Ghrc.io appears to be malicious(bmitch.net)
352 points by todsacerdoti | 58 comments
Blog post by Brandon Mitchell reporting that ghrc.io, a typo of GitHub's ghcr.io container registry, appears to steal GitHub credentials.
First screen, captured .
Looks similar
Tokio and Prctl = Nasty Bug(kobzol.github.io)
190 points by ingve | 61 comments
Building Linux kernel on macOS natively(seiya.me)
21 points by ingve | 3 comments
Implementing a RISC-V Hypervisor(seiya.me)
94 points by ingve | 4 comments
Writing a Hypervisor in 1k Lines(seiya.me)
93 points by ingve | 9 comments
Related stories
I never authorized an integration that scans my secrets(github.com)
202 points by trvrprkr | 155 comments
A closed GitHub issue on the home-assistant.io repo in which a user complains that an integration scanning their secrets was enabled without authorization, calling it a privacy invasion.
There isn't an easy exploit for this PHP vulnerability(eliastaylor.com)
566 points by zkldi | 437 comments
Blog post arguing a newly disclosed PHP vulnerability is hard to exploit and that thousands of LLM-generated GitHub PoC exploits don't work against vanilla PHP.
What a Hacker Stole from Me(mynoise.net)
355 points by wonger_ | 106 comments
A myNoise blog post by founder Stéphane describing a hacker's attack on the myNoise website, first via code-injection attempts and then a different strategy.
RCE Vulnerability in React and Next.js(github.com)
559 points by rayhaanj | 214 comments
GitHub security advisory GHSA-9qr9-h5gf-34mp for a critical (CVSS 10.0) remote code execution vulnerability in React Server Components affecting Next.js, with patched versions listed.
Several vulnerabilities have been discovered in the Linux kernel(lwn.net)
529 points by luispa | 380 comments
LWN.net repost of Debian Security Advisory DSA-6528-1, a Linux kernel security update fixing numerous CVEs, dated September 29, 2026.
Leaking the email of any YouTube user for $10k(brutecat.com)
1548 points by brutecat | 439 comments
A security researcher's write-up of a vulnerability chain that exposed the email address of any YouTube channel owner, earning a $10,000 Google bug bounty.