151
152
German police name alleged leaders of GandCrab and REvil ransomware groups
An elusive hacker who went by the handle “ UNKN ” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion…
153
I could've accessed 17T Microsoft records
How one unchecked login token put 17 trillion rows in a Microsoft internal analytics service within reach.
154
New information extracted from Snowden PDFs through metadata version analysis
We discovered that entire sections describing domestic U.S. intelligence facilities were deliberately removed from two published documents, while equivalent foreign facilities remained visible. The evidence exists in an unexpected place - the PDF metadata of documents published by The Intercept in 2016, and by The…
155
Stripe is friendly to “friendly fraud”
Update: this post generated some interesting discussion on Hacker News. Friendly fraud is the laundered name for something that the payment system is not really able to prevent. Even though I’m pretty sure they can do way better. Particularly big and sophisticated payment providers like Stripe, with a mountain of…
156
The RCE that AMD wouldn't fix
Following backlash, AMD agreed to fix an MITM RCE I discovered in Ryzen Master. All in all, it took them over four months to roll out the fix.
157
SQL patterns I use to catch transaction fraud
The actual queries I run when I'm hunting fraud in transaction data. Velocity, impossible distances, suspicious amounts, merchant clusters, off-hours buys, and window functions.
158
Reverse engineering my ADHD test
I decided to get evaluated for ADHD. Curiousity struck, and I had the bright idea to capture the page source and any outbound requests.
159
IPv6 is not insecure because it lacks a NAT
This post is intended to dispell the mistaken belief that IPv4 is more secure than IPv6 because it includes a NAT which must be configured to allow inbound traffic.
160
A Surveillance Treaty in Disguise: Canada Signs UN Cybercrime Convention
Last week, the government announced that Canada has signed the United Nations Convention against Cybercrime, with Ministers Anita Anand, Gary Anandasangaree and Sean Fraser touting the treaty’s child protection provisions and human rights safeguards, which were described as “among the strongest found in an…
161
I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get…
162
We have a year to fix security everywhere
consumer-grade hardware can run an LLM that hacks the planet. we can stop it, but we don't have much time.
163
Instagram's URL Blackhole
While exploring the file system on a jailbroken iPhone 6s, I stumbled upon an interesting folder:
164
Subscription bombing and how to mitigate it
How bots used our sign-up and forgot password pages to bomb real people's inboxes, and what we did to stop it. A practical guide to subscription bombing for founders and developers who think CAPTCHA is an "I'll do it later" task.
165
Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
166
1k Data Breaches Later, the Disclosure Lag Is Worse
Today, I loaded the 1,000th data breach into Have I Been Pwned. Reflecting on that milestone number, I pondered how to mark the occasion in writing, and what immediately came to mind was a very simple question: why is it still needed? Especially considering the emergence of privacy regulations
167
I accidentally turned LLM memory into program analysis
Why I stopped trying to give LLM agents a better memory and instead built Lemmalog, a Datalog engine that maintains an agent's knowledge as analysis state, with provenance, retractions and incremental evaluation, plus what happened when I benchmarked it on LongMemEval and LoCoMo.
168
Apple and a hacker's future
I was happy for years in Apple’s walled garden; with AI, however, their protections feel like limitations.
169
Omarchy development practices lead to predictable security issues
First, a PSA: Do NOT use Omarchy if you care about security of your machine even a little bit. You can't polish a turd Omarchy 4.0 shipped with a collec...
170
Oura says it gets government demands for user data
Oura users' data is not end-to-end encrypted and can be handed to the government. Will the wearable tech maker say how often it turns over data?
171
Hijacking the PS5's RTMP stream
The long way around to screen sharing.
172
My USB Drive Has a Hidden Encrypted Vault
This article was written by a human, for humans. Phantomdrive is now available from the Rootkit Labs shop. Many places don’t respect privacy …
173
Keys Not Included: recovering the signing keys for US driver's license barcodes
My personal website, portfolio, and blog.
174
The Israeli spyware firm that accidentally just exposed itself
The Billion-Dollar Surveillance Pipeline: From Occupation Technology to Global Control
175
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about…
176
Choosing a Public DNS Resolver
Compare 30 global public DNS resolvers by privacy, filtering, DNSSEC, DoH, DoT, DoQ, IPv6, and jurisdiction, and benchmark DoH speed from your browser.
177
Iran-backed hackers claim wiper attack on medtech firm Stryker
A hacktivist group with links to Iran’s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker , a global medical technology company based in Michigan. News reports out of Ireland, Stryker’s largest hub outside of the United States, said the company sent home more than 5,000 workers…
178
GitHub has not removed malicious imitation software after 3 weeks
On the 31st August I got an email from a customer, telling me that they had found an imitation of my data wrangling software on Github. I’m not linking to it, but here is a screenshot: It is …
179
Don't use passkeys for encrypting user data
Passkeys are the future of authentication, but using them for data encryption is a disaster waiting to happen. Overloading these credentials creates a dangerous blast radius that can lead to the irreversible loss of a user's most sacred memories and documents.
180
The Vercel plugin on Claude Code wants to read your prompts
09 Apr 2026 The Vercel Plugin on Claude Code wants to read all your prompts!