1 bug, $50k in bounties, a Zendesk backdoor(gist.github.com)
1542 points by mmsc | 400 comments
A GitHub Gist write-up by a 15-year-old bug hunter describing a Zendesk bug affecting many Fortune 500 companies that earned over $50,000 in bounties.
First screen, captured .
Looks similar
We pwned X, Vercel, Cursor, and Discord through a supply-chain attack(gist.github.com)
1080 points by hackermondev | 397 comments
A GitHub Gist writeup by a 16-year-old researcher describing a critical XSS vulnerability in Mintlify docs that affected X, Vercel, Cursor, Discord and others.
0-click deanonymization attack targeting Signal, Discord, other platforms(gist.github.com)
1370 points by hackermondev | 417 comments
A GitHub Gist writeup by a 15-year-old researcher describing a 0-click deanonymization attack that locates users of Signal, Discord and other apps within about 250 miles.
Obfuscating Lua (2019)(gist.github.com)
39 points by shakna | 10 comments
Hofstadter on Lisp (1983)(gist.github.com)
360 points by Eric_WVGG | 204 comments
A GitHub Gist reproducing Douglas Hofstadter's 1983 Scientific American introduction to Lisp, "Atoms and Lists," from Metamagical Themas.
Roc rewrites the compiler in Zig(gist.github.com)
322 points by todsacerdoti | 237 comments
A GitHub Gist by Richard Feldman explaining why the Roc programming language's compiler is being rewritten from Rust in Zig.
Related stories
Leaking the email of any YouTube user for $10k(brutecat.com)
1548 points by brutecat | 439 comments
A security researcher's write-up of a vulnerability chain that exposed the email address of any YouTube channel owner, earning a $10,000 Google bug bounty.
GitHub is investigating unauthorized access to their internal repositories(twitter.com)
527 points by splenditer | 289 comments
A post on X from GitHub stating it is investigating unauthorized access to its internal repositories, with no current evidence of impact to customer data.
Someone at BrowserStack is leaking users' email addresses(shkspr.mobi)
329 points by m_km | 88 comments
Blog post by Terence Eden describing how a unique email address he gave BrowserStack ended up with a third party via Apollo.io, implying a leak.
When MFA isn't MFA, or how we got phished(retool.com)
333 points by dvdhsu | 240 comments
Retool blog post describing a phishing attack on its employees and how Google Authenticator cloud sync undermined multi-factor authentication.
We used an AI agent to fix an open-source bug. Someone asked to ban us(github.com)
9 points by maxcr | 2 comments
A GitHub pull request to the VisiData project submitted using an AI agent to fix a bug, which drew a request to ban the contributors.
Hackers obtain counterfeit TLS certificates for Google and other large services(arstechnica.com)
111 points by colinprince | 37 comments
Ars Technica article reporting that hackers compromised three domain registries and obtained unauthorized TLS certificates for Google and other large services.