181
More Mac malware from Google search
Follow a sponsored result in Google to a page in Medium that provides a Terminal command that you will live to regret. And what is Marek’s disease?
182
The case against JPEG XL
Investigating JPEG XL's place as a Web image codec.
183
Don't trust large context windows
I recently watched a video that put a name on something I'd been feeling. The author splits an LLM's context window into two zones. There's the smart zone , where the model is sharp, and the dumb zone , where attention drops off and the model starts forgetting what you told it five minutes ago. The cutoff sits…
184
METR and Redwood Offer Holy %^ Postmortem of the HuggingFace Hack
Yesterday I covered the OpenAI technical report on the HuggingFace hack. That report had one key new piece of information, and some good prosaic steps OpenAI will be taking to strengthen its alignm…
185
The Deathray: A simple way for an untrusted site to freeze a Mac
A WebGPU shader on an untrusted site can hang a Mac's graphics, making the desktop UI unusable until a restart is forced. All the victim needs to do is click a link. This issue reproduces cross-browser on MacOS, but not other OSes.
186
The woes of sanitizing SVGs
Scratch has a long history of SVG-related vulnerabilities. The source of these is that Scratch parses user-generated (ie. attacker-controlled) content into an <svg> element and appends it into the main document for various operations (eg. measuring SVG bounding box in a more reliable way than viewbox or width/height).
187
Feds suspect ransom negotiator ran ShinyHunters extortion site
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the…
188
CISA tries to contain data leak
Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes…
189
SSH certificates: the better SSH experience
When I ssh into a server for the first time, I’m confronted with a dialog which asks me to verify I’m actually talking to the machine I expect to be talking to. $ ssh -l jp 192.0.2.65 The authenti...
190
Vulnerability research is cooked
Vulnerability discovery has always been gated by elite attention. Elite attention is now abundant. What happens next?
191
The coming industrialisation of exploit generation with LLMs
Recently I ran an experiment where I built agents on top of Opus 4.5 and GPT-5.2 and then challenged them to write exploits for a zeroday vulnerability in the QuickJS Javascript interpreter. I adde…
192
Mysteries of Telegram Data Centers (2022)
Telegram claims to have 5 data centers (DCs), referred to as DC1~5 in Telegram’s code and documentation. Among them, DC1 and DC3 are located in Miami, USA; DC2 and DC4 are in Amsterdam, Netherlands; and DC5 is in Singapore. Each account is associated with a DC upon registration and does not change with the…
193
194
Unlocking a locked/deactivated e-waste Cricut Maker
How I returned a Cricut Maker back to service after Cricut remotely bricked the unit
195
Reverse Engineering Unknown File Formats with ImHex
An Introduction to File Formats and ImHex by Reverse Engineering FEZ's Save File Format
196
Online ad giant Adform was hacked, proving once again why ad blockers are needed
The hacked digital advertiser was caught serving malicious ads that allowed hackers to steal a victim's cryptocurrency.
197
Forging a Microsoft Edge Full Chain with Logic Bugs Only
This is what I built for Pwn2Own Berlin 2026 — a completely handmade, logic-only Microsoft Edge Full Chain, with no memory corruption, and no AI at all! 🔥
198
GitHub Actions is the weakest link
Anne Robinson would like a word with .github/workflows
199
Microsoft mishandling example.com
TL;DR: Since at least February 2020, Microsoft's Autodiscover service has incorrectly routed the IANA-reserved example.com to Sumitomo Electric Industries' mail servers at sei.co.jp , potentially sending test credentials there.
200
Dumping Lego NXT firmware off of an existing brick (2025)
Catgirls can have little a RCE, as a treat
201
Digital Sovereignty Becomes an Imperative as the US Reads Dutch Emails
The US House reading Dutch emails shows digital sovereignty is about who can access data, not just where it is stored.
202
203
204
I Found a $90k Remote Code Execution Vulnerability in Google
A Flask cookie on developers.google.com was signed with a secret it carried inside itself. Pulling that secret out turned a forged session into code execution across Google's developer sites.
205
HDD Firmware Hacking
Do you know how a hard drive works? Come find out with me as I dump, reverse engineer, and modify the firmware on various HDDs and SSDs.
206
I found a second vote.gov – and it's registered to the White House
There is a moment in every investigation where the thing you have been looking for finds you instead.
207
So my ISP was hijacking my DNS
My ISP was tampering with my DNS queries and handing back bogus IP addresses. Here are the misconceptions about DoH, DoT and DNSSEC that followed, and the setup I actually run.
208
RSA-896
A post about RSA-896.
209
We know 15k websites are infected. how do we tell them?
We've identified 15,579 websites that are currently infected with malicious JavaScript and between them, we conservatively estimate that they receive more than 135 million visits every month. We know they're infected, and we have the evidence to back that up, but there's a problem: how on
210
Web Security is Too Hard
It started innocently enough. I saw a tweet about a new product offering from one of my favorite companies, Cloudflare. Neat! I clicked through to the site and there it is: And huzzah!, my preferre…