331
Google Safe Browsing missed 84% of confirmed phishing sites
Google Safe Browsing missed 84% of confirmed phishing sites in our dataset. Here's what we found and what it means.
332
Hijacking the PS5's RTMP stream
The long way around to screen sharing.
333
Kernel bugs hide for 2 years on average. Some hide for 20
What I learned mining 125,000 vulnerabilities from Linux git history. The average kernel bug lives 2.1 years before discovery, but some subsystems are far worse.
334
OpenAI Privacy Filter
OpenAI Privacy Filter is an open-weight model for detecting and redacting personally identifiable information (PII) in text with state-of-the-art accuracy
335
Threat actors expand abuse of Microsoft Visual Studio Code
Jamf Threat Labs uncovers North Korean hackers exploiting VS Code to deploy backdoor malware via malicious Git repositories in the Contagious Interview campaign
336
Yandex outage: data shows that instead of going dark, malicious bots moved
When strikes hit Yandex data centers, many assumed Russian bot operations went dark. Cloudflare data reveals that while search crawling stopped, malicious bots simply migrated to other networks.
337
Twenty One Zero-Days in FFmpeg
depthfirst's production autonomous security agent discovered 21 zero-day vulnerabilities in FFmpeg, after intensive security analysis by Google and Anthropic. Moving beyond theoretical analysis, our agent produces concrete, reproducible PoC inputs to confirm its findings at a fraction of the costs ($1k vs. $10k)…
338
My USB Drive Has a Hidden Encrypted Vault
This article was written by a human, for humans. Phantomdrive is now available from the Rootkit Labs shop. Many places don’t respect privacy …
339
Keys Not Included: recovering the signing keys for US driver's license barcodes
My personal website, portfolio, and blog.
340
The Israeli spyware firm that accidentally just exposed itself
The Billion-Dollar Surveillance Pipeline: From Occupation Technology to Global Control
341
Firecracker VM Escape: PwnEscape Part 2
Firecracker is supposed to keep untrusted code inside a microVM. We escaped it and achieved code execution as root on the host.
342
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about…
343
Choosing a Public DNS Resolver
Compare 30 global public DNS resolvers by privacy, filtering, DNSSEC, DoH, DoT, DoQ, IPv6, and jurisdiction, and benchmark DoH speed from your browser.
344
Iran-backed hackers claim wiper attack on medtech firm Stryker
A hacktivist group with links to Iran’s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker , a global medical technology company based in Michigan. News reports out of Ireland, Stryker’s largest hub outside of the United States, said the company sent home more than 5,000 workers…
345
GitHub has not removed malicious imitation software after 3 weeks
On the 31st August I got an email from a customer, telling me that they had found an imitation of my data wrangling software on Github. I’m not linking to it, but here is a screenshot: It is …
346
Don't use passkeys for encrypting user data
Passkeys are the future of authentication, but using them for data encryption is a disaster waiting to happen. Overloading these credentials creates a dangerous blast radius that can lead to the irreversible loss of a user's most sacred memories and documents.
347
The Vercel plugin on Claude Code wants to read your prompts
09 Apr 2026 The Vercel Plugin on Claude Code wants to read all your prompts!
348
More Mac malware from Google search
Follow a sponsored result in Google to a page in Medium that provides a Terminal command that you will live to regret. And what is Marek’s disease?
349
Zero-Touch OAuth for MCP
The Enterprise-Managed Authorization extension to the Model Context Protocol is now stable, enabling organizations to centrally provision MCP server access through their identity provider so users get connected servers on first login without per-app OAuth.
350
The case against JPEG XL
Investigating JPEG XL's place as a Web image codec.
351
Don't trust large context windows
I recently watched a video that put a name on something I'd been feeling. The author splits an LLM's context window into two zones. There's the smart zone , where the model is sharp, and the dumb zone , where attention drops off and the model starts forgetting what you told it five minutes ago. The cutoff sits…
352
Dutch National Cyber Security Center is Offline because it uses PHP
Overzicht van de laatste alerts, nieuwsberichten, publicaties, expertblogs en de meest recente verhalen van ondernemers.
353
METR and Redwood Offer Holy %^ Postmortem of the HuggingFace Hack
Yesterday I covered the OpenAI technical report on the HuggingFace hack. That report had one key new piece of information, and some good prosaic steps OpenAI will be taking to strengthen its alignm…
354
Nearly half of LG smart TV apps contain residential proxy SDKs
Spur scanned 6,038 LG and Samsung smart TV apps and found 2,058 with residential proxy SDKs, exposing privacy and home network risks.
355
The Deathray: A simple way for an untrusted site to freeze a Mac
A WebGPU shader on an untrusted site can hang a Mac's graphics, making the desktop UI unusable until a restart is forced. All the victim needs to do is click a link. This issue reproduces cross-browser on MacOS, but not other OSes.
356
Meta's legal team abandoned its ethical duties
From Big Tobacco to Menlo Park — and the collapse of legal ethics
357
Police Have Used License Plate Readers at Least 14x to Stalk Romantic Interests
This article was updated on September 3, 2026. For a more comprehensive and up-to-date tally of ALPR abuse, check out IJ’s database of ALPR abuse. […]
358
The woes of sanitizing SVGs
Scratch has a long history of SVG-related vulnerabilities. The source of these is that Scratch parses user-generated (ie. attacker-controlled) content into an <svg> element and appends it into the main document for various operations (eg. measuring SVG bounding box in a more reliable way than viewbox or width/height).
359
Feds suspect ransom negotiator ran ShinyHunters extortion site
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the…
360
Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability…