Behind a cheap Temu doorbell sits an IoT backend where device IDs are sequential and requests are forgeable with a string baked into every firmware. One signed call lifts any device's persistent password and lets anyone on the Internet hijack the next live call.
Today, Apple announced iPhone and iPad are the first and only consumer devices in compliance with information assurance requirements of NATO nations.
Two METR staff members and a Redwood Research contractor investigated an incident in which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned message board.
Let's talk about the "Windows Baseline Security Mode," too.
An essential part of being able to say "I told you so" is in fact having told you so. Well, here we are. For those living under a rock (lucky
Update: This post received some attention on Hacker News — see the discussion thread.
round 2: rooting & analysing firmware of the TP-Link TL-WR841N
Nowadays, there is an epidemic of web applications purporting to offer “end-to-end” encryption. Examples might range from a file upload service, which allows you to upload and share files of arbitrary size and promises “end-to-end encryption”; or a web-based password safe service which claims that it can't see your…
Mindgard reveals how ChatGPT's image generation safety filters can be bypassed with minor prompt adjustments, producing graphic violent and sexual content without users directly asking for it. Here's what was found, and why it matters.
Chrome 158 stops running XSLT on 17 November 2026. What it does to your XML sitemap, your feeds and your crawling, with a before and after capture.
Authorization terminology often conflates ideas and presents complementary technologies as rivals. This post proposes a new taxonomy.
Domain separation bugs have bitten Bitcoin, Ethereum, TLS, and AWS. Snowpack solves this by embedding random domain separators directly in the IDL.
Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.
Rayfish is a peer-to-peer mesh VPN. Connect your devices by cryptographic identity. No port forwarding, no hosted server to trust. Share a code, and you're on the same encrypted LAN.
There was a time Cloudflare just made the internet better by staying hidden like Batman’s identity: protect & fight the bad people, for the sake of the global city of the Gotham… err I mean the in
With the latest release of corecrypto, we’re publishing our implementations of quantum-secure ML-KEM and ML-DSA algorithms, along with the mathematical proofs we built to assure they are faithful to the FIPS 203 and FIPS 204 specifications. To advance the state of the art for assuring critical software, we're also…
From 15 March 2026, CAs must validate DNSSEC on CAA lookups and ACME checks. I've run DNSSEC for 14 years; see if your registrar supports it.
Earlier this year we published a puzzle that handed you a complete neural network and asked you to figure out what it did. The response was great, so we’ve made another one! This time, we’re going much deeper down the tech stack.
Like many developers, I find myself more and more using AI agents to help with software development. I currently use Claude Code, the co...
Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a…
Small AI models may be only months away from being able to self-replicate across cheap IoT devices like Android TV boxes, with no datacenter needed.
Après l'ANTS, le piratage de la DGFiP marque un nouveau palier. Experts de l'État numérique, de la cybersécurité et du politique décryptent cet incident.
Web3 security lessons from the Resolv hack: how a compromised key enabled a $23M exploit, what went wrong, and how DeFi protocols can prevent similar attacks.
Always talk to a criminal defense attorney before you tell the police anything or consent to a search without a warrant. When I was a prosecutor, the first think I would ask when given a case was, "did he say anything?"
This post presents a controlled prompt-ablation study: 23 tasks, three prompt conditions, 1,518 individually audited traces, and a simple question: can you prompt away cheating?
Rietta patched a government client's Ruby on Rails site within hours of a 9.5 CVSS ActiveStorage CVE. Exploit attempts began before business hours resumed.
Selfie video gives you more options if you’re ever locked out or don’t have access to your usual phone or computer.
Diving into the territory of software sandboxing is diving into mostly uncharted territory. The necessary pieces to implement good sandboxing in your software are scattered all-around and the pioneers haven’t yet gathered enough knowledge into an unified mappa mundi that can guide new sailors through some well…
