MAL-2025-28055 Malicious code in observatory-banana-ci96 (npm)

The package observatory-banana-ci96 was found to contain malicious code...

MAL-2025-37325 Malicious code in turnip-observatory-j27k (npm)

The package turnip-observatory-j27k was found to contain malicious code...

MAL-2025-27921 Malicious code in nutmeg-observatory-6jte (npm)

The package nutmeg-observatory-6jte was found to contain malicious code...

MAL-2025-28053 Malicious code in observatory-alpha-u7qb (npm)

The package observatory-alpha-u7qb was found to contain malicious code...

MAL-2025-37090 Malicious code in tornado-observatory-l8xh (npm)

The package tornado-observatory-l8xh was found to contain malicious code...

MAL-2025-28059 Malicious code in observatory-yacht-750n (npm)

The package observatory-yacht-750n was found to contain malicious code...

observatory.herts.ac.uk Cross Site Scripting vulnerability OBB-3890855

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Satellite Images Show the Devastating Cost of Sudan’s Aerial War

As civil conflict continues in and above the streets of Khartoum, satellite images from the Conflict Observatory at Yale University have captured the catastrophic damage...

Meta Takes Down Fake Facebook and Instagram Accounts Linked to Pro-U.S. Influence Operation

Meta Platforms on Tuesday said it took down a network of accounts and pages across Facebook and Instagram that were operated by people associated with the U.S. military to spread narratives that depicted the country in a favorable light in the Middle East and Central Asia. The network, which...

Clubhouse under scrutiny for sending data to Chinese servers

The audio-chat app Clubhouse is the latest rage in the social media landscape. What makes it so popular and, now its part of the social media landscape, can we trust it? The Clubhouse app Clubhouse was launched about a year ago and was initially only used by Silicon Valley’s rich and famous. It i...

Facebook's Ex-Security Chief Details His 'Observatory' for Internet Abuse

Alex Stamos' Stanford-based project will try to persuade tech firms to offer academics access to massive troves of user data...

htrace.sh - Simple Shell Script To Debugging HTTP/HTTPS Traffic Tracing, Response Headers And Mixed-Content

htrace.sh is a shell script that allows you to validate your domain configuration and catch any errors e.g. redirect loops. It also displays basic information about the ssl configuration if available, response headers, checks for mixed content and performs security scans using Nmap scripts and...

Majority of Sites Fail Mozilla's Comprehensive Security Review

A majority of the top 1 million websites earn an “F” letter grade when it comes to adopting defensive security technology that protect visitors from XSS vulnerabilities, man-in-the-middle attacks, and cookie hijacking. The failing grades come from a comprehensive analysis published this week by t...

TaBi - Track BGP Hijacks

Developed since 2011 for the needs of the French Internet Resilience Observatory , TaBi is a framework that ease the detection of BGP IP prefixes conflicts, and their classification into BGP hijacking events. The term prefix hijacking refers to an event when an AS, called an hijacking AS ,...

How to Manage Android App Permissions to Protect Your Privacy

Do you actually read the list of permissions that Android apps are asking for before you install them? I know most of us treat those permissions like terms and conditions, blindly tapping our way through. But if you actually do, you would be aware of their reach. Some of your apps can make phone...

Komodia Certificate Manipulation Enabled Man-In-The-Middle Attacks

The shoddy state of SSL certificate validation on the Internet again floated to the surface, this time by the Superfish mess, which continues to get worse. The Electronic Frontier Foundation on Wednesday released a report based on data scoured from the Decentralized SSL Observatory which it...

HTTPS Everywhere 3.0 Released

The EFF has released an updated version of its popular HTTPS Everywhere browser plugin, which enables users to automatically connect over HTTPS to many sites. The newest version of the extension now supports more than 1,500 sites. The EFF developed HTTPS Everywhere in collaboration with The Tor...

EFF's HTTPS Everywhere Plugin Detects Bad Certs, Security Flaws

The EFF has released a new version of its HTTPS Everywhere browser extension, and users can now turn on a feature that will send the EFF copies of digital certificates that the browser encounters, allowing the organization to look for flawed, fake or expired certificates. The new capability is...

EFF Data Shows Four CAs Compromised Since June

The EFF, through the use of its SSL Observatory, has taken a look at the data from certificate revocation lists for SSL certificates in recent months, and found that there were four separate CAs compromised in the last four months. The data that the EFF looked at was a summary of the reasons that...

A Syrian Man-In-The-Middle Attack against Facebook

If you are in Syria and your browser shows you this certificate warning on Facebook, it is not safe to login to Facebook. You may wish to use Tor to connect to Facebook, or use proxies outside of Syria. Yesterday we learned of reports that the Syrian Telecom Ministry had launched a...