## exploits - 23andMe

[23andMe says user data stolen in credential stuffing attack | Hacker News](https://news.ycombinator.com/item?id=37794379)
[Genetics firm 23andMe says user data stolen in credential stuffing attack](https://www.bleepingcomputer.com/news/security/genetics-firm-23andme-says-user-data-stolen-in-credential-stuffing-attack/)

[Cybercriminals Obtain and Sell Sensitive Genetic Data from 23andMe | National Review](https://www.nationalreview.com/news/cybercriminals-obtain-and-sell-sensitive-genetic-data-from-23andme/)

[Hacker leaks millions more 23andMe user records on cybercrime forum | Hacker News](https://news.ycombinator.com/item?id=37931383)
[Hacker leaks millions more 23andMe user records on cybercrime forum | TechCrunch](https://techcrunch.com/2023/10/18/hacker-leaks-millions-more-23andme-user-records-on-cybercrime-forum/)

[23andMe confirms hackers stole ancestry data on 6.9M users | Hacker News](https://news.ycombinator.com/item?id=38527965)
[23andMe confirms hackers stole ancestry data on 6.9 million users | TechCrunch](https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/)
.
[23andMe changed its terms of service to prevent hacked customers from suing | Hacker News](https://news.ycombinator.com/item?id=38613386)
[23andMe frantically changed its terms of service to prevent hacked customers from suing](https://www.engadget.com/23andme-frantically-changed-its-terms-of-service-to-prevent-hacked-customers-from-suing-152434306.html)

[23andMe's Fall | Hacker News](https://news.ycombinator.com/item?id=39202583)
[23andMe's Fall From $6 Billion to Nearly $0 - WSJ](https://www.wsj.com/health/healthcare/23andme-anne-wojcicki-healthcare-stock-913468f4)

## exploits - a16z

[Researcher finds flaw in a16z website that exposed some company data | Hacker News](https://news.ycombinator.com/item?id=41016768)
[how to pwn a billion dollar vc firm using inspect element - eva's site](https://www.kibty.town/blog/a16z/)

## exploits - Adobe

[Adobe warns of critical Colfdusion RCE bug exploited in attacks](https://www.bleepingcomputer.com/news/security/adobe-warns-of-critical-colfdusion-rce-bug-exploited-in-attacks/)

## exploits - airlines

[A mysterious voice is haunting American Airlines' in-flight announcements | Hacker News](https://news.ycombinator.com/item?id=32958319)
[A mysterious voice is haunting American Airlines' in-flight announcements and nobody knows how - Waxy.org](https://waxy.org/2022/09/a-mysterious-voice-is-haunting-american-airlines-in-flight-announcements-and-nobody-knows-how/)

[Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform](https://old.reddit.com/r/netsec/comments/15hynnj/leaked_secrets_and_unlimited_miles_hacking_the/)

## exploits - Amazon

[Infosys leaked FullAdminAccess AWS keys on PyPI for over a year | Hacker News](https://news.ycombinator.com/item?id=33628562)
[Infosys leaked FullAdminAccess AWS keys on PyPi for over a year](https://tomforb.es/infosys-leaked-fulladminaccess-aws-keys-on-pypi-for-over-a-year/)

## exploits - Android

[New Android security flaw lets hackers seize control of apps — how to stay safe | Tom's Guide](https://www.tomsguide.com/computing/malware-adware/new-android-security-flaw-lets-hackers-seize-control-of-apps-uninstall-these-immediately)

[India warns of malware attacks targeting its Android users | TechCrunch](https://techcrunch.com/2023/09/05/india-advisory-dogerat-malware-android-users/)

## exploits - Apple

[A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution | Hacker News](https://news.ycombinator.com/item?id=29568625)
[Project Zero: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution](https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html)

[goto fail;](https://gotofail.com)

[Disclosure of three 0-day iOS vulnerabilities | Hacker News](https://news.ycombinator.com/item?id=28637276)
[Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program / Habr](https://web.archive.org/web/20211013020752/https://habr.com/en/post/579714/)

[NSO Group iMessage Zero-Click Exploit Captured in the Wild | Hacker News](https://news.ycombinator.com/item?id=28516095)
[FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild - The Citizen Lab](https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/)
[Journalists Hacked with Suspected NSO Group iMessage 'Zero-Click' Exploit | Hacker News](https://news.ycombinator.com/item?id=25489298)
[The Great iPwn: Journalists Hacked with Suspected NSO Group iMessage 'Zero-Click' Exploit - The Citizen Lab](https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/)

[Delays aren't good enough - Apple must abandon its surveillance plans | Hacker News](https://news.ycombinator.com/item?id=28411918)
[Delays Aren't Good Enough-Apple Must Abandon Its Surveillance Plans | Electronic Frontier Foundation](https://www.eff.org/deeplinks/2021/09/delays-arent-good-enough-apple-must-abandon-its-surveillance-plans)

[Air-Gap Attack Turns Memory Modules into Wi-Fi Radios | Threatpost](https://threatpost.com/air-gap-attack-turns-memory-wifi/162358)
[ThreatPost](https://threatpost.com/)
Security News

[About the security content of iOS 14.7.1 and iPadOS 14.7.1 | Hacker News](https://news.ycombinator.com/item?id=27962761)
[About the security content of iOS 14.7.1 and iPadOS 14.7.1 - Apple Support](https://support.apple.com/en-us/103145)

[Hackers release a new jailbreak tool for almost every iPhone | TechCrunch](https://techcrunch.com/2021/03/01/hackers-unc0ver-jailbreak-iphone)

[We Hacked Apple for 3 Months | Hacker News](https://news.ycombinator.com/item?id=24718078)
[We Hacked Apple for 3 Months: Here's What We Found | Sam Curry](https://samcurry.net/hacking-apple/)

[Zero-day in Sign in with Apple | Hacker News](https://news.ycombinator.com/item?id=23362149)
[Zero-day in Sign in with Apple | bhavukjain1](https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/)

[M1racles: An Apple M1 covert channel vulnerability | Hacker News](https://news.ycombinator.com/item?id=27285700)
[M1RACLES: M1ssing Register Access Controls Leak EL0 State](https://m1racles.com/)

[Apple apps on Big Sur bypass some firewalls and VPNs | Hacker News](https://news.ycombinator.com/item?id=25109724)
[Apple apps on Big Sur bypass firewalls and VPNs - this is terrible](https://thenextweb.com/news/apple-apps-on-big-sur-bypass-firewalls-vpns-analysis-macos)

[Bypassing Firewalls in macOS Big Sur | Hacker News](https://news.ycombinator.com/item?id=25095972)
[Patrick Wardle on X: "In Big Sur Apple decided to exempt many of its apps from being routed thru the frameworks they now require 3rd-party firewalls to use (LuLu, Little Snitch, etc.) 🧐 Q: Could this be (ab)used by malware to also bypass such firewalls? 🤔 A: Apparently yes, and trivially so 😬😱😭 https://t.co/CCNcnGPFIB" / X](https://twitter.com/patrickwardle/status/1327726496203476992)

[Apple's T2 security chip jailbreak | Hacker News](https://news.ycombinator.com/item?id=24636166)
[Hackers jailbreak Apple's T2 security chip powered by bridgeOS - Report Cyber Crime](https://web.archive.org/web/20200930065005/https://reportcybercrime.com/hackers-jailbreak-apples-t2-security-chip-powered-by-bridgeos/)

[A deep dive into iOS Exploit chains found in the wild | Hacker News](https://news.ycombinator.com/item?id=20835223)
[Project Zero: A very deep dive into iOS Exploit chains found in the wild](https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html)

[Apple targeted in $50 million ransomware attack resulting in unprecedented schematic leaks - The Verge](https://www.theverge.com/2021/4/21/22396283/apple-schematics-leak-ransomware-quanta-supplier-leak)

[Use Touch ID for Sudo on Mac | Hacker News](https://news.ycombinator.com/item?id=26302139)
[Use Touch ID for sudo on Mac](https://davidwalsh.name/touch-sudo)
[Quick Tip: Enable Touch ID for Sudo (2020) | Hacker News](https://news.ycombinator.com/item?id=31750560)
[Quick Tip: Enable Touch ID for sudo - Six Colors](https://sixcolors.com/post/2020/11/quick-tip-enable-touch-id-for-sudo/)

[Zero click vulnerability in Apple's macOS Mail | Hacker News](https://news.ycombinator.com/item?id=26664714)
[Zero click vulnerability in Apple's macOS Mail | by Mikko Kenttälä | Medium](https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c)

