peer-tweet

PeerTweet 使用 BitTorrent DHT 的去中心化信息流。灵感来自 Arvid 和 The8472 的“DHT RSS feeds” http://libtorrent.org/dhtrss.html 截图 快速链接 从发布页面下载最新二进制文件。 从地址问题页面查找和分享 PeerTweet 地址。 什么是 PeerTweet？ BitTorrent 的 DHT 可能是互联网上最具弹性和抗审查能力的网络之一。PeerTweet 利用这个网络允许用户向所有监听者广播 推文 。当你启动 PeerTweet 时，它会生成一个哈希...

cargo-fuzz

cargo fuzz Acargo subcommand for fuzzing with libFuzzer! Easy to use! Installation $ cargo install cargo-fuzz Note: libFuzzer needs LLVM sanitizer support, so this only works on x86-64 and Aarch64, and only on Unix-like operating systems not Windows. This also needs a nightly compiler since it us...

rekor

Rekor Rekór - “Registro” en griego Los objetivos de Rekor son proporcionar un registro inmutable y resistente a manipulaciones de los metadatos generados dentro de la cadena de suministro de proyectos de software. Rekor permitirá a los mantenedores de software y a los sistemas de compilación...

ChromeAlone

ChromeAlone - Un Framework C2 para Navegador ¿Qué me aporta esto? ChromeAlone es un implante de navegador que puede utilizarse en lugar de los implantes convencionales como Cobalt Strike o Meterpreter. Este repositorio proporciona un proceso de compilación sencillo que generará una consola de...

psc

psc psc ps container 是一款快速进程扫描工具，利用 eBPF 迭代器与 Google CEL，精确且完整地查询系统状态，并提供完整的容器上下文。 为什么选择 psc？ 利用 eBPF 迭代器实现高速内核级访问 psc 使用 eBPF 迭代器直接从内核数据结构读取进程和文件描述符信息。这种方法具备以下优势： 快速 ：相比 proc 文件系统（传统工具在该系统中大部分时间用于执行系统调用），eBPF 迭代器的效率极高 完整 ：可访问传统上通过 /proc 无法暴露的内核信息。我计划后续按需提供访问 taskstruct 某些字段的高级用法，目前这仍是一个设想 抗篡改...

QuantumLock

QuantumLock Specification Unbreakable, Quantum-Ready, Forever. HTML Mirror: https://roxanneardary.com/quantumlock-specification/ Vision QuantumLock is an open-source protocol specification designed to make Bitcoin more resilient against the development of quantum computing and other emerging...

Axiom-protocol

Axiom: Decentralized and Censorship-Resistant Communication Protocol 🚀 Live Deployment Details Network: Arbitrum One Mainnet L2 Chain ID: 42161 RPC Endpoint: https://arb1.arbitrum.io/rpc or any custom Alchemy/Infura endpoint Axiom Proxy Contract Address: 0xc11CFf8111e8b1F055eba095Efb679a38Abe6b63...

WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android

Meta on Tuesday announced a set of WhatsApp account security features, including support for multiple passkeys to a single account to help users with both iOS and Android devices sign into their accounts using the phishing-resistant method. The tech giant said more than 1 billion people use a...

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed,...

Google’s synchronized passkeys can be stolen in ‘Pass‑ta‑key’ attacks

Passkeys were supposed to make stolen passwords a thing of the past. No password to phish, no secret to reuse, and no string of characters sitting in a database waiting to be leaked. Over time, it's thought that passkeys will replace passwords entirely. But what happens when malware steals the...

JLSEC-2026-1144 Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the...

Issue summary: The implementations of AES-SIV RFC 5297 and AES-GCM-SIV RFC 8452 mishandle the authentication of AAD Additional Authenticated Data with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's...

Malicious code in fluid-type-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216 src/index.js in [email protected] contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is...

The Verification Step Is the New ATO Battleground in 2026

For years, account takeover ATO followed a predictable script. Attackers bought stolen credentials in bulk, ran them through automated tools, and waited for matches. Credential stuffing was cheap, scalable, and for defenders, relatively well understood. That era is ending. Not because attackers...

CVE-2026-45446 Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

Issue summary: The implementations of AES-SIV RFC 5297 and AES-GCM-SIV RFC 8452 mishandle the authentication of AAD Additional Authenticated Data with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's...

CVE-2026-45446

Issue summary: The implementations of AES-SIV RFC 5297 and AES-GCM-SIV RFC 8452 mishandle the authentication of AAD Additional Authenticated Data with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's...

Hardening Agent Benchmarks with Adversarial Hacker-Fixer Loops

Agent benchmarks score submissions with outcome verifiers that are typically hand-written and brittle, leaving them open to reward hacking. We audit 1,968 tasks across five terminal-agent benchmarks and find 323 16% hackable by frontier models given only the task description. This corrupts both...

World Passkey Day: Advancing passwordless authentication

World Passkey Day is a chance to reflect on progress toward a shared goal: reducing our reliance on passwords and other phishable authentication methods by accelerating passkey adoption. As cyberattacks become more automated and AI-powered, each account is only as secure as its weakest credential...

ClawGuard: Out-Of-Band Detection of LLM Agent Workflow Hijacking Via EM Side Channel

Autonomous LLM agents face a critical security risk known as workflow hijacking, where attackers subtly alter tool and skill invocations. Existing defenses rely on host-internal telemetry such as audit logs, which can be forged if the host OS is compromised. To solve this, we introduce ClawGuard,...

MAGIQ: A Post-Quantum Multi-Agentic AI Governance System with Provable Security

Our computing ecosystem is being transformed by two emerging paradigms: the increased deployment of agentic AI systems and advancements in quantum computing. With respect to agentic AI systems, one of the most critical problems is creating secure governing architectures that ensure agents follow...

A Cryptography Engineer’s Perspective on Quantum Computing Timelines

My position on the urgency of rolling out quantum-resistant cryptography has changed compared to just a few months ago. You might have heard this privately from me in the past weeks, but it’s time to signal and justify this change of mind publicly. There had been rumors for a while of expected an...