I’m coming down from spending a few days at Usenix Security, right here in my hometown of Baltimore. This means that my days have been taken up with two kinds of conversation: first, explaini…
#HOPE26 will be the seventeenth Hackers On Planet Earth event. It will take place from August 14-16, 2026, at the New Yorker Hotel in #NewYorkCity.
This promises to be a memorable event. It is open to all hackers, makers, tinkerers, experimenters, artists, educators and anyone else with an interest in exploring and improving the world we live in, and sharing knowledge with others.
HOPE is an all-ages event with multiple simultaneous sessions and many other things to do throughout the weekend.
Some of what you can expect: Speaker sessions Workshops Entertainment Contests Vendors Space to socialize Hands-on learning opportunities Friendly and supportive conference attendees #privacy #security
I have recently (12th August 2026) carried out a thorough research into this as I am planning to migrate to whichever is the best email provider/service for APS and move away and ditch US Big Tech.
Between the two, the one that comes on top depends on what you value most on aggregate. In individual edge terms, here is how they compare:
Tuta Mail: cheaper; more custom domains; more email addresses; more established/robust Post-Quantum (PQ) Security;
Vulnerability-Lookup (github.com/vulnerability-looku…) is an open-source platform (AGPL) for fast vulnerability lookup and correlation across many sources — CVE, EUVD, GHSA, OSV, CSAF/VEX, national CERTs — with collaborative annotation, sightings and coordinated disclosure. 6.0.0 is out today; two big additions this round.
Webhook notifications
Product notifications are no longer e-mail only. A subscription can push its reports to any HTTPS endpoint — a chat channel, a SIEM, a ticketing system — instead of, or in addition to, e-mail. HTTP method, custom headers and a payload template are all configurable, so the same mechanism feeds a generic JSON collector or the specific shape Mattermost/Teams/DingTalk/Telegram expect.
Targets are held to a strict outbound policy, enforced when the form is saved and again at delivery time: HTTPS on a standard port, no redirects, delivery pinned to the validated IP, private/loopback/
... show more
Vulnerability-Lookup (github.com/vulnerability-looku…) is an open-source platform (AGPL) for fast vulnerability lookup and correlation across many sources — CVE, EUVD, GHSA, OSV, CSAF/VEX, national CERTs — with collaborative annotation, sightings and coordinated disclosure. 6.0.0 is out today; two big additions this round.
Webhook notifications
Product notifications are no longer e-mail only. A subscription can push its reports to any HTTPS endpoint — a chat channel, a SIEM, a ticketing system — instead of, or in addition to, e-mail. HTTP method, custom headers and a payload template are all configurable, so the same mechanism feeds a generic JSON collector or the specific shape Mattermost/Teams/DingTalk/Telegram expect.
Targets are held to a strict outbound policy, enforced when the form is saved and again at delivery time: HTTPS on a standard port, no redirects, delivery pinned to the validated IP, private/loopback/link-local refused (IPv6 transition addresses judged by their embedded IPv4 destination), URL-shortener and dynamic-DNS domains rejected via the MISP warning lists, and URL paths redacted from failure logs.
Local exploit hazard
An implementation of the model from arXiv:2607.24618 (arxiv.org/abs/2607.24618), which turns an EPSS forecast into an exploitation risk estimate that accounts for your environment — compensating controls (globally or per attack vector), KEV policy weighting, and exponential or KEV-calibrated Weibull age decay.
POST /api/exploit-hazard — a single vulnerability instance, resolved from a vulnerability id or from explicit values.
POST /api/exploit-hazard/batch — aggregates a whole exposed set into the aggregate daily hazard, the expected number of exploitation events over the horizon, and the Poisson probability of at least one event.
The same model drives the notifications: reports are ordered by individual hazard and annotated with EPSS score, age and horizon probability. Each subscription can localize the estimates with its own parameters, and a daily standing exposure evaluation alerts on upward threshold crossings, listing the vulnerabilities whose remediation would lower the exposure most.
A vulnerability credits index — credited researchers from CVE 5, OSSF and CSAF records, indexed and ranked at /credits/ with search and pivots from every advisory
SSVC v2.0 decisions on the CVE page, extracted from every container (CNA and ADPs), normalized and attributed
import_dump — bootstrap a fresh instance from the public NDJSON dumps (a one-time bootstrap, not a sync mechanism)
EUVD: KEV catalog linking and a score-ordered EPSS index
Security fixes: XSS in tag rendering, SSE stream gated on confirmed accounts, single-use activation/recovery tokens, outbound-URL policy on remote sync, and authenticated responses kept out of shared caches
Project governance, maintainer list, roadmap and privacy documentation
This paper presents a local exploit hazard model : a Bayesian framework that converts the global probabilities produced by an exploit likelihood model (ELM), such as the Exploit Prediction Scoring System (EPSS), into a daily exploit hazard rate for a…
Version 1.18.1 and 1.19.0 pre-release rolled out for Flatpak, due to some security issues that were found so it's an essential update for all Linux systems.