[Exploiting the iPhone 4 | Hacker News](https://news.ycombinator.com/item?id=37736318)
[Exploiting the iPhone 4, Part 1: Gaining Entry | Phillip Tennen](https://axleos.com/exploiting-the-iphone-4-part-1-gaining-entry/)

[iLeakage: Browser-Based Timerless Speculative Execution Attacks on Apple Devices | Hacker News](https://news.ycombinator.com/item?id=38015277)
[iLeakage](https://ileakage.com/)

[Brute-forcing a macOS user's real name from a browser using mDNS | Hacker News](https://news.ycombinator.com/item?id=36712788)
[Demo: Brute-forcing a macOS user's real name from a browser using mDNS](https://fingerprint.com/blog/apple-macos-mdns-brute-force/)

[GitHub - JordanEJ/KFD-Projects: A List of iOS KFD Projects](https://github.com/JordanEJ/KFD-Projects)

[Uninstall the NightOwl app | Hacker News](https://news.ycombinator.com/item?id=37052508)
[Uninstall the Nightowl App, now.](https://robins.one/notes/uninstall-the-nightowl-app-now.html)

[SiriSpy - iOS bug allowed apps to eavesdrop on your conversations with Siri | Hacker News](https://news.ycombinator.com/item?id=33348013)
[SiriSpy - iOS bug allowed apps to eavesdrop on your conversations with Siri | Rambo Codes](https://rambo.codes/posts/2022-10-25-sirispy-ios-bug-allowed-apps-to-eavesdrop)

[Breaking all macOS security layers with a single vulnerability | Hacker News](https://news.ycombinator.com/item?id=32464034)
[Process injection: breaking all macOS security layers with a single vulnerability · Sector 7](https://sector7.computest.nl/post/2022-08-process-injection-breaking-all-macos-security-layers-with-a-single-vulnerability/)

[iPhone flaw exploited by second Israeli spy firm | Hacker News](https://news.ycombinator.com/item?id=30192743)
[EXCLUSIVE iPhone flaw exploited by second Israeli spy firm-sources | Reuters](https://web.archive.org/web/20220710054327/https://www.reuters.com/technology/exclusive-iphone-flaw-exploited-by-second-israeli-spy-firm-sources-2022-02-03/)

[Techniques used by developers to bypass App Store review | Hacker News](https://news.ycombinator.com/item?id=41146779)
[How developers trick App Store into approving malicious apps](https://9to5mac.com/2024/08/02/developers-trick-app-store-review/)

## exploits - AOL

[155: Search History - explain xkcd](https://www.explainxkcd.com/wiki/index.php/155:_Search_History)

## exploits - Atlassian Confluence

[Zero-Day Exploitation of Atlassian Confluence | Hacker News](https://news.ycombinator.com/item?id=31602288)
[Zero-Day Exploitation of Atlassian Confluence | Volexity](https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/)

[US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing | Hacker News](https://news.ycombinator.com/item?id=28431838)
[US Cybercom says mass exploitation of Atlassian Confluence vulnerability 'ongoing and expected to accelerate' | ZDNET](https://www.zdnet.com/article/us-cybercom-says-mass-exploitation-of-atlassian-confluence-vulnerability-ongoing-and-expected-to-accelerate/)

## exploits - ATT

[Hackers Steal Phone, SMS Records for Nearly All AT&T Customers | Hacker News](https://news.ycombinator.com/item?id=40948035)
[Crooks Steal Phone, SMS Records for Nearly All AT&T Customers – Krebs on Security](https://krebsonsecurity.com/2024/07/hackers-steal-phone-sms-records-for-nearly-all-att-customers/)

[AT&T says criminals stole phone records of 'nearly all' customers in data breach | Hacker News](https://news.ycombinator.com/item?id=40944505)
[AT&T says criminals stole phone records of 'nearly all' customers in new data breach | TechCrunch](https://techcrunch.com/2024/07/12/att-phone-records-stolen-data-breach/)

## exploits - auto dealerships

[Car dealerships revert to pens and paper after cyberattacks on software provider | Hacker News](https://news.ycombinator.com/item?id=40776951)
[Car dealerships in North America revert to pens, paper after cyberattacks | AP News](https://apnews.com/article/car-dealerships-cyberattack-cdk-outage-3f7c81f6be0e212172b33cdc9f49feba)

## exploits - autos

[Remotely unlock/start/locate any remotely connected Honda/Nissan [resolved] | Hacker News](https://news.ycombinator.com/item?id=33831127)
[Sam Curry on X: "More car hacking! Earlier this year, we were able to remotely unlock, start, locate, flash, and honk any remotely connected Honda, Nissan, Infiniti, and Acura vehicles, completely unauthorized, knowing only the VIN number of the car. Here's how we found it, and how it works: https://t.co/ul3A4sT47k" / X](https://twitter.com/samwcyo/status/1597792097175674880)

[Someone hacked YandexTaxi and ordered all available taxis to the same location | Hacker News](https://news.ycombinator.com/item?id=32681012)
[Russian Market on X: "Someone hacked #YandexTaxi and ordered all available taxis to Kutuzov Prospect in Moscow Now there is a huge traffic jam with taxis. It's like James Bond movie. https://t.co/IatuAEtA2i" / X](https://twitter.com/runews/status/1565319649683804160)

[Toyota: Car location data and videos of 2M customers exposed for ten years | Hacker News](https://news.ycombinator.com/item?id=35919133)
[Toyota: Car location data of 2 million customers exposed for ten years](https://www.bleepingcomputer.com/news/security/toyota-car-location-data-of-2-million-customers-exposed-for-ten-years/)

## exploits - BGP

[Possible BGP hijack | Hacker News](https://news.ycombinator.com/item?id=30561518)
[BGPStream Event #287556](https://web.archive.org/web/20220305090011/https://bgpstream.com/event/287556)

## exploits - China

[Billion-record stolen Chinese database for sale on breach forum | Hacker News](https://news.ycombinator.com/item?id=31986441)
[Database stolen from Shanghai Police for sale on the darkweb • The Register](https://www.theregister.com/2022/07/05/shanghai_police_database_for_sell/)

## exploits - CircleCI

[CircleCI says hackers stole encryption keys and customers' source code | Hacker News](https://news.ycombinator.com/item?id=34386017)
[CircleCI says hackers stole encryption keys and customers' secrets | TechCrunch](https://techcrunch.com/2023/01/14/circleci-hackers-stole-customer-source-code/)
[CI2Go](https://github.com/ngs/ci2go)
For [Continuous Integration and Delivery - CircleCI](https://circleci.com/)

## exploits - Cloudflare

[Cloudflare lobbied FTC to stifle security researchers | Hacker News](https://news.ycombinator.com/item?id=32704598)
[Tavis Ormandy on X: "@k8em0 True story: After cloudbleed, cloudflare literally lobbied the FTC to investigate me and question the legality of openly discussing security research. How come they're not lobbying their DC friends to investigate the legality KF? 🤷 ♂️" / X](https://twitter.com/taviso/status/1566077115992133634)

## exploits - colleges

[California Community College Overrun With 'Fake Students, Bots': Whistleblower](https://www.theepochtimes.com/california-community-college-overrun-with-fake-students-bots-whistleblower_4092548.html)

[Security Breach at US Universities | Hacker News](https://news.ycombinator.com/item?id=26656759)
[Massive security breach at US universities.](https://web.archive.org/web/20210401025955/https://dorper.me/articles/unileak.aspx)

## exploits community

[Exploitee.rs](https://www.exploitee.rs)

[Best hacking forums ? : Hacking_Tutorials](https://old.reddit.com/r/Hacking_Tutorials/comments/mlpooe/best_hacking_forums)

## exploits - Conti

[Conti ransomware gang's internal chats leaked online after declaring support for Russian invasion | TechCrunch](https://techcrunch.com/2022/02/28/conti-ransomware-chats-leaked)

## exploits - credit cards

[How I Stopped a Credit Card Thief From Ripping Off 3,537 People - and Saved Our Nonprofit in the Process](https://www.freecodecamp.org/news/stopping-credit-card-fraud-and-saving-our-nonprofit)

[More than 50,000 Australians affected in charity data breach, credit card data stolen](https://www.abc.net.au/news/2023-08-27/australian-charities-impacted-by-pareto-phone-data-breach/102777740)

[The underground world of credit card network exploitation | Hacker News](https://news.ycombinator.com/item?id=36971888)
[How I discovered the underground world of credit card network exploitation | ChargebackStop.com](https://www.chargebackstop.com/blog/card-networks-exploitation)

## exploits - Crema Finance

[Explained: The Crema Finance Hack (July 2022) : hacking](https://old.reddit.com/r/hacking/comments/w317y0/explained_the_crema_finance_hack_july_2022)

