CRLF Injection in `–proxy-header` allows extra HTTP headers (CWE-93)(hackerone.com)

8 points by oblivionsage 1 year ago | 4 comments

You did this with an AI and you do not understand what you're doing here(hackerone.com)

897 points by redbell 1 year ago | 431 comments

A HackerOne vulnerability report page, apparently an AI-generated bug report rejected by maintainers; the content had not loaded when captured.

Upcoming changes to how live videos are stored(facebook.com)

15 points by EGreg 1 year ago | 1 comments

Bill Atkinson has died(daringfireball.net)

1519 points by romanhn 1 year ago | 258 comments

Daring Fireball link post noting the death of Bill Atkinson, the Apple engineer behind MacPaint and HyperCard; the capture shows a Facebook login wall instead.

Stripe is down(status.stripe.com)

46 points by tompccs 7 months ago | 16 comments

A list of Hacker News's undocumented features and behaviors(github.com)

534 points by ssgodderidge 2 years ago | 208 comments

A GitHub README by minimaxir cataloging undocumented features and behaviors of Hacker News, such as karma effects, ranking penalties, and moderation mechanics.

Bypassing airport security via SQL injection(ian.sh)

1859 points by iancarroll 2 years ago | 403 comments

Ian Carroll's blog post describing how a SQL injection flaw let researchers add arbitrary people to the TSA Known Crewmember program, bypassing airport security screening.

I Went to SQL Injection Court(sockpuppet.org)

1162 points by mrkurt 1 year ago | 416 comments

Blog post by Thomas Ptacek about testifying in an Illinois court case over whether public bodies can withhold database schemas from FOIA requests, and pending legislation.

There isn't an easy exploit for this PHP vulnerability(eliastaylor.com)

566 points by zkldi 4 days ago | 437 comments

Blog post arguing a newly disclosed PHP vulnerability is hard to exploit and that thousands of LLM-generated GitHub PoC exploits don't work against vanilla PHP.

Sourcehut account takeover via build logs (XSS in ansi2html)(blog.arusekk.pl)

136 points by arusekk 1 month ago | 27 comments

A vulnerability writeup describing a wormable XSS in SourceHut's ansi2html.py that let attackers take over accounts of users viewing injected build logs.

Several vulnerabilities have been discovered in the Linux kernel(lwn.net)

529 points by luispa 24 days ago | 380 comments

LWN.net repost of Debian Security Advisory DSA-6528-1, a Linux kernel security update fixing numerous CVEs, dated September 29, 2026.

Hacker in Snowflake extortions may be a U.S. soldier(krebsonsecurity.com)

329 points by todsacerdoti 1 year ago | 183 comments

KrebsOnSecurity investigation suggesting the hacker Kiberphant0m, linked to Snowflake customer data extortions, may be a U.S. Army soldier stationed in South Korea.