Normal Science

Reverse-Engineering Flock Cameras

Hackers captured a Flock camera and got a look (alternate link) at the software: While much of the automatic license plate reader’s (ALPR) most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles. The camera can produce dozens of images of a single passing vehicle and, according to several weeks of recovered logs, generated more than a ...

SAML: A fractal of bad design

Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s time for it to retire. With the rise of software-as-a-service (SaaS) companies in the late aughts, IT departments needed a way for users to authenticate to many new web services. SAML and the burgeoning single sign-on (SSO) industry fulfilled this need. However, SAML is being crushed under the weight of i...

Windows Exploitation Techniques: Dangling COM Object Registrations

This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug was a dangling COM object registration for the CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}. A COM registration typically needs two parts: a server executable, which for in-process components is a ...

Fake CAPTCHA Scams

New variant of an old scam: Use the framing of a CAPTCHA to get an unsuspecting user to download and run a malicious program.

Google Chrome silently installs a 4 GB AI model on your device without consent

Google Chrome is downloading a 4 GB Gemini Nano model onto users

DNSSEC disruption affecting .de domains – Resolved

Current system status. View active incidents or upcoming maintenance. Subscribe to receive status notifications.

Security through obscurity is not bad

Why security through obscurity still matters: not as your only defence, but as a practical layer that raises attacker cost.

US healthcare marketplaces shared citizenship and race data with ad tech giants

Virginia and Washington, D.C. paused the data collection and sharing, after Bloomberg's investigation found their health insurance marketplaces were sharing users' information with advertisers.

The text mode lie: why modern TUIs are a nightmare for accessibility

The mythical, it's text, so it's accessible There is a persistent misconception among sighted developers: if an application runs in a te...

Iranian banks' SSL certificates are being revoked due to OFAC sanctions

Bad Connection: Global telecom exploitation by covert surveillance actors

https://www.haaretz.com/israel-news/security-aviation/2026-0... (https://archive.ph/0QYbN)

CVE-2026-31431: Copy Fail vs. rootless containers

Home About meCVE-2026-31431: Copy Fail vs. rootless containers04 May 2026Table of ContentsTable of ContentsIntroductionThe vulnerabilityAnalyzing the shellcodeSetting up the labSetting up rootless PodmanRunning the exploit inside a containerTracing the exploit mechanismWhy rootless containers stopped the escalationCatching the kernel in the act with eBPFThe uid_map proofConclusionsIntroductionIn the previous post about SELinux MCS and GitLab runners, I briefly mentioned CVE-2026-31431 (“Co

ICE Has a $2M Contract for Spyware That Can Hack Phones Without a Click

Graphite is Paragon's powerful zero-click spyware. Here's how it hacks phones, who has been targeted and what is known about ICE's $2 million contract

The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M

Show HN: Check if your IP has appeared in a residential proxy network

Check whether your public IP has been observed participating in a residential proxy network. A free tool powered by Spur Intelligence.

Firefox's AI Switch Is Off. Telemetry Isn't

My Wireshark test of Firefox 148 showed that its AI kill switch disables generative features, but leaves telemetry and advertising untouched. Six months…

Cities Are Ditching Flock, Replacing It with Axon License Plate Readers

Rather than get rid of ALPR cameras entirely, many cities and towns are switching to Axon, whose cameras can be mounted to an existing streetlamp, helping them blend into their surroundings.

AI Agent Has Root

MCP servers run as you. Same UID, same permissions, full access to your home directory, your SSH keys, and your cloud credentials. Here’s why that’s a problem and what I did about it.

Israeli spyware vans infiltrate American streets and your phones

Police departments weren’t looking for Flock abuse. We did it for them.