## exploits - Disney

[Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data | Hacker News](https://news.ycombinator.com/item?id=40955693)
[Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data](https://hackread.com/disneys-internal-slack-breached-nullbulge-leak-data/)

## exploits - Dominion

[Explainer: Dominion vulns reported by Halderman](https://cybersect.substack.com/p/explainer-dominion-vulns-reported)

## exploits - Epik

[EPIK Cheap Domain Names, Hosting, Domaining & more!](https://www.epik.com/)

[Anonymous Hacks Epik | Hacker News](https://news.ycombinator.com/item?id=28532464)
[Anonymous Presents: Operation Epik Fail](https://web.archive.org/web/20210914153259/https://4chan.partyvan.epikfail.win:55899/)

## exploits - Experian

[Identity thieves bypassed Experian security to view credit reports | Hacker News](https://news.ycombinator.com/item?id=34310522)
[Identity Thieves Bypassed Experian Security to View Credit Reports - Krebs on Security](https://krebsonsecurity.com/2023/01/identity-thieves-bypassed-experian-security-to-view-credit-reports/)
[It's still easy for anyone to become you at Experian | Hacker News](https://news.ycombinator.com/item?id=38232767)
[It's Still Easy for Anyone to Become You at Experian - Krebs on Security](https://krebsonsecurity.com/2023/11/its-still-easy-for-anyone-to-become-you-at-experian/)
[Experian's credit freeze security is still a joke | Hacker News](https://news.ycombinator.com/item?id=26948814)
[Experian's Credit Freeze Security is Still a Joke - Krebs on Security](https://krebsonsecurity.com/2021/04/experians-credit-freeze-security-is-still-a-joke/)

## exploits - FedEx

[Thanks FedEx, this is why we keep getting phished | Hacker News](https://news.ycombinator.com/item?id=39479001)
[Troy Hunt: Thanks FedEx, This is Why we Keep Getting Phished](https://www.troyhunt.com/thanks-fedex-this-is-why-we-keep-getting-phished/)

## exploits - Flatpak

[Flatpak](https://flatpak.org/)
Create & Distribute Linux Applications
[FlatPak](http://flatpak.org/getting)
Standalone apps for Linux are here!

[Flatpak: A security nightmare - two years later | Hacker News](https://news.ycombinator.com/item?id=24661126)
[Flatpak - a security nightmare](https://www.flatkill.org/2020/)

[Ubuntu stops shipping Flatpak by default | Hacker News](https://news.ycombinator.com/item?id=35354729)
[Ubuntu stops shipping Flatpak by default [LWN.net]](https://lwn.net/Articles/927262/)

## exploits - gas pumps

[Gas pumps happen to be about as insecure as your typical router | Hacker News](https://news.ycombinator.com/item?id=30733337)
[How did thieves steal 400 gallons of gas in High Point? It's apparently easy](https://myfox8.com/news/north-carolina/high-point/its-apparently-easy-to-bypass-a-gas-pump-and-steal-400-gallons-or-more/)

## exploits - git

[Git security vulnerability announced | Hacker News](https://news.ycombinator.com/item?id=31009675)
[Git security vulnerability announced - The GitHub Blog](https://github.blog/2022-04-12-git-security-vulnerability-announced/)

[Git security vulnerabilities announced | Hacker News](https://news.ycombinator.com/item?id=34417103)
[Git security vulnerabilities announced - The GitHub Blog](https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2/)

[Git: Malicious repositories can execute remote code while cloning | Hacker News](https://news.ycombinator.com/item?id=26404830)
[oss-security - git: malicious repositories can execute remote code while cloning](https://www.openwall.com/lists/oss-security/2021/03/09/3)

[Gitlab servers are being exploited in DDoS attacks | Hacker News](https://news.ycombinator.com/item?id=29112713)
[GitLab servers are being exploited in DDoS attacks in excess of 1 Tbps](https://therecord.media/gitlab-servers-are-being-exploited-in-ddos-attacks-in-excess-of-1-tbps)

## exploits - Google

[Google Caught Hackers Using a Mac Zero-Day Against Hong Kong Users](https://www.vice.com/en/article/93bw8y/google-caught-hackers-using-a-mac-zero-day-against-hong-kong-users)

[The mermaid is taking over Google search in Norway | Hacker News](https://news.ycombinator.com/item?id=27991322)
[The mermaid is taking over Google search in Norway - ALEXSKRA](https://alexskra.com/blog/the-mermaid-is-taking-over-google-search-in-norway/)

[The unexpected Google wide domain check bypass | Hacker News](https://news.ycombinator.com/item?id=22527842)
[The unexpected Google wide domain check bypass - bugs.xdavidhu.me](https://bugs.xdavidhu.me/google/2020/03/08/the-unexpected-google-wide-domain-check-bypass/)

[Google Compute Engine VM takeover via DHCP flood | Hacker News](https://news.ycombinator.com/item?id=27673933)
[irsl/gcp-dhcp-takeover-code-exec: Google Compute Engine (GCE) VM takeover via DHCP flood - gain root access by getting SSH keys added by google_guest_agent](https://github.com/irsl/gcp-dhcp-takeover-code-exec)

[Remote code execution vulnerability in Google they are not willing to fix | Hacker News](https://news.ycombinator.com/item?id=35581532)
[Remote Code Execution Vulnerability in Google They Are Not Willing To Fix](https://giraffesecurity.dev/posts/google-remote-code-execution/)

[Hackers discover way to access Google accounts without a password | The Independent](https://www.independent.co.uk/tech/google-account-password-hack-b2476002.html)

[HACKING GOOGLE - YouTube](https://www.youtube.com/playlist?list=PL590L5WQmH8dsxxz7ooJAgmijwOz0lh2H)
[Hacking Google | Hacker News](https://news.ycombinator.com/item?id=33041733)
[H4CK1NG G00GL3](https://h4ck1ng.google/)

[Accidental Google Pixel Lock Screen Bypass | Hacker News](https://news.ycombinator.com/item?id=33544883)
[Accidental $70k Google Pixel Lock Screen Bypass - bugs.xdavidhu.me](https://bugs.xdavidhu.me/google/2022/11/10/accidental-70k-google-pixel-lock-screen-bypass/)

[Google Cloud Build bug lets hackers launch supply chain attacks](https://www.bleepingcomputer.com/news/security/google-cloud-build-bug-lets-hackers-launch-supply-chain-attacks/)

[11 million devices infected with botnet malware hosted in Google Play | Ars Technica](https://arstechnica.com/security/2024/09/11-million-devices-infected-with-botnet-malware-hosted-in-google-play/)

## exploits - governments - other

[Six Palestinian organizations hacked with NSO Group's Pegasus Spyware | Hacker News](https://news.ycombinator.com/item?id=29147564)
[Six Palestinian human rights defenders hacked with NSO Group's Pegasus Spyware | Front Line Defenders](https://www.frontlinedefenders.org/en/statement-report/statement-targeting-palestinian-hrds-pegasus)

[Meduza co-founder's phone infected with Pegasus | Hacker News](https://news.ycombinator.com/item?id=37496589)
[The million-dollar reporter How attackers hijacked the phone of Meduza co-founder Galina Timchenko, making her the first Russian journalist to be infected with Pegasus spyware - Meduza](https://meduza.io/en/feature/2023/09/13/the-million-dollar-reporter)

[UK Government Officials Infected with Pegasus | Hacker News](https://news.ycombinator.com/item?id=31075558)
[UK Government Officials Infected with Pegasus - The Citizen Lab](https://citizenlab.ca/2022/04/uk-government-officials-targeted-pegasus/)

[How I hijacked the top-level domain of a sovereign state - Detectify Labs](https://labs.detectify.com/2021/01/15/how-i-hijacked-the-top-level-domain-of-a-sovereign-state)

[Another Chinese Hacking Group Spotted Targeting Ukraine Amid Russia Invasion](https://thehackernews.com/2022/03/another-chinese-hacking-group-spotted.html)

[The Central Bank of Russian Federation leak (28 GB) has been published by Anonymous : hacking](https://old.reddit.com/r/hacking/comments/tof58m/the_central_bank_of_russian_federation_leak_28_gb)

[Egyptian presidential hopeful targeted by Predator spyware - The Washington Post](https://www.washingtonpost.com/investigations/2023/09/23/predator-egypt-hack-spyware-iphone/)

[CatalanGate: Spyware operation against Catalans using Pegasus and Candiru | Hacker News](https://news.ycombinator.com/item?id=31069422)
[CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru - The Citizen Lab](https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/)