⚠️Quick tip for the privacy community: remember that duress passwords and decoy PINs can be a double-edged sword. In some jurisdictions, using them during an investigation is treated as destruction of evidence, which may result in separate criminal charges and prison time.
Stay safe by knowing your rights and talking to a local legal professional before setting up these tools!
At first, #Spider-Man: Brand New Day looks like another emotional #superhero #story. Peter Parker has lost everything. No one remembers him, not even MJ. He searches for his #identity while trying to protect #NewYork. The #film spends much of its time
At first, #Spider-Man: Brand New Day looks like another emotional #superhero #story. Peter Parker has lost everything. No one remembers him, not even MJ. He searches for his #identity while trying to protect #NewYork. The #film spends much of its time on #trauma, #loneliness, and #mental #health.
But behind this personal story lies a political #message. The film presents mass surveillance as something necessary and even heroic. This is where the #movie becomes much more interesting—and much more troubling.
Spider-Man uses powerful surveillance #technology to watch the city. He collects video from many security cameras. He scans every face to find criminals. Even the #police admit that this is probably #illegal. Still, the film treats these actions as acceptable because Spider-Man is one of the "good guys."
Jean Grey—now portrayed by Sadie Sink (She kept her role a huge secret beforehand for marketing reasons.) in the Marvel Universe—falls into the facial recognition trap set by Spider-Man's surveillance program. If, by the end, you feel sorry for Jean Grey because the script wants you to and you’ve let yourself be swept up in the drama, then please remember that at the beginning of the movie, Jean possessed an old man and sent him running into the street so he would be brutally run over. She’s a mass murderer who’ll stop at nothing to achieve her goal. She could easily achieve this goal with her incredible superpower, but she makes it unnecessarily complicated by first freeing the Scorpion, which is what draws Spider-Man's attention to her in the first place.
This idea has a long #history in popular culture. The strongest comparison is George Orwell's 1984. #Orwell imagined a #society where every citizen is watched. Surveillance is presented as a tool for #security, but it destroys #freedom. In Brand New Day, the situation is different because Spider-Man is a hero, not a dictator. Yet the basic question remains the same: Who watches the watchers? If one person can see everyone, who controls that person?
The film never really asks this #question. Instead, it assumes that surveillance is good as long as the right people #control it. This is one of its biggest #weaknesses.
Another interesting comparison is The Dark Knight. In Christopher Nolan's film, #Batman creates a machine that can monitor every mobile phone in Gotham. Lucius Fox calls it too dangerous because it gives one person unlimited power. Batman agrees. He uses the system only once to catch the #Joker and then destroys it immediately.
Brand New Day takes a very different approach. Spider-Man's surveillance technology is not treated as a #moral #problem. Instead, it becomes a normal #tool of #crime fighting. The ethical debate that makes The Dark Knight so powerful is almost completely missing.
The transcript also compares Spider-Man's work with modern surveillance technology. Peter Parker works closely with the Department of Damage Control and helps collect huge amounts of personal data. The review argues that this creates a positive image of a close relationship between #government institutions and powerful technology companies.
This makes the film feel surprisingly modern. Today, governments and private companies collect enormous amounts of digital information. Cameras, facial recognition, smartphones and artificial #intelligence make surveillance easier than ever before. The movie reflects this reality but rarely questions it.
One of the most interesting contradictions is #PeterParker himself. He wants #privacy for his own life. He hides his identity and wants to escape public attention. At the same time, he watches everyone else and scans thousands of faces. The film never fully explores this contradiction.
This creates an uncomfortable message. Privacy seems important for the hero but less important for ordinary citizens.
The citizens themselves hardly have a voice. They mostly watch, cheer and accept Spider-Man's actions without #discussion. They never decide whether they want to live in such a #society. They simply #trust the hero.
As #entertainment, Spider-Man: Brand New Day offers impressive visuals and emotional performances. However, its political ideas deserve much more attention. The film normalizes mass surveillance while presenting it as an act of kindness and #responsibility. It replaces difficult ethical questions with emotional storytelling.
Unlike 1984, it does not warn us about surveillance. Unlike The #DarkKnight, it does not seriously question its use. Instead, it asks the #audience to trust the hero completely.
