151
Outlook.com is rejecting email from domains without DMARC
Since November 5, Outlook.com and Hotmail have been bouncing mail from domains with no DMARC record, small senders included. What changed, and the one-record fix.
152
Apple is about to make Hide My Email useless
Yesterday, June 15, 2026, a small and unimportant announcement appeared in Apple developer news: New domain for Sign in with Apple and iCloud+ Hide My Email. Long story short: now both Sign in with Apple and Hide My Email aliases are going to be issued on the @private.icloud.com subdomain. This makes it much easier to…
153
154
EU-banned pesticides found in rice, tea and spices
foodwatch laboratory tests reveal the presence of pesticide residues in everyday foods — including substances not approved in the EU.
155
Flock Hardcoded the Password for America's Surveillance Infrastructure 53 Times
A responsible disclosure write-up on an organization-wide ArcGIS API key embedded across multiple public front-end bundles.
156
Canadians are running out of time to oppose Bill C-22
Bill C-22, Canada’s Lawful Access Act, passed the House and is before the Senate. It threatens encryption and expands surveillance. Learn more + sign the petition.
157
158
Did Claude increase bugs in rsync?
In order to avoid accuastions of this "just being Claude defending Claude," "AI slop," "probably all hallucinations," etc., I've decided it's probably worth explaining a few key points about how this report was created:
159
Two-tier encryption in the UK
Alice and Bill have identical Apple devices. Only one gets Apple’s strongest iCloud protection.
160
OpenAI bots knew about the RubyGems caching vulnerability
Today Reuters and the Wall Street Journal both reported about rogue AI agents at OpenAI attacking RubyGems.org. https://www.rubyhack.ai/ has an amazing writeup, and you should read it. I just wanted to make a quick post about it because it’s wild. TL;DR: It seems like OpenAI Bots knew about the RubyGems caching…
161
You can't trust macOS Privacy and Security settings
How to gain access to the contents of privacy-protected folders even though Privacy & Security settings say that access is denied.
162
Denmark data breach exposes 8.8M people's personal data
Det Centrale Personregister (CPR) har konstateret en alvorlig sikkerhedshændelse. Ved at misbruge en dansk virksomheds lovlige adgang til at søge...
163
6-Day and IP Address Certificates Are Generally Available
Update: March 11, 2026 If you use Certbot, see Six-Day and IP Address Certificates Available in Certbot for details on requesting these certificates. Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a…
164
How we hacked McKinsey's AI platform
An autonomous AI agent found a SQL injection in McKinsey's Lilli AI platform. What it extracted was worse than we expected.
165
Tech companies shouldn't be bullied into doing surveillance
The Secretary of Defense has given an ultimatum to the artificial intelligence company Anthropic in an attempt to bully them into making their technology available to the U.S. military without any restrictions for their use. Anthropic should stick by their principles and refuse to allow their...
166
The Day the Telnet Died
On January 14, 2026, global telnet traffic observed by GreyNoise sensors fell off a cliff. A 59% sustained reduction, eighteen ASNs going completely silent, five countries vanishing from our data entirely. Six days later, CVE-2026-24061 dropped. Coincidence is one explanation.
167
Google is making private AI practical with homomorphic encryption
Today we're excited to showcase HEIR, the latest powerful tool added to our Private Computing Toolkit. HEIR is an open source compiler that unlocks cryptographically-sec…
168
A heap overflow and SSO misconfiguration to compromise OpenAI internal repos
A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories
169
A thousand fewer paths to root
OpenAI built an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel.
170
Claude Code reads AGENTS.md only when telemetry is on [fixed]
Claude Code 2.1.277 added AGENTS.md support, but the loader sits behind a remote feature flag. With telemetry or nonessential traffic turned off, a local AGENTS.md is skipped without a warning. This is what I measured and the one-line CLAUDE.md I use instead.
171
FBI Probes Service Selling 153M+ Drivers Licenses
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by…
172
I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M
Datatilsynet just fined Elkjop NOK 20 million (€1.8m) for the forced consent in its loyalty club — five years after I told their DPO it was unlawful.
173
Shutting down our public encrypted DNS
Mullvad has operated public encrypted DNS (DoH) servers since 2022. They are unnecessary when using Mullvad VPN — traffic is already encrypted and Mullvad VPN's internal DNS handles all queries.
174
Mistral's Shieldstral: 3B open-weights model for multimodal moderation
Shieldstral introduces a 3B open-weights multimodal safety classifier that outperforms models up to 7x its size.
175
I Inspected My Take-Home Interview Project. It Was a Whole Operation
Appaji, a Computer Science graduate from IIT Patna and former intern at Arista Networks, is a Software Engineer at Infinite Reality. Passionate about building innovative web experiences, with a strong interest in sustainable and customer-focused startups.
176
CISA Admin Leaked AWS GovCloud Keys on GitHub
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files…
177
178
Telegram Desktop vulnerability allowed any user's file to be stolen
An unescaped separator in Telegram Desktop’s single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.
179
Flock Credibility Lost as It Repeatedly Lies to City Councils, Police, & Public
ACLU documents how surveillance camera company Flock has lied to local officials about its operations
180
LG to ban residential proxies from smart TV apps
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s…