[Canada's tax revenue agency tries to ToS itself out of hacking liability | Hacker News](https://news.ycombinator.com/item?id=35072517)
[Risky Biz News: Canada's tax revenue agency tries to ToS itself out of hacking liability](https://riskybiznews.substack.com/p/risky-biz-news-canadas-tax-revenue)

[Turkish citizens' personal data offered online after government site hacked | Hacker News](https://news.ycombinator.com/item?id=36261411)
[Turkish Citizens' Personal Data Offered Online After Govt Site Hacked | Balkan Insight](https://balkaninsight.com/2023/06/09/turkish-citizens-personal-data-offered-online-after-govt-site-hacked/)

[Aadhaar details of 81.5 cr people leaked in India's 'biggest' data breach - Hindustan Times](https://www.hindustantimes.com/technology/in-indias-biggest-data-breach-personal-information-of-81-5-crore-people-leaked-101698719306335.html)
[The World's Largest Biometric Digital ID System, India's Aadhaar, Just Suffered Its Biggest Ever Data Breach - David Icke](https://davidicke.com/2023/11/06/the-worlds-largest-biometric-digital-id-system-indias-aadhaar-just-suffered-its-biggest-ever-data-breach/)

## exploits - governments - US

[Classified tank specs leaked on War Thunder game forums again | Hacker News](https://news.ycombinator.com/item?id=28822055)
[Classified tank specs leaked on War Thunder game forums - again](https://ukdefencejournal.org.uk/classified-tank-specs-leaked-on-war-thunder-game-forums-again/)

[Ransomware gang threatens to expose police informants if ransom is not paid - The Record from Recorded Future News](https://therecord.media/ransomware-gang-threatens-to-expose-police-informants-if-ransom-is-not-paid)

[U.S. to give ransomware hacks similar priority as terrorism, official says | Hacker News](https://news.ycombinator.com/item?id=27387110)
[Exclusive: U.S. to give ransomware hacks similar priority as terrorism | Reuters](https://www.reuters.com/technology/exclusive-us-give-ransomware-hacks-similar-priority-terrorism-official-says-2021-06-03/)

[US passes emergency waiver over fuel pipeline cyber-attack | Hacker News](https://news.ycombinator.com/item?id=27101092)
[US fuel pipeline hackers 'didn't mean to create problems' - BBC News](https://www.bbc.com/news/business-57050690)

[Chinese hackers breached State, Commerce Depts, Microsoft and US say](https://www.reuters.com/technology/chinese-hackers-accessed-government-emails-microsoft-says-2023-07-12/)

[Major Louisiana DMV Hack | Hacker News](https://news.ycombinator.com/item?id=36351185)
[Major Cyber Attack at OMV Vendor, Louisianans Should Act Urgently to Protect Their Identities | Office of Governor John Bel Edwards](https://web.archive.org/web/20230621034655/https://gov.louisiana.gov/index.cfm/newsroom/detail/4158)

## exploits - governments - US - surveillance agencies

[U.S. State Department phones hacked with Israeli company spyware | Hacker News](https://news.ycombinator.com/item?id=29432276)
[U.S. State Department phones hacked with Israeli company spyware - sources | Reuters](https://www.reuters.com/technology/exclusive-us-state-department-phones-hacked-with-israeli-company-spyware-sources-2021-12-03/)

[Hoax email blast abused poor coding in FBI website | Hacker News](https://news.ycombinator.com/item?id=29213850)
[Hoax Email Blast Abused Poor Coding in FBI Website - Krebs on Security](https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/)

[Email from FBI Looks Odd | Hacker News](https://news.ycombinator.com/item?id=29208276)
[Email From FBI Looks Odd : sysadmin](https://old.reddit.com/r/sysadmin/comments/qsun7o/email_from_fbi_looks_odd/)

[Millions of the Pentagon's dormant IP addresses sprang to life on January 20 | Hacker News](https://news.ycombinator.com/item?id=26924883)
[The Florida mystery of dormant Pentagon IP addresses - The Washington Post](https://www.washingtonpost.com/technology/2021/04/24/pentagon-internet-address-mystery/)

[The Pentagon reportedly gave a small company control of its IP addresses to find security issues - The Verge](https://www.theverge.com/2021/4/24/22401339/pentagon-ip-addresses-security-department-defense)

['Nobody is Safe': In Wild Hacking Spree, Hackers Accessed Federal Law Enforcement Database: cybersecurity](https://www.reddit.com/r/cybersecurity/comments/11ssnb6/nobody_is_safe_in_wild_hacking_spree_hackers)

## exploits - healthcare

[BREAKING: A cyber attack is underway causing MAJOR disruptions to hospitals and healthcare across several states.](https://old.reddit.com/r/cybersecurity/comments/15icoe1/breaking_a_cyber_attack_is_underway_causing_major/)

## exploits - heartbleed bug

[Heartbleed Bug](https://heartbleed.com)

## exploits - Hetzner

[Mitigating the Hetzner/Linode XMPP.ru MitM interception incident | Hacker News](https://news.ycombinator.com/item?id=37961166)
[Mitigating the Hetzner/Linode XMPP.ru MitM interception incident](https://www.devever.net/~hl/xmpp-incident)
[Encrypted traffic interception on Hetzner and Linode targeting Jabber service | Hacker News](https://news.ycombinator.com/item?id=37955264)
[Encrypted traffic interception on Hetzner and Linode targeting the largest Russian XMPP (Jabber) messaging service -](https://notes.valdikss.org.ru/jabber.ru-mitm/)

## exploits - HN

[How we hack Hacker News and consistently hit the front page | Hacker News](https://news.ycombinator.com/item?id=35929794)
[How to hack Hacker News (and consistently hit the front page)](https://www.indiehackers.com/post/how-to-hack-hacker-news-and-consistently-hit-the-front-page-56b4a04e12)

## exploits - Honda

[Vulnerability in Honda's Remote Keyless System | Hacker News](https://news.ycombinator.com/item?id=30804702)
[nonamecoder/CVE-2022-27254: PoC for vulnerability in Honda's Remote Keyless System(CVE-2022-27254)](https://github.com/nonamecoder/CVE-2022-27254)

## exploits - HP

[Hundreds of HP printer models vulnerable to remote code execution](https://www.bleepingcomputer.com/news/security/hundreds-of-hp-printer-models-vulnerable-to-remote-code-execution)

## exploits - HTTP-2

[HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks | Hacker News](https://news.ycombinator.com/item?id=37830998)
[The Cloudflare Blog](https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/)
[The novel HTTP/2 'Rapid Reset' DDoS attack | Hacker News](https://news.ycombinator.com/item?id=37830987)
[How it works: The novel HTTP/2 'Rapid Reset' DDoS attack | Google Cloud Blog](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)

[The largest DDoS attack to date, peaking above 398M rps | Hacker News](https://news.ycombinator.com/item?id=37831062)
[Google Cloud mitigated largest DDoS attack, peaking above 398 million rps | Google Cloud Blog](https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/)

[HTTP/2 Rapid Reset: deconstructing the record-breaking attack | Hacker News](https://news.ycombinator.com/item?id=37831004)
[The Cloudflare Blog](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)

[Internet companies report biggest-ever denial of service operation | Reuters](https://www.reuters.com/technology/internet-companies-report-biggest-ever-denial-service-operation-2023-10-11/)

## exploits - Instagram

[How I Could Have Hacked Any Instagram Account - The Zero Hack](https://thezerohack.com/hack-any-instagram)

## exploits - insurance

[Hacking into an insurance company by exploiting their premium calculator | Hacker News](https://news.ycombinator.com/item?id=39030302)
[Hacking into a Toyota/Eicher Motors insurance company by exploiting their premium calculator website](https://eaton-works.com/2024/01/17/ttibi-email-hack/)

## exploits - Intel+AMD

[Retbleed: New speculative execution attack sends Intel and AMD scrambling | Hacker News](https://news.ycombinator.com/item?id=32071949)
[New working speculative execution attack sends Intel and AMD scrambling | Ars Technica](https://arstechnica.com/information-technology/2022/07/intel-and-amd-cpus-vulnerable-to-a-new-speculative-execution-attack/)

## exploits - Intel

[Intel CPUs are leaking passwords and killing performance | Digital Trends](https://www.digitaltrends.com/computing/downfall-vulnerability-intel-cpus-are-leaking-passwords/)

[ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs | Hacker News](https://news.ycombinator.com/item?id=19911341)
[ZombieLoad: Cross Privilege-Boundary Data Leakage - Cyberus Technology](https://cyberus-technology.de/articles/zombieload)

[ZombieLoad Attack](https://zombieloadattack.com/)

[Downfall data-leak vulnerability found in Intel processors](https://www.theregister.com/2023/08/09/google_intel_downfall/)

