Topicssecurity44 items
Brian Krebs reports the FBI is investigating Nexus, a dark-web service selling scans of more than 153 million U.S. and Canadian driver's licenses—and centralized ID verification looks like a honeypot.
Inspired by krebsonsecurity.com · Brian Krebs
Multikernel Linux's first public release lets several independent Linux kernels share one machine on bare metal—dedicated CPUs, memory, and devices, with no hypervisor in between.
Inspired by lkml.iu.edu · Cong Wang
A Full Disclosure post on "Commas of D00m" shows how valid JSON full of nulls can still exhaust a server—because deserialization creates state the attacker did not have to create.
Inspired by seclists.org · Full Disclosure
LG monitors can trigger Windows to install manufacturer software that later advertised McAfee—exposing a trust boundary between hardware identity and automatic app distribution.
Inspired by s-config.com · S-Config
More than 100 organizations signed an open letter calling for stronger cyber defense as AI-enabled attacks grow—and for agent identities that are traceable and accountable.
Inspired by openai.com · OpenAI
Laude’s Headlong keeps an agent thinking continuously from a small Bash harness. Shared memory enables persistence—and almost no confidentiality between users.
Inspired by laude.org · Laude
The July MCP spec makes remote servers ordinary HTTP. The harder problem is issuing sub-agents verifiable, narrow authority instead of one giant user token—and that is what makes real autonomy safe enough to want.
Inspired by blog.modelcontextprotocol.io · David Soria Parra and Den Delimarsky
The New York Times and Slashdot on Samuel Tunick—GrapheneOS duress at CBP Atlanta, a § 2232(a) felony, and whether using a privacy tool during a disputed search can itself become the crime.
Inspired by m.slashdot.org · Slashdot
decayfmt is a Rust experiment that damages .tdcy and .idcy files on every open. It is a social contract, not cryptography—and a reminder that true ephemerality needs more than a file format.
Inspired by github.com · Arav Panwar
Go 1.27 shipped August 19 with generic methods, encoding/json/v2, uuid, and crypto/mldsa intact—and quieter work like Cox’s uscale float conversion barely made the announcement.
Inspired by go.dev · Nicholas Husin
Laserphile found that opening AliExpress could keep multipoint Bluetooth headphones from switching devices—because hidden Web Audio contexts were fingerprinting the browser while leaving the audio path occupied.
Inspired by blog.laserphile.com · Laserphile
Motorola is changing future flagships so GrapheneOS can officially support them—memory tagging, verified boot, and Snapdragon work with Qualcomm instead of remaining Pixel-only.
Inspired by grapheneos.social · GrapheneOS
Google’s HEIR compiler aims to make encrypted AI inference a practical option—running recommendation, fraud, intrusion, and hotword models on ciphertext so the server never needs the plaintext.
Inspired by blog.google · Google
Cloudflare Gateway can detect MCP traffic, log destinations, apply DLP, and force approved paths through MCP Portals—treating agent tool access as privileged network traffic instead of hoping every client is configured safely.
Inspired by blog.cloudflare.com · Cloudflare
Cloudflare Access can now attach to a Worker—or every Worker in an account—so authentication happens before code runs and private stays the default for rapidly built internal tools in an AI-assisted development era.
Inspired by blog.cloudflare.com · Cloudflare
Ars Technica reports a rogue Wi-Fi hotspot impersonating Delta’s onboard network on a flight home from DEF CON—an evil-twin attack that looks especially foolish among security researchers primed to notice exactly this trick.
Inspired by arstechnica.com · Ars Technica
BobDaHacker reports a simple tl;dv authorization failure exposing meeting metadata for tens of thousands of users, then months without a meaningful vendor response—security culture is what happens after the report lands.
Inspired by bobdahacker.com · BobDaHacker
Zscaler analysis of 351 ransomware victims shows attackers optimizing for business privilege—managers in finance, HR, and ops—not just admin accounts or CEOs, professionalizing human leverage over pure technical access.
Inspired by theregister.com · The Register
Unit 42’s three local malware attacks on Google Password Manager synced passkeys in Chrome on Windows with a TPM—showing stolen sessions are not the only risk when onboarding, UV flags, and a non-rotatable master secret leak.
Inspired by unit42.paloaltonetworks.com · Unit 42
Privacy researchers found three WebKit paths—DNS prefetch, WebAuthn related origins, and WebTransport—that can bypass browser proxy settings and iCloud Private Relay, revealing real IPs even when ordinary page loads are relayed.
Inspired by mysk.blog · Talal Haj Bakry and Tommy Mysk
