Ethical Hacking and Cybersecurity Blog
Prove You’re a Computer
PACT: Anonymous Credentials for the Web – Mozilla Hacks - the Web developer blog
A deeper look at PACT: a new initiative to tackle the rising tide of CAPTCHAs on the web whilst keeping the web open and preserving user's privacy.
An update on the scraper situation
Our article 'Fighting the AI scraper bot scourge', published in early 2025, discussed the probl [...]
Download pumping: New npm deception technique for supply chain attacks
Learn how attackers exploit automated bot traffic as part of software supply chain attacks to artificially inflate download counters and mask malicious payloads as legitimate.
Assessing Claude Mythos Preview’s cybersecurity capabilities
Claude Mythos Preview is a new general-purpose language model that is strikingly capable at computer security tasks. This post provides technical details for researchers and practitioners who want to understand exactly how we have been testing this model, and what we have found over the past month.
Michael R. Crusoe (@biocrusoe@fairpoints.social)
Oh, I like this part > No AI-generated text in human-to-human communication > When our maintainers volunteer their time to review your issue, PR, or proposal, they do not want to talk to a machine. This is a basic principle of respect. https://mastodon.gamedev.place/@godotengine/116839550229253906
CSP Bypass Search
A tool designed to help ethical hackers bypass restrictive Content Security Policies
What happened after 2,000 people tried to hack my AI assistant — Fernando Irarrázaval
I built hackmyclaw.com, where anyone could email Fiu, my OpenClaw assistant, and try to make it leak the contents of a secrets.env file.
A quote from Daniel Stenberg
The challenge with AI in open source security has transitioned from an AI slop tsunami into more of a ... plain security report tsunami. Less slop but lots of reports. …
Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories
The Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.
Elena Rossini on GoToSocial ⁂ (@elena@aseachange.com)
[1 media attachment] Good morning Fedi friends. Is anybody curious about how the #WSocial experiment is going? You know, the private, for profit "European answer to X" endorsed by the European Commission, which is a fork of Bluesky and has quietly gone closed-source before its beta launch (à la #TruthSocial)? I've got numbers for you! Nearly two months in, W Social has almost the same number of accounts as #Eurosky... You know, the European fork of Bluesky that does NOT require government IDs to post. W Social: 23.5k accounts Eurosky: 24.8k accounts In order to post on W Social you need to provide your government ID and go through a 13-step verification process. So far 4.5k accounts are verified but only 2036 (as of this morning) have ever published a single post or reply. There is a handy website - https://pdsls.dev - that allows you to monitor the "firehose" of any ATproto-powered PDS. Inspired by @pallenberg and his awesome videos (example: https://mu.social/profile/palle.eurosky.social/post/3mskkqrrc522l) I have been comparing the live activities of the two networks. The difference is SHOCKING. W Social is largely a zombie, dormant network, with a high number of accounts that do not interact. Eurosky by contrast shows very lively activity. The screenshot I grabbed yesterday shows a side-by-side comparison of their firehose over a 27 minute period. W Social had a total of 240 events (follows, likes, posts...) whereas Eurosky registered 7596 events in the same time interval. A couple of days ago I downloaded their PDS and saw that 67,8% of their accounts have 0 follows, 0 followers and 0 posts. That's what I mean when I call it a "zombie network." W Social's CEO says they plan to start monetizing by introducing ads in 2027. WITH THESE NUMBERS?!? Sure Jan. I love how with the transparency of open data you can't really use the standard playbook of CEO hype and hubris. Because we can all see their numbers. And they are BAAAAD. I have been feeling…
Cybersecurity Looks Like Proof of Work Now
The UK's AI Safety Institute recently published Our evaluation of Claude Mythos Preview’s cyber capabilities, their own independent analysis of Claude Mythos which backs up Anthropic's claims that it is …
Ten Lines Of Code That Changed My World – Pixelambacht
Front-end antics and typographic mischievousness
Unlawful by design: Exposing the human rights costs of generative AI - Amnesty International
This briefing examines how standalone generative AI systems, based on unlawful web scraping, are in conflict with international human rights law (IHRL) and standards through their design, development and deployment. While these technologies promise sophisticated automation and efficiency, they rely on data collection and model training practices that abuse privacy rights, enable discrimination, and threaten […]
It’s time to drain the Programmatic Swamp - New Digital Age
"Large parts of the programmatic ecosystem are a scam, and I don't mean slightly inefficient or in need of a tidy-up," writes Daniel Gilbert for New Digital Age...
Log in to the site | Blacksky Learn