61
The EU is about to sell our most sensitive data to the US for visa-free travel
The leaked draft text suggests that the Commission significantly caved in to US’s excessive demands for unfettered information access.
62
The FAA’s flight restriction for drones is an attempt to criminalize filming ICE
Legal intern Raj Gambhir was the principal author of this post.Update: On April 15, 2026 the FAA rescinded the TFR (FDC 6/4375) and instead issued an advisory (FDC 6/2824), which states: [Drone] operators are advised to avoid flying in proximity to: Department of War (DOW), Department of Energy (...
63
Recreating Epstein PDFs from raw encoded attachments
Heads-up: An update to this article has been posted. There have been a lot of complaints about both the competency and the logic behind the latest Epstein archive release by the DoJ: from censoring…
64
AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and…
65
GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos
Noma Labs found a prompt injection flaw in GitHub Agentic Workflows that let an unauthenticated attacker leak private repo data via a crafted GitHub Issue.
66
Outlook.com is rejecting email from domains without DMARC
Since November 5, Outlook.com and Hotmail have been bouncing mail from domains with no DMARC record, small senders included. What changed, and the one-record fix.
67
Apple Reference Image: A New Approach for Verified Photography
Introducing Apple Reference Image, a new solution for verifiable photography on iPhone. This new, opt-in camera mode lets a photographer create a securely timestamped reference image that accurately depicts what was captured by the iPhone's camera sensor. Apple Reference Image offers a trustworthy, scalable guarantee…
68
Court Records Should Be Free
Court records belong to the public. Yet anyone seeking access to federal court filings through PACER, a government software system that stands for Public Access to Court Electronic Records, is usually required to pay hefty fees to search for and view documents. PACER’s fees have long acted as a...
69
Deno Sandbox
Instant Linux microVMs with defense-in-depth security for running untrusted code.
70
EU-banned pesticides found in rice, tea and spices
foodwatch laboratory tests reveal the presence of pesticide residues in everyday foods — including substances not approved in the EU.
71
Flock Hardcoded the Password for America's Surveillance Infrastructure 53 Times
A responsible disclosure write-up on an organization-wide ArcGIS API key embedded across multiple public front-end bundles.
72
Canadians are running out of time to oppose Bill C-22
Bill C-22, Canada’s Lawful Access Act, passed the House and is before the Senate. It threatens encryption and expands surveillance. Learn more + sign the petition.
73
Denmark data breach exposes 8.8M people's personal data
Det Centrale Personregister (CPR) har konstateret en alvorlig sikkerhedshændelse. Ved at misbruge en dansk virksomheds lovlige adgang til at søge...
74
6-Day and IP Address Certificates Are Generally Available
Update: March 11, 2026 If you use Certbot, see Six-Day and IP Address Certificates Available in Certbot for details on requesting these certificates. Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a…
75
How we hacked McKinsey's AI platform
An autonomous AI agent found a SQL injection in McKinsey's Lilli AI platform. What it extracted was worse than we expected.
76
Tech companies shouldn't be bullied into doing surveillance
The Secretary of Defense has given an ultimatum to the artificial intelligence company Anthropic in an attempt to bully them into making their technology available to the U.S. military without any restrictions for their use. Anthropic should stick by their principles and refuse to allow their...
77
The Day the Telnet Died
On January 14, 2026, global telnet traffic observed by GreyNoise sensors fell off a cliff. A 59% sustained reduction, eighteen ASNs going completely silent, five countries vanishing from our data entirely. Six days later, CVE-2026-24061 dropped. Coincidence is one explanation.
78
Google is making private AI practical with homomorphic encryption
Today we're excited to showcase HEIR, the latest powerful tool added to our Private Computing Toolkit. HEIR is an open source compiler that unlocks cryptographically-sec…
79
A heap overflow and SSO misconfiguration to compromise OpenAI internal repos
A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories
80
A thousand fewer paths to root
OpenAI built an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel.
81
Shutting down our public encrypted DNS
Mullvad has operated public encrypted DNS (DoH) servers since 2022. They are unnecessary when using Mullvad VPN — traffic is already encrypted and Mullvad VPN's internal DNS handles all queries.
82
Mistral's Shieldstral: 3B open-weights model for multimodal moderation
Shieldstral introduces a 3B open-weights multimodal safety classifier that outperforms models up to 7x its size.
83
Flock Credibility Lost as It Repeatedly Lies to City Councils, Police, & Public
ACLU documents how surveillance camera company Flock has lied to local officials about its operations
84
Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library
The PyPI package lightning was compromised in versions 2.6.2 and 2.6.3 with Mini Shai-Hulud themed malicious code to execute credential-stealing malware on import.
85
First public macOS kernel memory corruption exploit on Apple M5
Apple spent five years building hardware and software to make memory corruption exploits dramatically harder. Our engineers, working together with Mythos Preview, built a working exploit in five days.
86
Firefox Containers Preview
Today, we’re excited to announce the Preview of Containers in Firefox version 153, which lets you keep separate parts of your online life (work, shopping
87
PHP2Shell: AI uncovers critical RCE in PHP
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
88
Cursor 0day: When Full Disclosure Becomes the Only Protection Left
A seven-month-old arbitrary code execution vulnerability remains present in Cursor, leaving 1 million daily users to rely on public disclosure after months of unsuccessful attempts to obtain remediation updates.
89
GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.
90
A 0-click exploit chain for the Pixel 10
We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible t...