security

BSides Orlando 2026 Badge

Contribute to bsidesorlando/2026-badge development by creating an account on GitHub.

How to Hack Time, With C2PA

The most impressive hacking stunt from cinema history comes from Kung Fury (2015), in which Hackerman hacks time itself. He uses this power to correct historic misdeeds. But what would I do with the ability to hack time?

Security in the LLM Age

Apple says it’s tightening macOS ‘Full Disk Access’ controls due to new risks from AI agents

Apple says it will add new controls around macOS’s Full Disk Access permission, warning that increasingly capable AI agents make broad access to users’ files, messages, mail, and browsing history riskier.

Medical records giant Epic pauses product development to fix security bugs that risk patients’ data

The healthtech software giant, which makes the widely used MyChart system for accessing medical data, will focus on fixing security bugs for the next few weeks.

GitHub’s advice for its new Copilot feature is to try something else first

GitHub launched computer use in public preview on Thursday, giving Copilot CLI and its desktop app the ability to operate The post GitHub’s advice for its new Copilot feature is to try something else first appeared first on The New Stack.

“No reason why everyone should have an identical Claude experience”: Anthropic’s mods let you change Claude Code’s look and behavior

Developers have long been able to customize Claude Code to their preferences, via settings, persistent instructions in CLAUDE.md, hooks, and The post “No reason why everyone should have an identical Claude experience”: Anthropic’s mods let you change Claude Code’s look and behavior appeared first…

16,326 Supabase databases are readable by anyone. Here's how to check yours in two minutes

UpGuard Research looked at about 300,000 domains that use Supabase and found 16,326 databases exposing tables that anyone could read. Over half had signs of personal data. Some had passwords or authentication tokens. These weren't abstract records.

Agent security moves out of the agent itself

Control leaves the process NVIDIA presented the Open Agent Safety Platform on September 28, and the design decision is the news. The runtime is called OpenShell, it is open source, and it already supports Codex, Claude Code, Pi and Hermes.

Top Secret Online Developer Tools to save

# 18 Secret Web Utilities That Will Save You Hours of Daily Work Whether you are a web developer, audio engineer, data scientist, or daily digital worker, hunting down reliable, single-purpose web tools often feels like an endless cycle of intrusive ads, paywalls, and slow-loading scripts.

Claude Code's Own Delete Guard Was Bypassed by cmd /c — Then a Quoting Bug Wiped a Drive

A Claude Code session, driven remotely from claude.ai with its working directory set to C:\Windows\System32, was asked to clean up a leftover folder from an old Windows upgrade. Its first delete attempt was correctly blocked by Claude Code's own system-path guard.

Your LLM Call Has No Ceiling. TypeScript Is Fine With It. Three CWEs Aren't.

generateText with a model and a prompt and nothing else is a valid call. TypeScript is satisfied. The type system has no opinion about how many tokens come back, how long it takes, or who pays for the answer nobody reads.

Inside J3D Eye: Building a Real-Time Global Camera Intelligence & OSINT Dashboard

Hey everyone! 👋 When expanding JED AI (https://jedcorp.ink) beyond automated vulnerability scans and terminal orchestration, we wanted to tackle a different kind of challenge: real-time global telemetry and visual intelligence.

监管加速落地，AI Agent「合规红利」窗口正在关闭——一份审计链路的工程观察

过去一年，每一次 Agent 系统上线前的合规审计，都要比上一次多花两周准备。不是流程变慢，而是监管表格在变厚，审计要交叉验证的数据点在变多。 1. 现象层：制度供给的「超常提速」 几个关键时间节点值得重看： 2021 年 12 月：国家互联网信息办公室、工业和信息化部、公安部、国家市场监督管理总局联合公布《互联网信息服务算法推荐管理规定》，自 2022 年 3 月 1 日起施行。算法推荐第一次被拉进备案与可解释的框架。 2022 年 11 月：《互联网信息服务深度合成管理规定》公布，自 2023 年 1 月 10 日起施行。深度合成内容标识义务成为硬性要求。 2023 年 7 月 10…

pkg-topic-fantasy-elf-森林里的安全协议-1786975392-6

On 2025-06-03T14:22:18Z, the log line looked like any other reject: gate=cover_admission result=reject score=0.75 threshold=0.60 model=cover-v3 I’m Fantasy Elf, and I work on AI safety. This is the story of a threshold that lied to us.

California subpoenas OpenAI as investigators trace its agents to the CDC

OpenAI’s rogue agents reached pre-production servers, tried attacker techniques and probed the websites of the CDC, the SEC, the International Energy Agency and the Mayo Clinic. That is according to an investigation published on Thursday by Asymmetric Security, a digital forensics firm.

OpenAI alerts 100+ orgs that its 'misaligned models' attempted to break in - or worse

Mostly 'routine research tasks,' and 'some involved government websites, which our models often use,' AI giant tells The Reg

Californian accused of shipping $300M worth of Nvidia chips to China without Uncle Sam’s approval

Prosecutors claim Greg Lui helped China procure advanced hardware to develop, ahem, 'super intelligence’