Sandboxes won't save you from OpenClaw
https://tachyon.so/blog/sandboxes-wont-save-you
#HackerNews #Sandboxes #OpenClaw #Cybersecurity #Threats #TechNews #SecurityResearch
#Tag
Sandboxes won't save you from OpenClaw
https://tachyon.so/blog/sandboxes-wont-save-you
#HackerNews #Sandboxes #OpenClaw #Cybersecurity #Threats #TechNews #SecurityResearch
I'm excited to share three new roles that I'm hiring for on the Security Research team at 1Password! 🔐
Here are the job descriptions available today:
Senior Security Researcher: https://jobs.ashbyhq.com/1password/a370e4fa-e1fa-49bc-be45-8b04184480da
Staff Security Researcher: https://jobs.ashbyhq.com/1password/980f3aad-cc6b-425f-9f35-a465ab20032a
Principal Security Researcher: https://jobs.ashbyhq.com/1password/2811c7da-7dad-445d-bf96-f6e0e5bb27d8
If you’ve got CVE’s, given conference talks at premier security conferences, published vulnerability write ups, and/or written blogs about vulnerabilities you’ve discovered, then this job is likely for you.
Especially if you’re into hacking AI-integrated software, Large Language Models, browsers, cryptographically sensitive software, or desktop/mobile applications! 😉
I'm excited to share three new roles that I'm hiring for on the Security Research team at 1Password! 🔐
Here are the job descriptions available today:
Senior Security Researcher: https://jobs.ashbyhq.com/1password/a370e4fa-e1fa-49bc-be45-8b04184480da
Staff Security Researcher: https://jobs.ashbyhq.com/1password/980f3aad-cc6b-425f-9f35-a465ab20032a
Principal Security Researcher: https://jobs.ashbyhq.com/1password/2811c7da-7dad-445d-bf96-f6e0e5bb27d8
If you’ve got CVE’s, given conference talks at premier security conferences, published vulnerability write ups, and/or written blogs about vulnerabilities you’ve discovered, then this job is likely for you.
Especially if you’re into hacking AI-integrated software, Large Language Models, browsers, cryptographically sensitive software, or desktop/mobile applications! 😉
And it's out!
Zack Whittaker and I have released our report on the pilot survey we conducted to increase awareness about threats security researchers and journalists who report on cybersecurity and cybercrime experience.
We are grateful to all those who responded to the survey and shared a bit of their experiences. Based on what we found in a pilot survey with a non-random sample, I really think we need to do a bigger study that can also do a deeper dive into some questions.
You can read the report in html or download the .pdf version:
pdf: https://databreaches.net/wp-content/uploads/security-researcher-journalist-threats-survey-2026.pdf
In conjunction with the release of the report, I've also added a new "Threats" category to DataBreaches.net.
You can also read some overview comments from Zack at
https://this.weekinsecurity.com/new-survey-reveals-how-security-researchers-and-journalists-experience-legal-and-criminal-threats/
My post explaining how this all started is at https://databreaches.net/2026/02/02/threats-results-of-a-pilot-survey-on-threats-and-a-new-category-on-databreaches-net/
#cybersecurity #securityresearch #legalthreats #threats #criminals #databreach #vulernabilities #malware #lawsuit #survey
@zackwhittaker @campuscodi @amvinfe @jgreig @dangoodin @GossiTheDog @lawrenceabrams @euroinfosec
And it's out!
Zack Whittaker and I have released our report on the pilot survey we conducted to increase awareness about threats security researchers and journalists who report on cybersecurity and cybercrime experience.
We are grateful to all those who responded to the survey and shared a bit of their experiences. Based on what we found in a pilot survey with a non-random sample, I really think we need to do a bigger study that can also do a deeper dive into some questions.
You can read the report in html or download the .pdf version:
pdf: https://databreaches.net/wp-content/uploads/security-researcher-journalist-threats-survey-2026.pdf
In conjunction with the release of the report, I've also added a new "Threats" category to DataBreaches.net.
