Passkeys – Under the Hood(research.kudelskisecurity.com)

140 points by paulgerhardt 2 years ago | 69 comments

Over 100k Infected Repos Found on GitHub(apiiro.com)

236 points by gnabgib 2 years ago | 153 comments

How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos(research.kudelskisecurity.com)

657 points by spiridow 1 year ago | 219 comments

Kudelski Security research post describing how a pull request to CodeRabbit led to remote code execution and write access to about one million repositories.

Did 5G kill the IMSI catcher?(zetier.com)

253 points by skramace 1 year ago | 110 comments

Kimwolf Botnet Lurking in Corporate, Govt. Networks(krebsonsecurity.com)

8 points by feross 9 months ago | 0 comments

Hackers can infect network-connected wrenches to install ransomware(arstechnica.com)

108 points by ColinWright 2 years ago | 91 comments

Archive.today links going forward(reddit.com)

190 points by consumer451 16 days ago | 134 comments

A Reddit r/Seattle post about archive.today links going forward after mods reportedly found malware injection; the page shows a Reddit network security block.

Chrome again exempts Google from user site data settings(lapcatsoftware.com)

508 points by ExMachina73 2 months ago | 89 comments

Jeff Johnson's blog post reporting that Chrome 152 again exempts Google-owned sites from the user setting to delete site data, six years after a similar bug.

New Date("wtf") – How well do you know JavaScript's Date class?(jsdate.wtf)

363 points by OuterVale 1 year ago | 213 comments

An interactive quiz by samwho testing knowledge of JavaScript's Date class parsing quirks, verified on Node.js 24.4.0.

Prompt injection in HTTP headers: what 217M web responses show(signalscorps.com)

81 points by panoramas4good 29 days ago | 16 comments

Signals Corps blog post analyzing HTTP headers from 217 million crawled web responses for text aimed at AI agents, including prompt injection attempts.

Results of technical investigations for Storm-0558 key acquisition(msrc.microsoft.com)

364 points by duringmath 3 years ago | 169 comments

Microsoft Security Response Center blog post presenting findings on how China-based actor Storm-0558 obtained an MSA consumer signing key used to forge tokens for Outlook access.

The Web Is Broken – Botnet Part 2(jan.wildeboer.net)

371 points by todsacerdoti 1 year ago | 225 comments

Blog post by Jan Wildeboer, second in a series, arguing the web is broken by botnets, likely covering apps embedding SDKs that turn user devices into scraping proxies.