their privacy and bypass these invasive laws. Their solution? Entirely ban the use of…
54
How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos
The Latest News from Research at Kudelski Security
55
I have recordings proving Coinbase knew about breach months before disclosure
I have recordings and emails showing attacks months before Coinbase's 'discovery'. Timeline, headers, and audio evidence.
56
Who owns Express VPN, Nord, Surfshark? VPN relationships explained (2024)
Who owns the major VPN companies like Express, Nord, and Surfshark? We take you through an interactive map of the murky world of VPNs.
57
58
Unlocking free WiFi on British Airways
Personal website talking about some stuff I've made and technology
59
We hacked Gemini's Python sandbox and leaked its source code (at least some)
Leaked Google's internal google3 source and confidential security protos out of Gemini's Python sandbox by exfiltrating a 579 MB binary in 10 MB chunks.
60
DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage
💡Update May 21, 2025: I've written a new detailed analysis of the heap dump dataset itself: TeleMessage customers include DC Police, Andreessen Horowitz, JP Morgan, and hundreds more Update May 26, 2025: I've published the source code for TeleMessage Explorer: a new open source research tool This morning,