[Downfall Attacks | Hacker News](https://news.ycombinator.com/item?id=37052586)
[Downfall](https://downfall.page/)

[Intel DOWNFALL: New Vulnerability Affecting AVX2/AVX-512 With Big Performance Implications](https://old.reddit.com/r/hardware/comments/15lnwre/intel_downfall_new_vulnerability_affecting/)

[Zenbleed | Hacker News](https://news.ycombinator.com/item?id=36848680)
[Zenbleed](https://lock.cmpxchg8b.com/zenbleed.html)

## exploits - keyboard encryption

["Please do not make it public": Vulnerabilities in Sogou Keyboard encryption expose keypresses to network eavesdropping - The Citizen Lab](https://citizenlab.ca/2023/08/vulnerabilities-in-sogou-keyboard-encryption/)
[The Citizen Lab Targeted Threats](https://citizenlab.ca/category/research/targeted-threats)
[Security Planner (CitizenLab)](https://securityplanner.org/)
Answer a few simple questions to get personalized online safety recommendations. It's confidential - no personal information is stored and CitizenLab won't access any of your online accounts. - free

## exploits - LastPass

[LastPass says DevOps engineer's hacked computer led to security breach in 2022 | Hacker News](https://news.ycombinator.com/item?id=34965260)
[LastPass says engineer's hacked computer led to security breach](https://9to5mac.com/2023/02/27/lastpass-devops-engineers-hacked/)

[The situation at LastPass may be worse than they are letting on | Hacker News](https://news.ycombinator.com/item?id=34111880)
[path.eth 🛡️ on X: "I think the situation at @LastPass may be worse than they are letting on. On Sunday the 18th, four of my wallets were compromised. The losses are not significant. Their seeds were kept, encrypted, in my lastpass vault, behind a 16 character password using all character types." / X](https://twitter.com/cryptopathic/status/1606416137771782151)

[LastPass breach gets worse | Hacker News](https://news.ycombinator.com/item?id=34516275)
[LastPass breach gets worse : sysadmin](https://old.reddit.com/r/sysadmin/comments/10kp4ye/lastpass_breach_gets_worse/)

[What's in a PR statement: LastPass breach explained | Hacker News](https://news.ycombinator.com/item?id=34147977)
[What's in a PR statement: LastPass breach explained | Almost Secure](https://palant.info/2022/12/26/whats-in-a-pr-statement-lastpass-breach-explained/)

[LastPass Breach and Alternatives - b3n.org](https://b3n.org/lastpass-breach-and-alternatives)

[Lastpass Security Incident | Hacker News](https://news.ycombinator.com/item?id=33806803)
[LastPass user vaults stolen in recent hack | Hacker News](https://news.ycombinator.com/item?id=34097142)
[Security Incident December 2022 Update - LastPass](https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/)

[I worked at LastPass as an engineer | Hacker News](https://news.ycombinator.com/item?id=34125790)
[evan j on Twitter: "I worked at LastPass as an engineer a long time ago. 7+ years ago. My 2 cents on the situation. This is the worst breach LastPass has had. By a lot. The key difference is that customer vaults were accessed this time, which are kept in a completely separate database. 1/x" / Twitter](https://web.archive.org/web/20221230031029/https://twitter.com/ejcx_/status/1606428769731878913)

[Ask HN: How did my LastPass master password get leaked? | Hacker News](https://news.ycombinator.com/item?id=29705957)

[How did LastPass master passwords get compromised? | Hacker News](https://news.ycombinator.com/item?id=29735132)
[How did LastPass master passwords get compromised? | Almost Secure](https://palant.info/2021/12/29/how-did-lastpass-master-passwords-get-compromised/)

[LastPass users warned their master passwords are compromised | Hacker News](https://news.ycombinator.com/item?id=29716715)
[LastPass users warned their master passwords are compromised](https://www.bleepingcomputer.com/news/security/lastpass-users-warned-their-master-passwords-are-compromised/)

[Private Equity Gave Your Bank Password to Hackers](https://mattstoller.substack.com/p/private-equity-gave-your-bank-password)

[LastPass security issues](https://en.wikipedia.org/wiki/LastPass#Security_issues)

[LastPass appears to be holding users' passwords hostage | Hacker News](https://news.ycombinator.com/item?id=29895161)
[LastPass appears to be holding users' passwords hostage alongside more expensive pricing plans | AlternativeTo](https://alternativeto.net/news/2022/1/lastpass-seemingly-deliberately-holding-users-password-data-hostage-alongside-new-pricing-plans/)

## exploits - Linux

[No support Linux hosting shutting down from hack | Hacker News](https://news.ycombinator.com/item?id=26076050)
[No Support Linux Hosting - cPanel Powered Linux Web Hosting](https://web.archive.org/web/20200609094855/http://www.nosupportlinuxhosting.com/)

[An Update on the UMN Affair | Hacker News](https://news.ycombinator.com/item?id=26982309)
[An update on the UMN affair [LWN.net]](https://lwn.net/Articles/854645/)

[Let's Encrypt comes up with workaround for abandonware Android devices | Hacker News](https://news.ycombinator.com/item?id=25515703)
[Let's Encrypt comes up with workaround for abandonware Android devices | Ars Technica](https://arstechnica.com/gadgets/2020/12/lets-encrypt-comes-up-with-workaround-for-abandonware-android-devices/)

[Apt Encounters of the Third Kind | Hacker News](https://news.ycombinator.com/item?id=26591669)
[APT Encounters of the Third Kind - Igor's Blog](https://igor-blue.github.io/2021/03/24/apt1.html)

[Linux bans University of Minnesota for sending buggy patches in name of research | Hacker News](https://news.ycombinator.com/item?id=26889677)
[Linux bans University of Minnesota for sending buggy patches in the name of research [Update] - Neowin](https://www.neowin.net/news/linux-bans-university-of-minnesota-for-sending-buggy-patches-in-the-name-of-research/)

[UMN CS&E Statement on Linux Kernel Research | Hacker News](https://news.ycombinator.com/item?id=26895510)
[Statement from CS&E on Linux Kernel research - April 21, 2021 | Department of Computer Science and Engineering | College of Science and Engineering](https://cse.umn.edu/cs/statement-cse-linux-kernel-research-april-21-2021)

["They introduce kernel bugs on purpose" | Hacker News](https://news.ycombinator.com/item?id=26887670)
[Re: [PATCH] SUNRPC: Add a check for gss_release_msg - Leon Romanovsky](https://lore.kernel.org/linux-nfs/YH+zwQgBBGUJdiVK@unreal/)

[Linux has been bitten by its most high-severity vulnerability in years | Ars Technica](https://arstechnica.com/information-technology/2022/03/linux-has-been-bitten-by-its-most-high-severity-vulnerability-in-years)

[GNOME Linux systems exposed to RCE attacks via file downloads](https://www.bleepingcomputer.com/news/security/gnome-linux-systems-exposed-to-rce-attacks-via-file-downloads/)

[A bug lurking for 12 years gives attackers root on most major Linux distros | Ars Technica](https://arstechnica.com/information-technology/2022/01/a-bug-lurking-for-12-years-gives-attackers-root-on-every-major-linux-distro)

## exploits - LockBit

[The Alleged LockBit Ransomware Mastermind Has Been Identified | WIRED](https://www.wired.com/story/lockbitsupp-lockbit-ransomware/)

## exploits - Log4j - 11

[CISA releases Apache Log4j scanner to find vulnerable apps](https://www.bleepingcomputer.com/news/security/cisa-releases-apache-log4j-scanner-to-find-vulnerable-apps)

[Log4jmemes.com: for those of us that need a laugh | Hacker News](https://news.ycombinator.com/item?id=29566541)
[log4j memes](https://web.archive.org/web/20220327150846/https://log4jmemes.com/)

[TL;DR: log4j vulnerability](https://tldr.engineering/tldr-log4j-vulnerability)

[Log4j RCE Found | Hacker News](https://news.ycombinator.com/item?id=29504755)
[Log4Shell: RCE 0-day exploit found in log4j, a popular Java logging package | LunaTrace](https://www.lunasec.io/docs/blog/log4j-zero-day/)
[Log4Shell update: second Log4j vulnerability published | Hacker News](https://news.ycombinator.com/item?id=29561532)
[Log4Shell Update: Second log4j Vulnerability Published (CVE-2021-44228 + CVE-2021-45046) | LunaTrace](https://www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/)

[Third High Severity CVE in Log4j Is Published | Hacker News](https://news.ycombinator.com/item?id=29604097)
[Log4j -](https://logging.apache.org/log4j/2.x/security.html)

[A Detailed Guide on Log4J Penetration Testing - Hacking Articles](https://www.hackingarticles.in/a-detailed-guide-on-log4j-penetration-testing)
[Hacking Articles](https://www.hackingarticles.in/)
LRaj Chandel's Security & Hacking Blog.

