Hacker Noon Cybersecurity

I dissected IEC 60870-5-104 from the wire up, tested its APCI state machine, ASDU/control paths, and parser boundaries, then compared the cleartext attack surface against IEC 62351 TLS and authorization controls.Read All

Print jobs should be temporary. Docshy replaces chat-based printing with an encrypted relay designed to delete files after the job is done.Read All

Claude Opus 5 hits an 88.6% coding pass rate, with lower bug and vulnerability density—but generates 2.3× more code than Opus 4.8.Read All

Expired domains aren’t just an SEO asset — they can become a cybersecurity risk. Old domains may still be referenced in documentation, DNS, email systems, APIs and external websites. If someone else registers the domain, that forgotten digital footprint can potentially be abused. Organizations should treat domain retirement as part of their security lifecycle and audit dependencies before allowing a domain to expire.Read All

Learn how Claude Code hooks create deterministic guardrails that block dangerous commands and verify AI-generated code before problems ship.Read All

Everything Protocol published a whitepaper on 20 August 2026 setting out a DeFi architecture in which a single reserve per token pair simultaneously prices swaps, backs loans and leveraged positions and supports resting limit orders. Liquidity earns swap fees while supporting the credit market, and eligible capital resting in limit orders can opt into lending and earn borrower interest until those orders execute. The design removes the external price oracle, deriving credit terms from an internal price band computed from the pool’s own trading state and time, fixed within a block and adjusted under predefined decay and clamp rules. The paper also sets out a solvency hierarchy in which user escrow sits outside the pricing reserve, filled-order proceeds rank senior, and eligible liquidation losses are written down against the junior liquidity provider tranche first.Read All

Flowra launched its Open Orderflow Auction on 21 August 2026, a block-building framework that lets registered searchers bid openly for Solana transaction inclusion instead of routing through closed orderflow channels. The Seoul-based company also introduced Programmable Block Policy, which lets validators define their own transaction inclusion rules at the block-building layer without changes to the Solana protocol, with sanctions and risk screening supplied through a collaboration with Honeypot. In early testing on a single validator, a Flowra-enabled setup raised compute units per block by 20.6%, moving that node from 84% to 101% of the network average, with 100% block production and 99.999% block engine uptime.Read All

CertiK reported five resource exhaustion bugs to the Besu maintainers who shipped the fixes within a fortnight and then published severity ratings that disagreeRead All

Local AI prototypes inherit security, identity, storage and cost controls from the laptop running them. Moving the same code onto a public URL exposes those hidden dependencies: MCP authentication, OAuth registration, permission models, resilience, abuse controls and who pays for inference. Hosting the code is easy; replacing the platform your machine quietly provided is the real work.Read All

IEC 104 carries SCADA telemetry and control over TCP/2404. This primer breaks down its framing, I/S/U formats, ASDUs, security boundaries, and IEC 62351 extensions before going on-wire.Read All

Build a five-line Claude Code hook that runs SonarQube Vortex Agentic Analysis after every edit and feeds CI-grade findings back to Claude.Read All

The breach of Liechtenstein beneficial ownership data reveals that structural risk extends beyond physical assets. When ownership data is centralized across institutions, single-point failures expose entire capital structures. Protecting cross-border assets requires applying Zero Trust principles to information architecture. Read All

AutoGPT enforces strict SSRF protections on its HTTP layer. But the SendEmailBlock uses Python’s smtplib to open raw TCP sockets, bypassing the blocklist entirely. Pointing this block at internal SSH or Redis ports forces smtplib to throw an exception that leaks the service banner directly in the API response. Authenticated users can map the internal network and identify vulnerable services from a single text field. Fixed in backend 0.6.52 by extending IP validation to all outbound protocols. Read All

Learn how TOON can cut AI coding-agent token usage by roughly a third to a half versus JSON using one simple Sonar CLI flag.Read All

Coding agents get worse as investigative debris fills their context. Learn how subagents keep Claude Code focused and effective for longer sessions.Read All

Are we ≤ AI or are we ≥ AI ?…Read All

SecurityMetrics’ Audit team has won the Cybersecurity Audit Team of the Year award from the Hacker News. This award highlights the Audit team’s expertise and commitment to streamlining the compliance process for their clients.Read All

Cross-team collaboration introduces additional complexity, and the volume of information being shared grows rapidly. Managing access rights, protecting customer information, and preventing accidental data exposure become increasingly difficult.Read All

Head of Operations and Partnerships Chris Biele to lead sessions on secure scientific collaboration, agentic AI and the need to move from trust to cryptographicRead All

A single OPC UA `GetEndpoints` request exposed five security configurations, including a `SecurityPolicy#None` endpoint. Following that path led to an accepted anonymous session, recursive address-space traversal, and successful writes to five variables. The lab also tested the other security boundaries: invalid username credentials and an independently generated self-signed X.509 certificate were both rejected. The complete scripts, packet captures, screenshots, and research notes are available in the OPC UA research repository : https://github.com/404saint/industrial-protocol-labs/tree/main/opcua-research. Read All