That may be the film's most surprising message. The greatest danger is not an #evil government forcing surveillance on its people. The greater danger is that we willingly accept surveillance because it is carried out by someone we like.
Spider-Man: Brand New Day succeeds as an emotional superhero #drama. As a political film, however, it raises fascinating questions without giving convincing answers.
Het fulltime bestrijden van misdaad als Spider-Man in een wereld die hem niet meer herinnert – en de druk om zijn oude vrienden zonder hem verder te zien gaan – zet een verandering in gang in Peter Parker die hij misschien niet in de hand heeft.
North Korea has denounced the United States and its allies for making unfounded allegations about its cyber activities to tarnish Pyongyang’s image and to justify pressure on sovereign states.
[2026-08-04] PressTV — State media KCNA carried the report on Tuesday, citing a North Korean foreign ministry spokesperson as responding to a recent US-led “joint warning on North Korean cyber threats.”
“It is illogical that the US, which has possessed and operated the biggest cyber force in the world by monopolizing the core resources of cyberspace, is talking about ‘cyber threat’ from other countries,” the spokesperson said.
The statement appeared to respond to a “joint alert” issued on Friday by the United States, South Korea, Japan, and eight other countries claiming that North Korean information technology workers use false identities to obtain remote jobs and generate revenue for Pyongyang’s “nuclear weapons and ballistic missile programs.”
... show more
North Korea has denounced the United States and its allies for making unfounded allegations about its cyber activities to tarnish Pyongyang’s image and to justify pressure on sovereign states.
[2026-08-04] PressTV — State media KCNA carried the report on Tuesday, citing a North Korean foreign ministry spokesperson as responding to a recent US-led “joint warning on North Korean cyber threats.”
“It is illogical that the US, which has possessed and operated the biggest cyber force in the world by monopolizing the core resources of cyberspace, is talking about ‘cyber threat’ from other countries,” the spokesperson said.
The statement appeared to respond to a “joint alert” issued on Friday by the United States, South Korea, Japan, and eight other countries claiming that North Korean information technology workers use false identities to obtain remote jobs and generate revenue for Pyongyang’s “nuclear weapons and ballistic missile programs.”
The foreign ministry official, however, rejected the allegations as politically motivated, condemning Washington for militarizing cyberspace through cyber warfare capabilities and joint exercises with allies. Pyongyang said it would not tolerate attempts to use cyber issues as a means of pressuring other countries.
In a separate KCNA editorial on Tuesday, a North Korean military commentator lambasted the United States, South Korea, and Japan for turning the US-led Rim of the Pacific (RIMPAC) naval exercise into a rehearsal for aggression and said their growing military cooperation was creating a new security crisis in the Asia-Pacific region.
The cyber dispute comes amid broader tensions between North Korea and the United States and its regional allies over military cooperation in Northeast Asia.
On July 31, KCNA reported that Pyongyang had warned against the expansion of the US military command in Japan, saying the changes were increasing the risk of conflict on the Korean Peninsula. North Korea said the expansion had transformed US Forces Japan (USFJ) into a “de facto war command” through increased staffing and closer operational integration with Japan’s military.
Amid the tensions, the North announced earlier that month that it would further strengthen and modernize its military capabilities. Reporting at the time, KCNA said an enlarged Central Military Commission meeting, held under ruler Kim Jong-un’s guidance, had adopted a resolution to “bolster up the nuclear force both in quality and quantity” and modernize military bases.
The Python Software Foundation is hiring a Security Developer to join @miketheman and I on triaging vulnerability reports and mitigating malware published to PyPI.
If you've got experience with Python, security, and collaborating with open source projects then we'd love to hear from you:
Hugging Face just released this extremely detailed technical description of OpenAI's recent accidental cyberattack against their infrastructure. This attack was very sophisticated, and the resulting document doubles as a crash-course …
How I found that anyone can pull the email address, name, country, and date of birth of any of the 719,517 users on Click To Pray, the Pope's official prayer app, with a single GET request. Reported January 3rd. Still live six months later.
We are pleased to announce the release of Vulnerability-Lookup 5.5.0!
This is a big one. The legacy admin flags give way to full Role-Based Access Control: roles, permissions, global and per-resource assignments, creation policies and dedicated management UIs, enforced across the views and the APIs. The vulnerability page gains AI-suggested MITRE ATT&CK techniques, inferred from the vulnerability description by a model trained with VulnTrain. On top of that: an EUVD ID allocation and creation pipeline, feeder supervision with automatic respawning and CSAF backoff, new VEX enrichment sources (SUSE and Microsoft MSRC) with a VEX records browse view, new feeders for Rocky Linux, Ubuntu and TuxCare, and a redesigned admin interface.
