security

Deadbugz: Currently Active MCP Supply-Chain Campaign https://lobste.rs/s/wjiyxu #security #vibecoding
https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign

What does GitHub’s security team even do? https://lobste.rs/s/jnhyrh #security #vcs
https://orchidfiles.com/github-security-team/

Bypassing Android Hardware Attestation from the Analyst's Chair https://lobste.rs/s/lbaw4d #android #security
https://blog.quarkslab.com/bypassing-android-hardware-attestation.html

Don't #Hang Up On #AI #Scammers. Do THIS Instead. #Kitboga #yt #satire #comedyGold #privacy #security

https://youtu.be/lk3jCuITwcE 🤣🤣🤣🤣🤣🤣

My Homelab Got Hacked - A Postmortem https://lobste.rs/s/ugkhor #devops #security
https://phunky.cafe/my-homelab-got-hacked/

Apple Limits Bug Bounty Submissions After a Barrage of AI Entries https://lobste.rs/s/uyyfhi #security #vibecoding
https://www.pcmag.com/news/apple-limits-bug-bounty-submissions-after-a-barrage-of-ai-entries

Decrypting Flume Water Monitor Traffic via @hibachrach https://lobste.rs/s/g94aro #hardware #security
https://lithostech.com/2026/08/decrypting-flume-water-monitor-traffic/

Exploiting Volvo/Eicher’s fleet management platform to gain control over all users and vehicles https://lobste.rs/s/pg4toy #security
https://eaton-works.com/2026/07/27/my-eicher-hack/

Apple MIE exploitation challenge https://lobste.rs/s/lz6eoe #mac #security
https://blog.calif.io/p/apple-mie-exploitation-challenge

I found a KVM guest-to-host heap corruption bug and someone else got there first https://lobste.rs/s/octplv #linux #security
https://blog.himanshuanand.com/2026/08/i-found-a-kvm-guest-to-host-heap-corruption-bug-and-someone-else-got-there-first/

Design flaws in issetugid() (2017) https://lobste.rs/s/6gx5vy #api #c #security #unix
https://gist.github.com/nicowilliams/4daf74a3a0c86848d3cbd9d0cdb5e26e

Bulk AbuseIPDB reporting using command-line tools https://lobste.rs/s/vjds7h #security
https://blog.mbirth.uk/2026/08/30/bulk-abuseipdb-reporting-using-command-line-tools.html

Bastillion 5.1: single-JAR SSH gateway now audits and replays every session https://lobste.rs/s/an2tby #java #release #security
https://github.com/bastillion-io/Bastillion/releases#release-v5.1.0

The Cipher Behind QSYRUPWD: Reconstructing IBM i Password Hashes https://lobste.rs/s/2dc0gb #reversing #security
https://blog.silentsignal.eu/2026/07/28/the-cipher-behind-qsyrupwd-reconstructing-ibm-i-password-hashes/

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident https://lobste.rs/s/pxczeo #security #vibecoding
https://huggingface.co/blog/agent-intrusion-technical-timeline

Proof types in Dart: Using final classes as computational witnesses https://lobste.rs/s/wdo7aj #compilers #security
https://modulovalue.com/blog/proof-types-in-dart/

Detection primitives for eBPF rootkits https://lobste.rs/s/72hjym #linux #security
https://securitylabs.datadoghq.com/articles/detection-primitives-for-ebpf-rootkits/

From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities https://lobste.rs/s/jpwrmk #security
https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/

I accidentally turned LLM memory into program analysis https://lobste.rs/s/gvotke #logiclangs #security #vibecoding
https://pwning.systems/posts/llm-memory-program-analysis/

Copilot will propagate a malicious worm from one Word document to another https://lobste.rs/s/rgn8u4 #security #vibecoding
https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/

Rootless Docker and Its Hidden Security Trade-Offs https://lobste.rs/s/lssato #security
https://www.kenmuse.com/blog/rootless-docker-and-its-hidden-security-trade-offs/

Guest author Peter Firmstone continues his brilliant series of #Security baked into the #JVM, with his third post: two Subjects, one call

This part covers the two kinds of identity a call carries, how SPIFFE manages process credentials without keystores, and how three identity layers coexist on a single dispatch thread.

https://blog.frankel.ch/security-baked-into-jvm/3/

OWASP Top 10 CI/CD Security Risks https://lobste.rs/s/qhxzrd #security
https://owasp.org/www-project-top-10-ci-cd-security-risks/

A rant about phishing: It's not the user's fault (and not DNS either) https://lobste.rs/s/9szn91 #security #web
https://maurycyz.com/misc/domains/

How CHERIoT Provides Strong and Usable Isolation Without an MMU https://lobste.rs/s/gtvx0w #hardware #osdev #security
https://queue.acm.org/doi/10.1145/3831361