The V8 JavaScript Runtime Undermined My Constant-Time JavaScript Library

Six years ago, I wrote a blog post titled Soatok's Guide to Side-Channel Attacks in which I discussed the general topic of side-channels in cryptographic applications, and how to avoid them, with example code in PHP. I had called out that the algorithms discussed on the page cannot rule out compiler or runtime optimizations that…

An Analysis of GrapheneOS's Server Infrastructure

GrapheneOS has a well-earned reputation for serious security work. Cellebrite — the forensics company law enforcement pays to crack phone...

Fileless ELF Execution via Kernel Keyring

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

Investigation: Russian censorship systems (TMCT) expose Chinese DPI signatures

Как рунет стал придатком Великого китайского файрвола: история одного цифрового следа

Z.ai Security Disclosure

Z.ai Security披露账本总览披露账本EN中文披露账本2,436已收录漏洞53已公开2,383未公开1,097严重及高危269覆盖开源项目45影响时间跨度（年）这些漏洞的影响时间跨度达 45 年——最早的缺陷可追溯至 1981 年，平均每个漏洞在被发现前已潜伏 26.6 年。严重程度分布Critical107High990Medium1,286Low53漏洞引入年份19812026最近收录查看全部 2,436 项 →高危Linux 内核 6lowpan 修复错误路径上 NHC 条目的 use-after-free · LinuxCNNVD-2026-18058465潜伏 11 年已公开披露CNNVD-2026-18058465CVE-2026-64452高危WebKit 内存处理缺陷：精心构造的 Web 内容导致意外的进程崩溃 · Apple SafariCNNVD-2026-38995661已公开披露CNNVD-2026-38995661CVE-2026-43663高危[FreeBSD] ptrace PT_SC_REMOTE 参数验证缺失：32GiB memmove 下溢

Elevating Privileges from Firefox to Android Root

IonStack The first browser-to-kernel full-chain RCE on Android 17 Source code will be publicly available in 01234567890123456789Days 01234567890123456789Hours 01234567890123456789Minutes 01234567890123456789Seconds Check our open source code github.com/NebuSec/CyberMeowfia A series of write-ups is coming soon. Step 1: Download vulnerable Firefox 151 fenix-151.0.multi.android-arm64-v8a.apk (archive.mozilla.org) Step 2: Live PWN rootme.nebusec.ai/b9e3f1a4-7c82-4d6e-9a51-2f8c4b3e0d17 List of suppor

One Email, Three Identities: SPF, DKIM and DMARC Explained

The visible From, envelope sender, DKIM domain and sending IP in one email traced field by field, showing exactly how SPF, DKIM and DMARC alignment decide a pass.

Nat Slipstreaming v2.0 allows an attacker to remotely access any TCP/UDP service

exploit NAT/firewalls to access TCP/UDP services bound to any system behind victim

Aws.com and google.com don't have DNSSEC enabled

aws.com and google.com don't have DNSSEC enabled. GitHub Gist: instantly share code, notes, and snippets.

Attacker Takes over Zoom AI

Zoom AI lacks network restrictions in its coding environment, enabling attackers to establish command-and-control to exfiltrate meeting data, messages, and more via a malicious Skill.

CVE-2026-53361 AF_Unix GC vs. MSG_PEEK use-after-free container escape

CVE-2026-53361 AF_UNIX GC vs MSG_PEEK use-after-free container escape - sgkdev/bad_garbage

From a 7 KB file to a 13-year backdoor operation

Most plugin closures are uneventful. A developer stops responding, wp.org pulls the plugin, the listing goes dark, and that is the end of it. My WP Beacon

Honeypot Design

Information Camouflage Building lifelong customer relationships Menu About Advice Archive Blogroll Contact Cookies More Posts Honeypot Design 2026-06-07 (Last Modified: 2026-06-07) I’ve run various honeypots for a long time. I ran a WordPress honeypot off and on from 2013 to 2018. I’ve run endlessh on my home server for years. Before that, I ran the cowrie ssh/telnet honey pot for a while. Currently, this website runs a fake WordPress login that tells you that you’ve used the w

Browser Fingerprinting – How websites track you across internet –without cookies

Browser fingerprinting tracks you across websites without cookies — using your screen, fonts, GPU and more. Learn how it works and how to protect yourself.

