eMudhra Login Bypass(mastodon.catgirl.cloud)

5 points by _ache_ 2 days ago | 1 comments

Show HN: Zsync, a Reddit Alternative with the Goal to Reward Quality Comments(zsync.xyz)

183 points by JSavageOne 3 years ago | 101 comments

What’s getting pwned right now(pwn.watch)

353 points by mrkd 4 days ago | 165 comments

pwn.watch is a live feed of ongoing security incidents and CVEs, listing affected software, patch status, fixed versions, and source advisories.

A complete bypass of eMudhra’s 1FA OTP login system(mastodon.catgirl.cloud)

131 points by tensegrist 3 days ago | 53 comments

Mastodon thread describing a bypass of eMudhra's OTP login by encrypting OTP requests with an exposed public key, enabling brute-forcing of logins to steal certificates.

Constantine: modular, high-performance, zero-dependency cryptography stack(forum.nim-lang.org)

63 points by michaelsbradley 2 years ago | 9 comments

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack(gist.github.com)

1080 points by hackermondev 10 months ago | 397 comments

A GitHub Gist writeup by a 16-year-old researcher describing a critical XSS vulnerability in Mintlify docs that affected X, Vercel, Cursor, Discord and others.

Steal My Bitcoin CTF PoC(github.com)

153 points by davikr 15 hours ago | 43 comments

What a Hacker Stole from Me(mynoise.net)

355 points by wonger_ 1 year ago | 106 comments

A myNoise blog post by founder Stéphane describing a hacker's attack on the myNoise website, first via code-injection attempts and then a different strategy.

Thief of $90M in seized U.S.-controlled crypto is gov't contractor's son(web3isgoinggreat.com)

321 points by pavel_lishin 9 months ago | 64 comments

A Web3 is Going Just Great entry reporting that the alleged thief of $90M in seized U.S.-government-controlled crypto is the son of a government crypto contractor.

Shreddit is a Python program to remove all your Reddit comments(github.com)

335 points by wgx 3 years ago | 207 comments

GitHub repository for Shreddit, a Python tool using PRAW to delete your Reddit comment history, since deleting an account does not remove comments.

AWS Bedrock to require sharing data with Anthropic for Mythos and future models

369 points by TomAnthony 4 months ago | 216 comments

Hacker News discussion of Anthropic requiring 30-day data retention for Mythos-class Claude models on AWS Bedrock, moving data outside AWS's security boundary.

Gheist campaign plants secret-dumping workflows using stolen GitHub tokens(wiz.io)

44 points by acossta 20 hours ago | 0 comments

Wiz Research blog post analyzing Gheist, a campaign using stolen GitHub tokens to plant workflows that dump repository secrets, with IOCs and response guidance.