Full Disclosure: 1-Click GitHub Token Stealing via a VSCode Bug https://lobste.rs/s/fysuyw #security #vscode #web
https://blog.ammaraskar.com/github-token-stealing/
security
Anatomy of a Failed (Nation-State?) Attack https://lobste.rs/s/j2ua4f #security
https://grack.com/blog/2026/06/25/dissecting-a-failed-nation-state-attack/
A peek into Reddit's anti-spam internals by @rebane2001 https://lobste.rs/s/boap41 #privacy #security
https://lyra.horse/blog/2026/06/reddit-spam-internals/
Golang code review notes II https://lobste.rs/s/d0ixpj #go #security
https://www.elttam.com/blog/golang-code-review-notes-ii
Incident Report: CVE-2026-LGTM https://lobste.rs/s/6q12d7 #satire #security
https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm.html
A Post-Quantum Future for Let's Encrypt via @fanf https://lobste.rs/s/djguny #security #web
https://letsencrypt.org/2026/06/03/pq-certs.html
Rooting Home Assistant through MeshCore: XSS attacks with a LoRa node name via @fanf https://lobste.rs/s/0rtm7s #security
https://mxsasha.eu/posts/meshcore-xss-home-assistant/
Detecting and removing dangerous secrets on dev workstations before Shai-Hulud does https://lobste.rs/s/evydbs #privacy #security
https://recyclebin.zip/posts/2026-05-25-secret-scanning-fleet-bagel/
It's dead, Jim! (UEFI CA expiry) https://lobste.rs/s/xz51yj #linux #security
https://blog.einval.com/2026/06/27#its_dead_jim
Pilcrow's auth book via @andrew_chou https://lobste.rs/s/a9qqxl #book #security #web
https://auth.pilcrowonpaper.com/
The Empty Field That Wasn't: GPS Broadcasts a Numbers Station https://lobste.rs/s/a7v7e5 #security
https://lsc-pagepro.mydigitalpublication.com/publication/?i=865273&p=62&view=issueViewer
exploitarium: A single archive of public exploit PoCs https://lobste.rs/s/4ywqva #security
https://github.com/bikini/exploitarium
Did Claude Increase Bugs in rsync? https://lobste.rs/s/mf5ryi #security #vibecoding
https://alexispurslane.github.io/rsync-analysis/
Januscape: Guest-to-Host Escape in KVM/x86 https://lobste.rs/s/jea4xl #linux #security
https://github.com/V4bel/Januscape
Try the `upki` preview for Ubuntu via @fanf https://lobste.rs/s/981pzy #linux #security
https://jnsgr.uk/2026/07/upki-preview-for-ubuntu/
Soatok’s Informal Guide to Threat Models https://lobste.rs/s/gwrlsv #rant #security
https://soatok.blog/2026/06/30/soatoks-informal-guide-to-threat-models/
Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694) https://lobste.rs/s/0kc445 #linux #security
https://cyberstan.co.uk/fuse-readdir-oob/
Magecart skimmer turns Stripe into a malware command server via @mseri https://lobste.rs/s/evgsx7 #security
https://sansec.io/research/stripe-api-skimmer-infrastructure
Chasing Lightning: Detecting, Characterizing, and Identifying a Powerful Space-Based GNSS Interference Source via @fanf https://lobste.rs/s/qrhqvc #science #security
https://arxiv.org/abs/2606.03673
The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy https://lobste.rs/s/k67xnh #privacy #security
https://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/
Running Python code in a sandbox with MicroPython and WASM https://lobste.rs/s/h22iaq #python #security #wasm
https://simonwillison.net/2026/Jun/6/micropython-in-a-sandbox/
Claude Code Is Steganographically Marking Requests https://lobste.rs/s/qs2sxd #security #vibecoding
https://thereallo.dev/blog/claude-code-prompt-steganography
Fuzzing for fun - unauthenticated denial of service in snac2 https://lobste.rs/s/zjnc5o #c #security
https://nullenvk.pl/posts/02-snac2-json/
The Threat of Residential Proxies via @fanf https://lobste.rs/s/x8qug8 #security
https://www.feistyduck.com/newsletter/issue_138_the_threat_of_residential_proxies
Dancing mad with sandboxing https://lobste.rs/s/fmkvwk #security
https://xeiaso.net/blog/2026/dancing-mad-sandboxing/