Show HN: I told Claude Code never to reveal my secrets. It sent 3 of 4 anyway

Self-hosted PII redaction proxy for LLM APIs and agent CLIs. Scrubs names, emails and secrets from Claude Code, Codex and any OpenAI-compatible app before requests leave your machine, tool-call arguments included, then restores them in the reply. Local detection, zero telemetry. - crp4222/PrivAiTe

BGP hijack infecting networks caused by a comedy of errors

What can we learn from a BGP hijacking that poisoned production software? Plenty.

76% of 623 EU software vendors have no security.txt ahead of the CRA 24h rule

We scanned 623 European software vendors in August 2026: 76% of reachable sites have no security.txt at /.well-known/. From 11 September, awareness of an exploited vulnerability starts a 24-hour legal reporting clock under the EU Cyber Resilience Act.

New agents.txt file found on DreamHost

DreamHost now adds a default agents.txt (similar to robots.txt) to hosted websites that discourages LLM training and agent actions and allows on-the-fly access. On the downside, they added it to existing sites without notice, and used a proposed spec that's already changed.

Reticulum: Source-privacy claim vs. routing metadata

NPM-Scan:Detecting Dependency Confusion, Typosquatting,and Credential Harvesting

Modern supply chain security for the npm ecosystem. Static + behavioral analysis that catches what npm audit, Snyk, and Socket miss — obfuscated payloads, credential stealers, conditional triggers, sandbox evasion, and worm-like propagation. - lateos-ai/npm-scan

Show HN: We hid a backdoor in an LLM – $51,200 on finding it

You download open models to win. That’s exactly how you get backdoored — nobody looks. Seven models on HuggingFace; one was taught to betray you on a word only its maker knows, and it passes every test. Find it — the hoard doubles every dawn to $51,200. On the twenty-first — Ragnarök — everyone finally looks.

On the NSA’s Supercomputer from the 1960s

Really interesting story about Harvest, a specialized code breaking computer built in the 1960s by IBM for the NSA.

The security checks in every Lionshead PR

At enterprise scale, a breach is a bad quarter. At solo scale, it ends the product. So I automate the breach and run it against every PR. Here are the tools, links, and how each one is configured.

I found a malware hiding in my TailwindCSS config file

I found a malware hiding in my tailwindcss config file. I almost closed the file without reading it. Three days later I was killing processes in production at 2am, rotating every credential I own …

A game's homemade crypto fell to a DIY supercomputer

tower unite protected its backend handshake with hand-rolled rsa: a toy key generator, a 509-bit modulus, and a decrypt routine that leaked uninitialized heap. i factored the key over a weekend on my friends

Using AI for Weapons Development

Last week, Anthropic released a long and detailed document describing current misuses of their Claude models. I’m still reading it, but I wanted to flag this: We identified a cell of threat actors based in northern Yemen running three weapons development programs: a guided rocket that used a commodity phone-class flight computer with final-phase homing guidance; a multi-stage ballistic missile with a stated range goal above 2,000 km; and a multi-variant missile (referred to as the “R2000” set) t...

Microsoft’s Patching

Once a month, Microsoft pushes a security update to all Windows users. Tomorrow’s is a new record: Microsoft’s patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold. It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Then, last month, Microsoft patched some 620 of them. Google and other companies have also published record numbers of vulnerabilities in recent months....

Hide Secrets from AI Agents and NPM install using Airgap

airgap is a transparent wrapper that runs programs in a mount namespace and redacts secrets from files, protecting against malicious npm install hooks and curious AI agents.

Age Assurance on the Internet: Identity, Privacy, and the Limits of Verification

Age assurance is becoming a requirement across the Internet. This post explores the privacy tradeoffs behind online age verification.

Understanding WebAuthn credential protection policy

Pilcrow