34 stories tagged vulnerability-research, newest first.
160 points by neom | 99 comments
Apple's program page for the Security Research Device, a specially fused iPhone loaned to qualified researchers for iOS security research, with guidelines and application details.
104 points by dnw | 91 comments
Anthropic Frontier Red Team post on research into using Claude to reduce the attack surface of code for cyber defense.
87 points by zoobab | 22 comments
Blog post by Quentin Kaiser describing two bugs in a Broadcom WiFi parser and how they are exploited on routers running eCos and Linux.
188 points by rs_rs_rs_rs_rs | 58 comments
A Calif research post by Andrew Griffiths describing how a 37-year-old OpenBSD kernel bug involving a small counter was exploited to gain a root shell.
20 points by ollin | 7 comments
XBOW Security Labs research post describing how it built a full-chain Google Chrome exploit, from zero to popping calc, in six days.
6 points by fourfire | 2 comments
GitHub Blog post describing how GitHub's open source AI security agent and its taskflows found 24 Android app vulnerabilities, and how to run it yourself.
456 points by Handy-Man | 192 comments
Hacktron research blog post describing how a heap overflow and an SSO misconfiguration were chained to compromise OpenAI internal repositories.
381 points by infosecau | 209 comments
Searchlight Cyber research post by Adam Kues describing finding a WordPress remote code execution vulnerability using GPT5.6 for about $25.
386 points by ranger_danger | 187 comments
Nebula Security research post (IonStack part II) detailing GhostLock, a stack use-after-free vulnerability present in all Linux distributions for 15 years.
487 points by ColinEberhardt | 187 comments
Noma Labs vulnerability research post describing how a crafted GitHub issue could trick GitHub's AI agent into leaking private repository contents.
321 points by Fysi | 124 comments
Cloudflare blog post by Grant Bourzikas on what the company learned from Project Glasswing and the Mythos frontier AI model for cybersecurity.
438 points by quadrige | 122 comments
Calif blog post describing the first public macOS kernel memory corruption exploit on Apple M5 silicon that bypasses Memory Integrity Enforcement, built in five days.
424 points by bo0tzz | 89 comments
Wiz Research blog post detailing CVE-2026-3854, a critical flaw in GitHub's internal git infrastructure enabling remote code execution on GitHub.com and GitHub Enterprise Server.
1455 points by Ryan5453 | 760 comments
Anthropic's announcement page for Project Glasswing, an initiative to secure critical software in the AI era using its Claude models.
351 points by eichin | 226 comments
Blog post by Michael Lynch describing how Anthropic researcher Nicholas Carlini used Claude Code to find remotely exploitable Linux kernel bugs, including one hidden for 23 years.
580 points by todsacerdoti | 159 comments
Post on Mozilla's Distilled blog about Anthropic's red team using Claude to find security vulnerabilities in Firefox that Mozilla then fixed.
![Screenshot of media.ccc.de: Bluetooth Headphone Jacking: A Key to Your Phone [video]](https://hn.urlbox.com/shots/renders/2026/1/1/2ed85560-8a18-4829-9ebd-b3ec1fe87f61.jpg)
517 points by AndrewDucker | 187 comments
Video recording of a 39C3 talk by Dennis Heinze and Frieder Steinmetz on Bluetooth headphone vulnerabilities that can be used to attack paired phones.
657 points by spiridow | 219 comments
Kudelski Security research post describing how a pull request to CodeRabbit led to remote code execution and write access to about one million repositories.
335 points by the1bernard | 102 comments
Eye Security research post describing how misconfigured Entra OAuth apps could be abused to gain access to internal Microsoft applications.
341 points by uponasmile | 136 comments
Eye Security research blog post describing how the team gained root access inside Microsoft Copilot's code execution sandbox.
586 points by zielmicha | 184 comments
Sean Heelan's blog post describing how he used OpenAI's o3 model to discover CVE-2025-37899, a remote zero-day in the Linux kernel's SMB (ksmbd) implementation.
355 points by nmgycombinator | 228 comments
Blog post by Noah Gregory describing CVE-2025-31250, a macOS flaw where TCC permission prompts could misrepresent which app is requesting access.
490 points by MrBruh | 230 comments
A blog post describing a one-click remote code execution vulnerability found in ASUS's preinstalled DriverHub driver software.
343 points by chc4 | 83 comments
A Zetier blog post arguing that video game speedrunners use the same skills and techniques as security vulnerability researchers.
1548 points by brutecat | 439 comments
A security researcher's write-up of a vulnerability chain that exposed the email address of any YouTube channel owner, earning a $10,000 Google bug bounty.
493 points by ramimac | 283 comments
Sam Curry's writeup on exploiting Subaru's STARLINK admin panel to remotely track, unlock, and control Subaru vehicles.
1370 points by hackermondev | 417 comments
A GitHub Gist writeup by a 15-year-old researcher describing a 0-click deanonymization attack that locates users of Signal, Discord and other apps within about 250 miles.
342 points by notmine1337 | 126 comments
Orange Tsai's blog post presenting WorstFit, a class of Windows vulnerabilities arising from Best-Fit character conversion between UTF-16 and ANSI code pages.
546 points by udev4096 | 91 comments
Flatt Security research post by RyotaK describing a supply chain attack against OpenWrt's firmware build service involving a SHA256 hash collision.
546 points by transpute | 176 comments
Blog post accompanying a POC2024 talk describing an overlooked macOS attack surface and more than ten new sandbox escape vulnerabilities.
543 points by speckx | 320 comments
Sam Curry's writeup on Kia web vulnerabilities that allowed remotely controlling vehicle functions using only a license plate number.
1332 points by xyzeva | 450 comments
A security researcher's blog post describing a Firebase misconfiguration in the Arc browser (CVE-2024-45489) that allowed remote code injection into any user's browser.
795 points by xrayarx | 164 comments
Sam Curry's blog post on discovering vulnerabilities that allowed hacking millions of ISP modems, and investigating who compromised his own modem.
332 points by admp | 72 comments
An interactive tree browser that maps Chrome Vulnerability Reward Program bounty payouts to the Chromium source files changed by the corresponding fixes.