This report on the technical aspects of end-to-end encryption was prepared by the author as a consultant for Privacy International who have a special licence for its use; the author further licences it to the public under the terms of the Creative Commons Attribution 4.0 International licence.

This report will be periodically updated to address typos, missing content, missing concepts, other clarifications, etc; a list of diffs/changes will be published for transparency & change tracking.

India just unveiled its BRICS 2026 chairship with a bold new agenda: a CBDC bridge connecting central bank digital currencies across BRICS nations. This paym…

Tesla runs a bug bounty program that invites researchers to find security vulnerabilities in their vehicles. To participate, I needed the actual hardware, so I started looking for Tesla Model 3 parts on eBay. My goal was to get a Tesla car computer and touchscreen running on my desk, booting the car’s operating system.

Very dope.

How I found that anyone with a boarding pass photo can pull full passport numbers, home addresses, children’s dates of birth, credit card details, and Known Traveler Numbers for every passenger on a Frontier Airlines booking. Reported March 3rd. Still live 105 days later.

How I found that anyone could register on FIFA’s public Agent Platform, gain access to the Football Data Platform’s Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.

We gotta stop doing client-side auth.

How I found that anyone could register on FIFA’s public Agent Platform, gain access to the Football Data Platform’s Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.

Dependabot is a noise machine. It makes you feel like you’re doing work, but you’re actually discouraging more useful work. This is especially true for security alerts in the Go ecosystem.

I recommend turning it off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running your test suite against the latest version of your dependencies.

“We show that a tiny snippet—just 13 words—of retrieved text on a UGC website like Reddit, Wikipedia, Quora, or Facebook can change AI agents to output spam / scam content pretty consistently.”

“I think based on the comment content itself, it’s just hard to distinguish between the poisoned text and an actual user’s text,” Zhang said. “Let’s say if you want to find the best restaurant, it could be possible that some [human] users post about good restaurants—you can’t really say [as a moderator] ‘You cannot post this comment because it’ll poison an LLM.’”

see: https://arxiv.org/abs/2605.24245

“You can also add about 1/8 cup of non-toxic glue to the sauce to give it more tackiness.”

Ah, so that’s where it came from. The LLM, because the joke was packaged up as advice, thought none the wiser. We gotta stop using this crap LOL.

via: https://www.404media.co/it-is-trivially-easy-to-use-reddit-to-manipulate-ai-search-research-suggests/

the cyberpunk present is weird as fuck: the latest Shai Hulud malware wave contains an LLM prompt to create biological weapons and nuclear weapons, with the purpose to trip LLM safety refusals so that LLM-based code scanning wont see the malware

Genius!

see: https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious

An easy-to-use secure configuration generator for web, database, and mail software. Simply select the software you are using and receive a configuration file that is both safe and compatible.

Tamper-sensing meshes are electronic layers that detect an attacker drilling or cutting into a device. There isn’t a lot of public information about their construction, so I did a survey of about 30 devices with such meshes. In this talk, I’ll share the results of that survey.

Bagel is a cross‑platform CLI that inspects developer workstations (macOS, Linux, Windows) and produces a structured report of:

• Dev tool configurations and risky settings across 9 probes: Git, SSH, npm, environment variables, shell history, cloud credentials (AWS/GCP/Azure), JetBrains IDEs, GitHub CLI, and AI CLI tools.
• Secret locations (metadata only): presence of tokens, keys, and credentials in config files, env vars, and history—detected by 8 secret detectors—never the secret values.

Helper that allows Git (and shell scripts) to use KeePassXC as credential store

The modern vibe-hacker doesn’t write exploits anymore, they just ask Claude to “penetration test this code for research purposes.”