[GitHub - hackinghippo/log4shell_ioc_ips: log4j / log4shell IoCs from multiple sources put together in one big file (IPs) more coming soon (CVE-2021-44228)](https://github.com/hackinghippo/log4shell_ioc_ips)
[Log4Shell, as explained by Metaphor and Memes! | by Jude Allred | Dev Genius](https://blog.devgenius.io/log4shell-as-explained-by-metaphor-and-memes-38de224a2eb7)

['Internet's on Fire Right Now': Millions of Devices at Risk Over New Software Vulnerability](https://www.theepochtimes.com/internets-on-fire-right-now-millions-of-devices-at-risk-over-new-software-vulnerability_4156484.html)

[Log4j: Between a rock and a hard place | Hacker News](https://news.ycombinator.com/item?id=29523608)
[crawshaw - 2021-12-11](https://crawshaw.io/blog/log4j)

[GitHub - google/log4jscanner: A log4j vulnerability filesystem scanner and Go package for analyzing JAR files.](https://github.com/google/log4jscanner)

[Weak Diffie-Hellman and the Logjam Attack](https://weakdh.org)
[Logjam: PFS Deployment Guide](https://weakdh.org/sysadmin.html)

## exploits - Lotus

[NSA Backdoor Key from Lotus-Notes (2002) | Hacker News](https://news.ycombinator.com/item?id=37554504)
[NSA Backdoor Key from Lotus-Notes](http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html)

## exploits - Make Money Fast

[Make Money Fast - Wikipedia](https://en.wikipedia.org/wiki/Make_Money_Fast)

## exploits - max headroom incident

[The Max Headroom Incident | Hacker News](https://news.ycombinator.com/item?id=29319651)
[The Max Headroom Incident And The Creepy Mystery Behind It](https://allthatsinteresting.com/max-headroom-incident)

## exploits

[List of security hacking incidents - Wikipedia](https://en.wikipedia.org/wiki/List_of_security_hacking_incidents)

[US companies hit by 'colossal' cyber-attack | Hacker News](https://news.ycombinator.com/item?id=27718529)
[US companies hit by 'colossal' cyber-attack - BBC News](https://www.bbc.com/news/world-us-canada-57703836)

[List of 8000 security vulnerabilities in 1200 Wi-Fi routers | Hacker News](https://news.ycombinator.com/item?id=29244508)
[Router Bugs and Security Vulnerabilities](https://modemly.com/m1/pulse)

## exploits - media players

[Anyone who can explain why Soda Player is accessing private files and mails? : Piracy](https://old.reddit.com/r/Piracy/comments/8q2pg3/anyone_who_can_explain_why_soda_player_is/)

## exploits - meow attack

[New 'Meow' attack has deleted almost 4k unsecured databases | Hacker News](https://news.ycombinator.com/item?id=23957510)
[New 'Meow' attack has deleted almost 4,000 unsecured databases](https://www.bleepingcomputer.com/news/security/new-meow-attack-has-deleted-almost-4-000-unsecured-databases/)

## exploits - Microsoft

[Follina - a Microsoft Office code execution vulnerability | by Kevin Beaumont | DoublePulsar](https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e)

[Microsoft's rich notifications for Windows 10 and 11 present new, native-looking browser popups to more readily fool users into getting phished or downloading malware : cybersecurity](https://old.reddit.com/r/cybersecurity/comments/v0jdhq/microsofts_rich_notifications_for_windows_10_and)

[Over 100k Infected Repos Found on GitHub | Hacker News](https://news.ycombinator.com/item?id=39545676)
[Over 100,000 Infected Repos Found on GitHub](https://apiiro.com/blog/malicious-code-campaign-github-repo-confusion-attack/)

[How I Might Have Hacked Any Microsoft Account - The Zero Hack](https://thezerohack.com/how-i-might-have-hacked-any-microsoft-account)

[AAD misconfiguration led to Bing.com results manipulation, account takeover | Hacker News](https://news.ycombinator.com/item?id=35364383)
[BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover | Wiz Blog](https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration)

[Ask HN: Developer abused "sign in with GitHub"? | Hacker News](https://news.ycombinator.com/item?id=33917962)

[Hackers slip into Microsoft Teams chats to distribute malware : hacking](https://old.reddit.com/r/hacking/comments/sv0vwp/hackers_slip_into_microsoft_teams_chats_to)

[Microsoft…The Truth Is Even Worse Than You Think](https://old.reddit.com/r/cybersecurity/comments/15gomck/microsoftthe_truth_is_even_worse_than_you_think/)

[With thousands of cybersecurity employees, Microsoft still doesn't know how it got hacked](https://old.reddit.com/r/cybersecurity/comments/152fsd5/with_thousands_of_cybersecurity_employees/)

## exploits - military-based

[Hactivists say they hacked Belarus rail system to stop Russian military buildup | Ars Technica](https://arstechnica.com/information-technology/2022/01/hactivists-say-they-hacked-belarus-rail-system-to-stop-russian-military-buildup)

[Ukraine calls on hacker underground to defend against Russia | Hacker News](https://news.ycombinator.com/item?id=30462219)
[EXCLUSIVE Ukraine calls on hacker underground to defend against Russia | Reuters](https://web.archive.org/web/20220630192042/https://www.reuters.com/world/exclusive-ukraine-calls-hacker-underground-defend-against-russia-2022-02-24/)

## exploits - NewsBlur

[A Docker footgun led to a vandal deleting NewsBlur's MongoDB database | Hacker News](https://news.ycombinator.com/item?id=27670058)
[How a Docker footgun led to a vandal deleting NewsBlur's MongoDB database | The NewsBlur Blog](https://blog.newsblur.com/2021/06/28/story-of-a-hacking/)

## exploits - npm registry

[NPM security update: Attack campaign using stolen OAuth tokens | Hacker News](https://news.ycombinator.com/item?id=31526044)
[npm security update: Attack campaign using stolen OAuth tokens - The GitHub Blog](https://github.blog/2022-05-26-npm-security-update-oauth-tokens/)

[Security issue related to the NPM registry | Hacker News](https://news.ycombinator.com/item?id=29245080)
[GitHub's commitment to npm ecosystem security - The GitHub Blog](https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/#security-issues-related-to-the-npm-registry)

## exploits - Nvidia

[Cybercriminals who breached Nvidia issue one of the most unusual demands ever | Hacker News](https://news.ycombinator.com/item?id=30550028)
[Cybercriminals who breached Nvidia issue one of the most unusual demands ever | Ars Technica](https://arstechnica.com/information-technology/2022/03/cybercriminals-who-breached-nvidia-issue-one-of-the-most-unusual-demands-ever/)

## exploits - Pandora Papers

[Pandora papers: biggest leak of offshore data exposes financial secrets of rich | Hacker News](https://news.ycombinator.com/item?id=28738407)
[Pandora papers: biggest ever leak of offshore data exposes financial secrets of rich and powerful | World news | The Guardian](https://www.theguardian.com/news/2021/oct/03/pandora-papers-biggest-ever-leak-of-offshore-data-exposes-financial-secrets-of-rich-and-powerful)

## exploits - parking apps

[Traffic cameras expose your location through parking apps | Hacker News](https://news.ycombinator.com/item?id=32980040)
[Stop others from tracking your car | NOTMYPLATE.COM](https://notmyplate.com/whitepaper/)

## exploits - PHP

[Hackers backdoor PHP source code after breaching internal git server | Ars Technica](https://arstechnica.com/gadgets/2021/03/hackers-backdoor-php-source-code-after-breaching-internal-git-server)

[PHP's Git server compromised, moving to GitHub | Hacker News](https://news.ycombinator.com/item?id=26616707)
[php.internals: Changes to Git commit workflow](https://news-web.php.net/php.internals/113838)

## exploits - red cross

[How the Red Cross lost the data of +500.000 refugees](https://cyb3rsecurity.tips/p/how-the-red-cross-lost-the-data-of?s=w)

## exploits - Reddit

[Hacked Reddit Data To Be Published Unless API Changes Dropped, Hackers Say](https://www.forbes.com/sites/daveywinder/2023/06/19/hacked-reddit-data-to-be-published-unless-api-changes-dropped-hackers-say/?sh=576bde2f147e)

## exploits - Rubygem

[Strong_password Rubygem hijacked | Hacker News](https://news.ycombinator.com/item?id=20377136)
[strong_password v0.0.7 rubygem hijacked - With a Twist.dev](https://withatwist.dev/strong-password-rubygem-hijacked.html)

