151
Apple vs the Law
Apple & Google at the EU DMA compliance workshops, June 2025.
152
153
Github scam investigation: Thousands of “mods” and “cracks” stealing data
While looking through the articles on a "social engineering" themed forum I discovered a relatively new scam scheme that shocked me. People create thousands of GitHub repositories with all sorts of things - from Roblox and Fortnite mods to "cracked" FL Studio and Photoshop. As soon as you download and
154
EPA Seeks to Eliminate Critical PFAS Drinking Water Protections
The move continues to expose communities across the country to toxic forever chemicals in tap water
155
Meta accessed women's health data from Flo app without consent, says court
A jury has ruled that Meta accessed sensitive information from women's reproductive health tracking app Flo without consent.
156
Feds Link Cyberheist to 2022 LastPass Hacks
In September 2023, KrebsOnSecurity published findings from security researchers who concluded that a series of six-figure cyberheists across dozens of victims resulted from thieves cracking master passwords stolen from the password manager service LastPass in 2022. In a court filing this week, U.S. federal agents…
157
Ring introducing new feature to allow police to live-stream access to cameras
Ring founder Jamie Siminoff is back at the helm of the surveillance doorbell company, and with him is the surveillance-first-privacy-last approach that made Ring one of the most maligned tech devices. Not only is the company reintroducing new versions of old features which would allow police to...
158
We identified a North Korean hacker who tried to get a job
Cybersecurity isn’t just a priority for Kraken, it’s part of our origin story and embedded into our DNA.
159
Can you trust that permission pop-up on macOS?
A security research blog.
160
Homomorphic encryption in iOS 18
A mathematical miracle enables Apple's servers to process your photos while never knowing anything about them
161
Okta Bcrypt incident lessons for designing better APIs
Hello there! If you follow tech news, you might have heard about the Okta security incident that was reported on 1st of November. The TLDR of the incident was …
162
Disrupting the first reported AI-orchestrated cyber espionage campaign
A report describing a highly sophisticated AI-led cyberattack and how we disrupted it.
163
NCSC, GCHQ, UK Gov't expunge advice to “use Apple encryption”
This is some really embarrassing timing on the Home Office’s (HO’s) part: a few weeks ago when news first broke of the HO’s demand for a backdoor in Apple ADP, I pointed out to MP…
164
EFF launches Age Verification Hub
With ill-advised and dangerous age verification laws proliferating across the United States and around the world, creating surveillance and censorship regimes that will be used to harm both youth and adults, the Electronic Frontier Foundation has launched a new resource hub that will sort through the mess and help…
165
WorstFit: Unveiling Hidden Transformers in Windows ANSI
📌 This is a cross-post from DEVCORE. The research was first published at Black Hat Europe 2024. Personally, I would like to thank splitline, the co-author of this research & article, whose help
166
Breaking Git with a carriage return and cloning RCE
tl;dr: On Unix-like platforms, if you use git clone --recursive on an untrusted repo, it could achieve remote code execution. Update to a fixed version of Git and other software that embeds Git (including GitHub Desktop).
167
Okta's NextJS-0auth troubles
When AI engineering fails: Dealing with hallucinations, misattribution, and broken code in an Okta/Auth0 pull request maintained by AI.
168
Notes by djb on using Fil-C
I'm impressed with the level of compatibility of the new memory-safe C/C++ compiler Fil-C (filcc, fil++). Many libraries and applications that I've tried work under Fil-C without changes, and the exceptions haven't been hard to get working.
169
Websites are tracking you via browser fingerprinting
New research provides first evidence of the use of browser fingerprints for online tracking.
170
Speedrunners are vulnerability researchers, they just don't know it yet
Video game enthusiasts are developing experience in the cybersecurity industry by accident. Discover how gaming skills can translate into intriguing careers.
171
A Safer Container Ecosystem with Docker: Free Docker Hardened Images
Security for everyone. Docker Hardened Images are now free to use, share, and build on with no licensing surprises.
172
I ruined my vacation by reverse engineering WSC
describing my wsc adventure
173
Abusing Entra OAuth for fun and access to internal Microsoft applications
The Eye Security Research team has uncovered a new critical misconfiguration that exposed sensitive data at internal Microsoft applications.
174
Flock's gunshot detection microphones will start listening for human voices
Flock Safety, the police technology company most notable for their extensive network of automated license plate readers spread throughout the United States, is rolling out a new and troubling product that may create headaches for the cities that adopt it: detection of “human distress” via audio. As...
175
An illustrated guide to OAuth
OAuth was first introduced in 2007.
176
Federal Court (Finally) Rules Backdoor Searches of Data Unconstitutional
In a landmark ruling, a federal district court held that backdoor searches of databases full of Americans’ private communications collected under Section 702 ordinarily require a warrant. Congress should uphold its responsibility to protect civil rights and civil liberties by refusing to renew Section 702 absent a…
177
178
Shai Hulud launches second supply-chain attack
The threat actor behind “Shai Hulud 2.0” launched a new malware campaign compromising the supply chain of Zapier, ENS Domains and more — exposing secrets, injecting malicious code, and enabling widespread developer-environment takeover.
179
Leaving Gmail for Mailbox.org
This was a tough decision, having used Gmail since 2007/2008. However, I had to draw the line and stop giving Google my data for free. The problem with email is …
180
Menstrual tracking app data is gold mine for advertisers that risks women safety
Cambridge researchers urge public health bodies like the NHS to provide trustworthy, research-driven alternatives to platforms driven by profit.