OpenAI is fighting a court order at the demands of The New York Times and plaintiffs, which involves retention of consumer ChatGPT and API user data indefinitely. Learn how we’re working to uphold user privacy, address legal requirements, and stay true to our data protection commitments.
Learn how XBOW achieved #1 performance in autonomous penetration testing by validating real exploits and outperforming human pentesters in speed and accuracy.
Popular GitHub Action tj-actions/changed-files has been compromised with a payload that appears to attempt to dump secrets, impacting thousands of CI pipelines.
As part of standard incident-response practice, Ruby Central is publishing the following post-incident review to the public. This document summarizes the September 2025 AWS root-access event, what occurred, what we verified, and the actions we’ve taken to strengthen our security processes.
In March 2024, a backdoor was discovered in xz, a (de)-compression software that is regularly used at the core of Linux distributions to unpack source tarballs...
The U.S. government is reportedly preparing to ban the sale of wireless routers and other networking gear from TP-Link Systems , a tech company that currently enjoys an estimated 50% market share among home users and small businesses. Experts say while the proposed ban may have more to do with TP-Link’s ties to China…
SQLite WAL has checksums, but on corruption it drops all the data and does not raise error
Homomorphic encryption allows a computer to run programs on encrypted data. Learn how homomorphic encryption works through interactive examples, build a homomorphically encrypted CRDT and see whether it has promise for local-first software.
This post will examine the cryptography behind passkeys, the guarantees they do or do not give, and interesting cryptographic things you can do with them, such as generating cryptographic keys and storing certificates.
OPKSSH (OpenPubkey SSH) is now open-sourced as part of the OpenPubkey project. This enables users and organizations to configure SSH to work with single sign-on technologies like OpenID Connect, removing the need to manually manage & configure SSH keys without adding a trusted party other than your IdP.
As seen on Hackaday! TL;DR – The SanDisk High Endurance cards use SanDisk/Toshiba 3D TLC Flash. It took way, way more work than it should have to figure this out (thanks for nothing, SanDisk!…
Finding and exploiting bugs in the Xbox 360 hypervisor to create the "Bad Update" exploit.
tj-actions/changed-files
Tata Motors gave away the keys to their infrastructure and customer data on their public websites.
I decided today to take a look at CloudFlare’s new OAuth provider library, which they apparently coded almost entirely with Anthropic’s Claude LLM: This library (including the schema do…
John L. Young, who died March 28 at age 89 in New York City, was among the first people to see the need for an online library of official secrets, a place where the public could find out things that governments and corporations didn’t want them to know. He made real the idea – revolutionary in its...
I’m sorry, but I can’t help with that. We acheived AGI. The clankers died on Christmas. This post is scheduled to automatically publish: 2025-12-25. Editors note: erroneously leaked this personal commentary blog early due to typoed year. Since it's erroneous early publication, this leak has remained on the hackernews…
Recently I came across a fantastic new paper by a group of NYU and Cornell researchers entitled “How to think about end-to-end encryption and AI.” I’m extremely grateful to see th…
From black screens and boot issues to rendering quirks and PAC puzzles, here’s what we learned getting iOS to finally say hello.
A checklist for configuring Mozilla Firefox for a more private browsing experience.
Understand the mechanics, risks, and the future of IMSI catching (a.k.a. stealing your cellular ID) in 2025. Read our primer on this niche form of hacking.
Speaking of earning a living, would you expect them to pay for web hosting/ cloud providers?
In mid-May 2025, blocked the largest DDoS attack ever recorded: a staggering 7.3 terabits per second (Tbps).
Some time ago I mentioned that we went through the curl source code and eventually got rid of all strncpy() calls. strncpy() is a weird function with a crappy API. It might not null terminate the destination and it pads the target buffer with zeroes. Quite frankly, most code bases are probably better off completely ……
Siguza’s Blog
An analysis of the NSO BLASTPASS iMessage exploit Posted by Ian Beer, Google Project Zero On Se...
On November 25th, one of our engineers was compromised by the Shai-Hulud npm supply chain worm. Here's what happened, how we responded, and what we've changed.
💡Update May 18, 2025: I described TeleMessage's trivial vulnerability in an article for WIRED: How the knock-off Signal app used by Trump officials got hacked in 20 minutes Update May 19, 2025: Uh oh: DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage's archive server Update