## exploits - SAP

[SAPwned: SAP AI vulnerabilities expose customers' cloud environments and privat | Hacker News](https://news.ycombinator.com/item?id=40990768)
[SAPwned: SAP AI vulnerabilities expose customers’ cloud environments and private AI artifacts | Wiz Blog](https://www.wiz.io/blog/sapwned-sap-ai-vulnerabilities-ai-security)

## exploits - security cameras

[Hackers break into thousands of security cameras, exposing Tesla, jail, hospital | Hacker News](https://news.ycombinator.com/item?id=26405056)
[Hackers breach thousands of security cameras, exposing Tesla, jails, hospitals - BNN Bloomberg](https://www.bnnbloomberg.ca/hackers-break-into-thousands-of-security-cameras-exposing-tesla-jails-hospitals-1.1574681)

## exploits - security companies

[Infosec company pwned by 4chan user | Hacker News](https://news.ycombinator.com/item?id=35888509)
[infosec company owned completely by 4chan user](https://maia.crimew.gay/posts/optimeyes-leak/)

[Spyware maker LetMeSpy shuts down after hacker deletes server data](https://old.reddit.com/r/cybersecurity/comments/15joyq0/spyware_maker_letmespy_shuts_down_after_hacker/)

[Hackers stole access tokens from Okta's support unit | Hacker News](https://news.ycombinator.com/item?id=37959904)
[Hackers Stole Access Tokens from Okta's Support Unit - Krebs on Security](https://krebsonsecurity.com/2023/10/hackers-stole-access-tokens-from-oktas-support-unit/)

## exploits - Slack

[Slack's private GitHub code repositories stolen over holidays | Hacker News](https://news.ycombinator.com/item?id=34257646)
[Slack's private GitHub code repositories stolen over holidays](https://www.bleepingcomputer.com/news/security/slacks-private-github-code-repositories-stolen-over-holidays/)

## exploits - SolarWinds

[SolarWinds hackers have a whole bag of new tricks for mass compromise attacks | Ars Technica](https://arstechnica.com/information-technology/2021/12/solarwinds-hackers-have-a-whole-bag-of-new-tricks-for-mass-compromise-attacks)

[Wide-ranging SolarWinds probe sparks fear in Corporate America | Hacker News](https://news.ycombinator.com/item?id=28481925)
[Exclusive: Wide-ranging SolarWinds probe sparks fear in Corporate America | Reuters](https://www.reuters.com/technology/exclusive-wide-ranging-solarwinds-probe-sparks-fear-corporate-america-2021-09-10/)

[Highly Evasive Attacker Leverages SolarWinds Supply Chain | Hacker News](https://news.ycombinator.com/item?id=25413053)
[SolarWinds Supply Chain Attack Uses SUNBURST Backdoor](https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor)

[U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise | Hacker News](https://news.ycombinator.com/item?id=25419487)
[U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise - Krebs on Security](https://krebsonsecurity.com/2020/12/u-s-treasury-commerce-depts-hacked-through-solarwinds-compromise/)

[SolarWinds CEO blames intern for password leak | Hacker News](https://news.ycombinator.com/item?id=26284782)
[Former SolarWinds CEO blames intern for 'solarwinds123' password leak | CNN Politics](https://edition.cnn.com/2021/02/26/politics/solarwinds123-password-intern/index.html)

[SolarWinds Customers](https://web.archive.org/web/20201214090828/https://www.solarwinds.com/company/customers)

[SolarWinds: The Untold Story of the Boldest Supply-Chain Hack | WIRED](https://www.wired.com/story/the-untold-story-of-solarwinds-the-boldest-supply-chain-hack-ever/)

## exploits - spring4shell

[Hackers Exploiting Spring4Shell Vulnerability to Deploy Mirai Botnet Malware](https://thehackernews.com/2022/04/hackers-exploiting-spring4shell.html?m=1)
[The Hacker News | #1 Trusted Cybersecurity News Site](https://thehackernews.com)
leading news source dedicated to promoting awareness for security experts and hackers.

## exploits - Tesla

[Hackers manage to unlock Tesla software-locked features | Hacker News](https://news.ycombinator.com/item?id=36988262)
[Hackers manage to unlock Tesla software-locked features worth up to $15,000 | Electrek](https://electrek.co/2023/08/03/hackers-manage-unlock-tesla-software-locked-features/)

[Researchers jailbreak a Tesla to get free in-car feature upgrades](https://old.reddit.com/r/technology/comments/15h4uwz/researchers_jailbreak_a_tesla_to_get_free_incar/)

[Unpatchable AMD Chip Flaw Jailbreaks Tesla's $15,000 FSD](https://old.reddit.com/r/hardware/comments/15hd1b6/unpatchable_amd_chip_flaw_jailbreaks_teslas_15000/)

[How I got access to 25+ Tesla's around the world. By accident. And curiosity. | by David Colombo | Medium](https://medium.com/@david_colombo/how-i-got-access-to-25-teslas-around-the-world-by-accident-and-curiosity-8b9ef040a028)

## exploits - Ticketmaster

[Ticketmaster hack: Australians likely caught up in suspected breach](https://www.smh.com.au/technology/australians-may-be-caught-up-in-suspected-ticketmaster-hack-20240529-p5jhjt.html)

## exploits - torrent software

[WARNING: Do not download Bitlord. It has major adware and will slow your system down hugely. : torrents](https://old.reddit.com/r/torrents/comments/1yb8kf/warning_do_not_download_bitlord_it_has_major/)
[BitLord](http://www.bitlord.com/)
Easiest torrent app for streaming and downloading.

## exploits - TPM

[Hackability of TPM locked OS that boots into graphical.target](https://old.reddit.com/r/linux/comments/163zgqq/hackability_of_tpm_locked_os_that_boots_into/)

## exploits - TunnelVision VPN

['TunnelVision' Attack Leaves Nearly All VPNs Vulnerable to Spying | WIRED](https://www.wired.com/story/tunnelvision-vpn-attack/)

## exploits - Twilio

[Twilio confirms data breach after hackers leak 33M Authy user phone numbers | Hacker News](https://news.ycombinator.com/item?id=40874341)
[Twilio Confirms Data Breach After Hackers Leak 33M Authy User Phone Numbers - SecurityWeek](https://www.securityweek.com/twilio-confirms-data-breach-after-hackers-leak-33m-authy-user-phone-numbers/)

## exploits - xz backdoor

[Backdoor in upstream xz/liblzma leading to SSH server compromise | Hacker News](https://news.ycombinator.com/item?id=39865810)
[oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise](https://www.openwall.com/lists/oss-security/2024/03/29/4)

[Xz: A microcosm of the interactions in open source projects | Hacker News](https://news.ycombinator.com/item?id=39879710)
[A Microcosm of the interactions in Open Source projects](https://robmensching.com/blog/posts/2024/03/30/a-microcosm-of-the-interactions-in-open-source-projects/)

[XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable." | Hacker News](https://news.ycombinator.com/item?id=39877267)
[Filippo Valsorda: "I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission. The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system(). It's RCE, not auth bypass, and gated/unreplayable." - Bluesky](https://bsky.app/profile/filippo.abyssdomain.expert/post/3kowjkx2njy2b)

[Xz/liblzma: Bash-stage Obfuscation Explained | Hacker News](https://news.ycombinator.com/item?id=39878681)
[xz/liblzma: Bash-stage Obfuscation Explained - gynvael.coldwind//vx.log](https://gynvael.coldwind.pl/?lang=en&id=782)

[Xz: Can you spot the single character that disabled Linux landlock? | Hacker News](https://news.ycombinator.com/item?id=39874404)
[git.tukaani.org - xz.git/blobdiff - CMakeLists.txt](https://git.tukaani.org/?p=xz.git;a=blobdiff;f=CMakeLists.txt;h=d2b1af7ab0ab759b6805ced3dff2555e2a4b3f8e;hp=76700591059711e3a4da5b45cf58474dac4e12a7;hb=328c52da8a2bbb81307644efdb58db2c422d9ba7;hpb=eb8ad59e9bab32a8d655796afd39597ea6dcc64d)

[Xzbot: Notes, honeypot, and exploit demo for the xz backdoor | Hacker News](https://news.ycombinator.com/item?id=39895344)
[amlweems/xzbot: notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)](https://github.com/amlweems/xzbot)

[What we know about the xz Utils backdoor that almost infected the world | Hacker News](https://news.ycombinator.com/item?id=39891607)
[What we know about the xz Utils backdoor that almost infected the world | Ars Technica](https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/)

