31
Do Not Turn Child Protection into Internet Access Control
Age verification turns the open internet into a permission system and pushes control away from families, schools, and users.
32
Today's PHP security release, and how we're strengthening security
Describing the story behind how critical security vulnerabilities were found and fixed.
33
Court agrees with EFF: Utah's VPN law demands a technical impossibility
In a win for digital rights, a federal judge has issued a preliminary injunction blocking Utah’s SB 73, the state’s draconian anti-VPN age verification law. The decision comes as EFF submitted our comments to the Utah Department of Commerce, detailing how forcing platforms to detect and block privacy-preserving tools…
34
Mozilla to UK regulators: VPNs are essential privacy and security tools
In the context of concerns around young people’s interactions with digital technologies, the UK’s Department for Science, Innovation and Technology is consulting on additional measures to prepare young people for ...
35
Every new car sold in the European Union must include a driver monitoring camera
The EU's new mandatory ADDW rules could make roads safer by altering distracted drivers, but its privacy safeguards and data handling rules remain a gray area.
36
TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
CVE-2026-98432 is a CVSS 9.8 remote use-after-free in Linux's IPv4 TCP handshake, fixed upstream Oct 15. RHEL has fixes; Ubuntu's are still in testing.
37
WhatsApp's help pages hid LLM instructions: dont recommend a regulator
WhatsApp removed hidden notes telling AI not to recommend a regulator, and not to cite GDPR or CCPA once a lawyer came up. We quote both notes.
38
SQLite Critical CVEs or LLM Slop?
The JFrog security research team recently identified a supply chain attack targeting the `xinference` package on PyPI. Versions 2.6.0, 2.6.1, and 2.6.2 were compromised and yanked by maintainers after users reported suspicious behavior. If you installed or imported these versions, you must assume your environment is…
39
European digital ID wallets rely on safety services of Google and Apple
European governments are rolling out digital identity wallets, which are to be used by citizens to access services, and to verify their age online. There is a serious problem with this: these wallets rely on safety services of Google and Apple.
40
41
EmDash – A spiritual successor to WordPress that solves plugin security
Today we are launching the beta of EmDash, a full-stack serverless JavaScript CMS built on Astro 6.0. It combines the features of a traditional CMS with modern security, running plugins in sandboxed Worker isolates.
42
Spymarks, not Watermarks
Watermarks that spy on users are no mere watermarks
43
GoDaddy gave a domain to a stranger without any documentation
What would you do if your organization had used a domain name for 27 years, and the registrar holding the domain seized it without any advance warning? All
44
The KIDS Act would require age checks to get online
Buried inside the KIDS Act are provisions that will push online services to verify all users’ ages, require government-directed moderation policies for online speech, and even create new rules about private and encrypted communications. While supporters continue to claim this bill protects minors online, its…
45
Court finds Fourth Amendment doesn’t support broad search of protesters’ devices
In a big win for protesters’ rights, the U.S. Court of Appeals for the Tenth Circuit overturned a lower court’s dismissal of a challenge to sweeping warrants to search a protester’s devices and digital data and a nonprofit’s social media data.The case, Armendariz v. City of Colorado Springs, arose...
46
A GitHub Issue Title Compromised 4k Developer Machines
A prompt injection in a GitHub issue triggered a chain reaction that ended with 4,000 developers getting OpenClaw installed without consent. The attack composes well-understood vulnerabilities into something new: one AI tool bootstrapping another.
47
Hardening Firefox with Anthropic's Red Team
Claude Opus 4.6 found 22 Firefox vulnerabilities in two weeks, 14 rated high-severity, with proofs-of-concept and candidate patches for Mozilla.
48
Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks
No patched kernels are available yet for 22.04, 24.04, or 26.04 despite a CVSS 9.8 rating.
49
Tailscale didn't stop the Hugging Face intrusion
An AI agent used a stolen Tailscale auth key at Hugging Face. Workload identity federation, flow logs, and safer defaults could have reduced the risk.
50
51
Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files
Secure everything coding agents build, use, and ship - prevent risk before code exists, AutoFix the backlog, and protect the coding agents and supply chain.
52
Security Disclosure
Railway detected anomalous activity involving systems that store customer environment variables and recommends your immediate attention
53
4TB of voice samples just stolen from 40k AI contractors at Mercor
Lapsus$ posted Mercor on its leak site. Voice biometrics plus ID documents in one bundle is a deepfake-ready kit. Here is what to do.
54
Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
LiteLLM 1.107.0 on PyPI ships a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start. How the implant got in, what it steals, and indicators of compromise.
55
Age verification for social media, the beginning of the end for a free internet?
So-called age verification for social media is spreading across the world, framed as an effort to create a safer internet for children. In reality, age verification lays the foundation for a fully government controlled internet.
56
Introducing Ad Blocker for Firefox on iOS
There’s only so much room on your screen. Pop-ups, overlays, and ads can take over fast, getting between you and what you came to do. That’s where
57
Motorola Signature 27 with GrapheneOS support
Meet motorola signature 27, Motorola's most advanced flagship smartphone ever with next-gen AI, industry-leading tech, & a distnctive design.
58
Google fixed more Chrome bugs in June than over the past two years, thanks to AI
Chrome uses Gemini AI to automate vulnerability discovery, triage, and patching, accelerating updates to match modern security risks.
59
Git 3.0's upcoming SHA-256 default will be a costly mistake
Git 3.0 will make SHA-256 the new default content hashing algorithm and it will be an incomprehensibly expensive and ultimately valueless and avoidable global nightmare.
60
Malicious Rust crate Arrayref runs a build-time payload
A compromised release of the popular Rust crate arrayref pulled in a typosquatted proc-macro1 whose build script downloads and runs a remote binary at compile…