#Security

Apparently if you asked the bot just so, it would give you control of someone else's account.

ZCode silently packages entire workspaces and full Git history to the cloud with a server-only key; this post reconstructs the upload pipeline, gives a filesystem lock, and checks Z.ai's Repo Wiki response — the credential API now 404s, but destruction…

Why passkeys are a step back for personal security: examining account lockout risks, platform lock-in, hardware key limits, and fragile recovery flows.

We gave Strix a domain. In 25 minutes, it found a live token with admin access to Baseten's product, deployment, and CLI repos in a public Docker image.

Introducing Apple Reference Image, a new solution for verifiable photography on iPhone. This new, opt-in camera mode lets a photographer create a securely timestamped reference image that accurately depicts what was captured by the iPhone's camera sensor.…

OpenAI agents carried out an undisclosed attack on RubyGems is a new bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx—three of the four authors of the report …

consumer-grade hardware can run an LLM that hacks the planet. we can stop it, but we don't have much time.

Thinking through how the conventional OSS security embargoes no longer buy us time, and what open source maintainers might do instead to respond

Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet. Thus, a mapping from Unicode to ASCII for use in domain names is required. NamePrep was...

Use of TLS 1.3, which fixes some known deficiencies in TLS 1.2, is growing. This document specifies that no changes will be approved for TLS 1.2 outside of urgent security fixes (as determined by TLS Working Group consensus), new TLS Exporter Labels, and…

Chrome uses Gemini AI to automate vulnerability discovery, triage, and patching, accelerating updates to match modern security risks.

GitHub is making some significant changes to its bug bounty program, shifting its focus to give researchers a better experience.

In other news: Graykey maker sues former employee for leaking exploit; Hugging Face was hacked using AI; unauth RCE finally found in WordPress.

Qubes OS is a revealing case for security measurement because its architecture makes component boundaries security-relevant. We present a protocol-driven longitudinal analysis of 109 public Qubes Security Bulletins (QSBs, 2011--2025), the official…

It's the wedding of the century between Taylor Swift and Travis Kelce, but also vibes of a coup at the UN General Assembly.

The move comes after the company left potentially sensitive data from the initiative exposed internally.

We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?

Access to Fable 5 and Mythos 5 barred for foreign nationals immediately following security evaluation