[The XZ Backdoor: Everything You Need to Know | WIRED](https://www.wired.com/story/xz-backdoor-everything-you-need-to-know/)

[Timeline of the xz open source attack | Hacker News](https://news.ycombinator.com/item?id=39902241)
[research!rsc: Timeline of the xz open source attack](https://research.swtch.com/xz-timeline)

[The xz attack shell script | Hacker News](https://news.ycombinator.com/item?id=39903685)
[research!rsc: The xz attack shell script](https://research.swtch.com/xz-script)

[Backdoor in upstream xz/liblzma leading to SSH server compromise | Hacker News](https://news.ycombinator.com/item?id=39865810)
[wiki.c2.com/?TheKenThompsonHack](https://wiki.c2.com/?TheKenThompsonHack)

[The xz sshd backdoor rabbithole goes quite a bit deeper | Hacker News](https://news.ycombinator.com/item?id=39956455)
[blasty on X: "the xz sshd backdoor rabbithole goes quite a bit deeper. I was just able to trigger some harder to reach functionality of the backdoor. there's still more to explore.. 1/n https://t.co/s1zJ8EBiMl" / X](https://twitter.com/bl4sty/status/1776691497506623562)

[XZ backdoor story - Initial analysis | Hacker News](https://news.ycombinator.com/item?id=40017310)
[Kaspersky analysis of the backdoor in XZ | Securelist](https://securelist.com/xz-backdoor-story-part-1/112354/)

## exploits - browser

[GitHub - Escapingbug/awesome-browser-exploit: awesome list of browser exploitation tutorials](https://github.com/Escapingbug/awesome-browser-exploit)

## exploits - equifax

[How Equifax Was Breached in 2017](https://old.reddit.com/r/cybersecurity/comments/16lkhpa/how_equifax_was_breached_in_2017/)

## exploits - Linux

[Understanding Linux Capabilities](https://tbhaxor.com/understanding-linux-capabilities)
[Exploiting Linux Capabilities - Part 2](https://tbhaxor.com/exploiting-linux-capabilities-part-2)

## exploits

[10 Infamous Cyberattacks: The List You Don't Want to Be On | Cybersecurity | CompTIA](https://www.comptia.org/blog/10-infamous-cyberattacks)

## hacking labs

[Hacking-Lab](https://www.hacking-lab.com/index.html)
online ethical hacking, computer network and security challenge platform.

[CTFlearn](https://ctflearn.com/)
is an online platform built to help ethical hackers learn and practice their cybersecurity knowledge.

[DefendTheWeb](https://defendtheweb.net/)
Cyber Security Challenges

[How to Create a Virtual Hacking Lab: The Ultimate Hacker Setup: netsec](https://www.reddit.com/r/netsec/comments/11yl4cx/how_to_create_a_virtual_hacking_lab_the_ultimate)

[HackXpert](https://hackxpert.com/)
Free labs and training.

[CyberSecLabs](https://www.cyberseclabs.co.uk/)
High quality training labs.

[Cybrary](https://www.cybrary.it/)
[Cybrary](https://www.cybrary.it/info/freeittraining/)
Videos, labs, and practice exams.

[RangeForce](https://www.rangeforce.com/)
Interactive and hands-on platform.

[Certified Secure](https://www.certifiedsecure.com/)
Loads of different challenges.

[rootsh3ll Labs: Self-paced Cyber Security Training Labs](https://labs.rootsh3ll.com/)
[I built a cloud-based Cyber Security training platform as a dream project : netsecstudents](https://old.reddit.com/r/netsecstudents/comments/d8zi08/i_built_a_cloudbased_cyber_security_training)

[Information Security Training](https://www.sans.org/)
[SANS Security Certifications](https://www.sans.org/cyber-security-courses/)
(paid)
[SANS OSINT Resources](https://www.sans.org/blog/-must-have-free-resources-for-open-source-intelligence-osint-/)
Collection of resources to help understand and improve OSINT knowledge and collection.
[Cyber Security White Papers | SANS Institute](https://www.sans.org/white-papers/)
[SIFT](https://digital-forensics.sans.org/community/downloads)
[SIFT Workstation Download (SANS DFIR)](https://digital-forensics.sans.org/community/downloads)
[SANS SIFT Workstation](https://www.sans.org/tools/sift-workstation)
Forensic workstation made by SANS.

[Hack The Box: Hacking Training For The Best | Individuals & Companies](https://www.hackthebox.com)
[Hack The Box](https://www.hackthebox.eu/)
online platform allowing you to test your penetration testing skills.
Cybersecurity training platform.
start hacking
[AWS penetration testing: a step-by-step guide](https://www.hackthebox.com/blog/aws-pentesting-guide)

[Silesia Security Lab](https://silesiasecuritylab.com/)
high quality security testing services.

[Practical Pentest Labs](https://practicalpentestlabs.com/)
pentest lab, take your Hacking skills to the next level.
orm.

[Root Me](https://www.root-me.org/)
[Root Me](https://www.root-me.org/?lang=en)
Over 400 cybersecurity challenges.
the fast, easy, and affordable way to train your hacking skills.

[TryHackMe](https://tryhackme.com/)
[TryHackMe | Complete Beginner Training](https://tryhackme.com/path/outline/beginner)
learning Cyber Security made easy.
cyber security training - start here:
Hands-on exercises and labs.

[hackxor](https://hackxor.net/)
is a realistic web application hacking game, designed to help players of all abilities develop their skills.

[Hack Yourself First](http://hack-yourself-first.com/)
it's full of nasty app sec holes.

[Wizard Labs](https://labs.wizard-security.net/)
is an online Penetration Testing Lab.

[PentesterLab: Learn Web Penetration Testing: The Right Way](https://pentesterlab.com/)
provides vulnerable systems that can be used to test and understand vulnerabilities.
Learn web-app penetration testing.

[try2hack](http://www.try2hack.nl/)
several security-oriented challenges for your entertainment.
[Try2Hack](https://try2hack.me/)
Play a game based on the real attacks.

[Hack.me](https://hack.me/)
a platform where you can build, host and share vulnerable web apps for educational purposes.

[Ubeeri](https://www.ubeeri.com/preconfig-labs)
preconfigured lab environments.

[Pentestit](https://lab.pentestit.ru/)
emulate IT infrastructures of real companies for legal pen testing and improving pentest skills.

[Microcorruption](https://microcorruption.com/login)
reversal challenges done in the web interface.

[DomGoat](https://domgo.at/cxss/intro)
DOM XSS security learning and practicing platform.

[Stereotyped Challenges](https://chall.stypr.com/)
upgrade your web hacking techniques today!

[W3Challs](https://w3challs.com/)
is a penetration testing training platform, which offers various computer challenges.

[Hack This Site](https://hackthissite.org)
[Hack This Site](https://www.hackthissite.org/pages/index/index.php)
is a free, safe and legal training ground for hackers.

[We Chall](https://www.wechall.net/challs)
there are exist a lots of different challenge types.

[Hacker Gateway](https://www.hackergateway.com/)
is the go-to place for hackers who want to test their skills.

[contained.af](https://contained.af/)
a stupid game for learning about containers, capabilities, and syscalls.

[flAWS challenge!](http://flaws.cloud/)
a series of levels you'll learn about common mistakes and gotchas when using AWS.

[CyberSec WTF](https://cybersecurity.wtf/)
provides web hacking challenges derived from bounty write-ups.

[Attack & Defense](https://attackdefense.com/)
is a browser-based cloud labs.

[Hacknet](http://www.hacknet-os.com/)
a hacking game simulator (not free), potentially boring (move to hackmud)

[h a c k m u d](https://www.hackmud.com/)
hackmud, a hacking game simulator (not free) with programming challenges

[Web Application Exploits and Defenses](https://google-gruyere.appspot.com/)
web application exploits and defenses.

[GitHub - amolnaik4/bodhi: Bodhi - Client-side Vulnerability Playground](https://github.com/amolnaik4/bodhi)
is a playground focused on learning the exploitation of client-side web vulnerabilities.

[GitHub - vulhub/vulhub: Pre-Built Vulnerable Environments Based on Docker-Compose](https://github.com/vulhub/vulhub)
pre-built Vulnerable Environments based on docker-compose.

[OWASP SamuraiWTF](https://www.samurai-wtf.org)

[SecurityShepherd](https://github.com/OWASP/SecurityShepherd)
web and mobile application security training platform.

[GitHub - globocom/secDevLabs: A laboratory for learning secure web and mobile development in a practical manner.](https://github.com/globocom/secDevLabs)
is a laboratory for learning secure web development in a practical manner.

[Real-time URL and Website Sandbox | CheckPhish](https://checkphish.ai)