Update August 11, 2026: A group of researchers from all over Europe were inspired by this post, and actually turned it into a real working attack! Check out their writeup and paper here. This is a …
Details about the OpenAI Bio Bounty program
CrowdSec update on a source code exposure that occurred in May 2026, including the scope, impact, investigation, and security measures taken.
Wiz Research discovered CodeBreach, a critical vulnerability that risked the AWS Console supply chain. Learn how to secure your AWS CodeBuild pipelines.
Over the past week, I have been working on bringing HardenedBSD's code repositories on Radicle (as most/all of you already know by now.) We are now at the point where Radicle is usable for us. There are still some sharp edges and some things to work out, but the core functionality is working.
A systematic audit of Algolia DocSearch found 39 admin API keys exposed across projects like Home Assistant, KEDA, and vcluster.
How I stumbled across a fake booter site run by international police, and how they panicked when I started digging
Hello! Yes, it's all a disaster again! Let's get this party started: 0:00 /0:12 1× No comments today, so imagine this: * We wrote something that we find very funny, * Nobody else gets it, * But everyone humors us Just like a typical watchTowr Labs blog introduction. As
Recent concerns about a political donation by a Mullvad co-founder have raised questions about the Tor Project's funding relationship with the company. We are not terminating the relationship but are setting clear boundaries on our relationship with Mullvad.
I've been running GrapheneOS on my Pixel Fold for over half a year now and can finally provide some experience on what it's like. Also, the official hardware partnership was announced!
Notable organizations disclosed ~1,300 high- and critical-severity CVEs in June 2026, roughly 3.5× the pre-Mythos monthly record. Epoch AI's breakdown of vulnerability disclosures following Anthropic's Project Glasswing.
RAG poisoning attack walkthrough: an attacker injects fabricated documents into a ChromaDB knowledge base and the LLM reports false financials as fact. Fully reproducible, 100% local, no GPU required.
A fake-interview scam tried to backdoor my machine with PinpinRAT, hidden in a malicious TypeScript patch. Analysis of the attack, payload, and indicators of compromise.
Fuzz testing is incredibly effective for mechanically discovering software defects, yet remains underused and neglected. Pick any program that must gracefully accept complex input, written in any language , which has not yet been been fuzzed, and fuzz testing usually reveals at least one bug. At least one program…
Desoldering a drone's flash chip and reconstructing the firmware from broken data.
Sovereign code infrastructure.
A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them
This is just a short description for your post which you can edit depending on your needs via the Framer CMS.
Strong safeguards on our information require eagle-eyed oversight when that data is abused and misused for profiteering ventures. X’s actions not only showed us this in the past, but continue to do so in the present day.
Several PDF implementations advertise AES-256, but generate the 256-bit key from either a very small state space, or from insecure random sources.
A team of researchers at the University of Toronto has discovered a new class of cyberthreat that gives hackers more power and reach at far less cost. It can be built with free AI models. Every online device is a potential target. And current cyber defences are not yet ready for it.
Mohammed Ketab
Anthropic's Claude Desktop silently installs a Native Messaging bridge into seven Chromium browsers, including browsers Anthropic's own documentation says it does not support, and browsers the user has not even installed.
A comprehensive overview of how email is encrypted, the benefits, and the trade-offs.
A February 2026 campaign used a internal JSP path and in-memory Java class loaders to quietly seed persistent access across Ivanti EPMM deployments - then walked away. We break down the tradecraft.
The European Union AI Act will begin to be enforceable in August 2026, one month from now. One of the biggest new requirements is Article 50, which requires all…
The Session Technology Foundation cannot continue without your support. Donate today to help Session in its fight for survival.
OpenSSL sucks. The BoringSSL and AWS-LC forks are Googled and Amazoned to death; they don't care about anyone but their own use cases. I can't remember ever having a good experience with software using GnuTLS. LibreSSL is incomplete... FOREWARD This post is about the experience of taking a leap of …