You can also read some overview comments from Zack at
https://this.weekinsecurity.com/new-survey-reveals-how-security-researchers-and-journalists-experience-legal-and-criminal-threats/
My post explaining how this all started is at https://databreaches.net/2026/02/02/threats-results-of-a-pilot-survey-on-threats-and-a-new-category-on-databreaches-net/
#cybersecurity #securityresearch #legalthreats #threats #criminals #databreach #vulernabilities #malware #lawsuit #survey
@zackwhittaker @campuscodi @amvinfe @jgreig @dangoodin @GossiTheDog @lawrenceabrams @euroinfosec
GlassWorm has resurfaced with 24 malicious extensions posing as popular developer tools across Visual Studio Marketplace and Open VSX. The campaign uses Rust implants, Solana-based C2, and inflated download stats to slip harmful updates into trusted environments.
This wave shows how supply-chain attacks continue evolving by blending seamlessly into developer workflows.
What protections do you think dev ecosystems should prioritize next?
Follow us for consistent, unbiased cybersecurity coverage.
#infosec #glassworm #supplychainsecurity #devsecops #vscode #openvsx #malware #threatintel #securityresearch #technadu
GlassWorm has resurfaced with 24 malicious extensions posing as popular developer tools across Visual Studio Marketplace and Open VSX. The campaign uses Rust implants, Solana-based C2, and inflated download stats to slip harmful updates into trusted environments.
This wave shows how supply-chain attacks continue evolving by blending seamlessly into developer workflows.
What protections do you think dev ecosystems should prioritize next?
Follow us for consistent, unbiased cybersecurity coverage.
#infosec #glassworm #supplychainsecurity #devsecops #vscode #openvsx #malware #threatintel #securityresearch #technadu
No Leak, No Problem – Bypassing ASLR with a ROP Chain to Gain RCE
https://modzero.com/en/blog/no-leak-no-problem/
#HackerNews #NoLeakNoProblem #ROPChain #RCE #SecurityResearch #ASLR #Exploit
A theoretical way to circumvent Android developer verification
https://enaix.github.io/2025/10/30/developer-verification.html
#HackerNews #AndroidDevelopment #Circumvention #SecurityResearch #DeveloperVerification #HackerNews
Finding thousands of exposed Ollama instances using Shodan
https://blogs.cisco.com/security/detecting-exposed-llm-servers-shodan-case-study-on-ollama
#HackerNews#Finding#Exposed#Instances#Shodan#Ollama#Cybersecurity#SecurityResearch
🍔 Just collabed with @BobTheShoplifter on a MASSIVE SECURITY BREACH: We exposed how Restaurant Brands International (Burger King, Tim Hortons, Popeyes) left their drive-thru systems etc completely vulnerable.
🎯 What we found:
• Unauthenticated API access to ALL drive-thru locations globally
• Drive-thru voice recordings of customers accessible
• Employee PII exposed.
• Bathroom feedback systems with zero auth
• Hardcoded passwords in client-side code
The scope was insane - we could access any drive-thru system globally. Even listen to your actual drive-thru orders 👂
Credit to RBI for lightning-fast response once disclosed, but the privacy implications were staggering.
Full technical breakdown: https://bobdahacker.com/blog/rbi-hacked-drive-thrus
#InfoSec#CyberSecurity#ResponsibleDisclosure#Privacy#GDPR#API#GraphQL#SecurityResearch#VulnDisclosure#RestaurantBrands#BurgerKing#TimHortons#Popeyes #vulnerability
🍔 Just collabed with @BobTheShoplifter on a MASSIVE SECURITY BREACH: We exposed how Restaurant Brands International (Burger King, Tim Hortons, Popeyes) left their drive-thru systems etc completely vulnerable.
🎯 What we found:
• Unauthenticated API access to ALL drive-thru locations globally
• Drive-thru voice recordings of customers accessible
• Employee PII exposed.
• Bathroom feedback systems with zero auth
• Hardcoded passwords in client-side code
The scope was insane - we could access any drive-thru system globally. Even listen to your actual drive-thru orders 👂
Credit to RBI for lightning-fast response once disclosed, but the privacy implications were staggering.
Full technical breakdown: https://bobdahacker.com/blog/rbi-hacked-drive-thrus
#InfoSec#CyberSecurity#ResponsibleDisclosure#Privacy#GDPR#API#GraphQL#SecurityResearch#VulnDisclosure#RestaurantBrands#BurgerKing#TimHortons#Popeyes #vulnerability
Finding thousands of exposed Ollama instances using Shodan
https://blogs.cisco.com/security/detecting-exposed-llm-servers-shodan-case-study-on-ollama
#HackerNews#Finding#Exposed#Instances#Shodan#Ollama#Cybersecurity#SecurityResearch