What's New
Role-Based Access Control
The boolean admin flags of previous versions are replaced by a fu
... show more
We are pleased to announce the release of Vulnerability-Lookup 5.5.0!
This is a big one. The legacy admin flags give way to full Role-Based Access Control: roles, permissions, global and per-resource assignments, creation policies and dedicated management UIs, enforced across the views and the APIs. The vulnerability page gains AI-suggested MITRE ATT&CK techniques, inferred from the vulnerability description by a model trained with VulnTrain. On top of that: an EUVD ID allocation and creation pipeline, feeder supervision with automatic respawning and CSAF backoff, new VEX enrichment sources (SUSE and Microsoft MSRC) with a VEX records browse view, new feeders for Rocky Linux, Ubuntu and TuxCare, and a redesigned admin interface.
What's New
Role-Based Access Control
The boolean admin flags of previous versions are replaced by a full RBAC mechanism: roles and permissions in a unified data model, role assignments with global or per-resource scope, creation policies that automatically grant the creator role when a resource is created, and a configurable default role for self-registration. Permission checks are enforced across the views, the templates and the user, system, KEV, CNA, bundle and sightings APIs. Contributed by @NMD03 in #497.
Each role is a set of fine-grained permissions (bundle:create, cna_publication:publish, kev:modify, ...) that can be edited from the admin interface:
The release also ships the hardening and migration work that followed the initial review: three security gaps around account confirmation and admin lockout were closed, permission checks keep working on a closed session, the creator role assignment is atomic with resource creation, owner role assignments are backfilled for pre-existing resources, the seeding is non-destructive and runs on update, role assignments are no longer bulk-loaded on every request, and the scoped-assignment tables are paginated. A permission-matrix test suite locks the behavior in, and the migration path for existing instances is documented — existing users and their resources are migrated automatically.
A new POST /api/vlai/attack-techniques endpoint proxies the ML-Gateway /classify/attack-techniques service with strict validation of the gateway response. The suggestions are lazy-loaded from the vulnerability description and clearly labelled as AI-generated, with a link to the model card and the exact model revision; gateway, model or network errors are shown to the user and allow a retry.
The EUVD support keeps progressing: a per-year EUVD ID allocator with a one-EUVD-per-CVE guarantee, an EnisaID creation pipeline that mints EUVD IDs for published CVEs, bidirectional vendor/product/advisory relationship sets, EUVD search with sort indexes and CVSS/EPSS/date filtering, a source and assigner registry with an assigner filter index, and advisory, vendor/product and CSAF advisory links wired into EUVD creation. Contributed by @archakisn in #475, #476, #479, #480, #488, #489, #491, #498, #499, #500, #501, #502, #503, #509 and #511.
Feeder supervision and CSAF resilience
feeders_manager now watches the feeders and respawns the dead ones, and CSAF sources are suspended with exponential backoff after fully failed cycles (#508, closing #459 and #463). CSAF import memory is bounded — untouched files are skipped and batches flushed on size — while unparseable files stay retryable, the watcher survives launch failures and transient cache errors, and the runtime script_name is aligned with modules.cfg so --stop actually stops the feeders.
More VEX enrichment sources and a VEX records UI
New SUSE CSAF VEX (#483) and Microsoft MSRC CSAF VEX (#469) metadata feeders join the Red Hat one introduced in 5.4.0. A new VEX records browse view allows pivoting from VEX documents to the corresponding CVEs, with index-level paging and input validation (#473).
New feeders: Rocky Linux, Ubuntu and TuxCare
New sources join the platform: Rocky Linux OSV (#482), Ubuntu USN (OSV) and TuxCare CSAF (#487), wired into the web interface and the README.
Profile photo and improved public profile
Users can now upload a profile photo, with Gravatar as fallback (#496). The public profile page was improved: stat tiles and profile links point to the author-filtered public pages, and the header stacks on small screens.
Changes
Admin — Admin interface redesign: the navbar Admin dropdown is replaced by a full-height sidebar on the admin pages, grouped by mission with an RBAC sub-navigation and a user menu at the bottom. The Maintenance card moved to a dedicated page, the user list can be filtered by role (with role user counts linking to it), breadcrumbs were dropped and the page headings harmonized.
CWE — Modernized the CWE views: singular /cwe endpoint (with 301 redirects from the legacy paths), vex-style browse list and harmonized detail page; /api/cwe/ can now filter out Discouraged and Prohibited CWEs.
Sync — Sturdier synchronization of large backfills: pages are streamed with bounded transactions, transient page failures are retried and last_sync is kept on incomplete runs, JSON decode errors are caught per page, and the sightings page size was lowered (#492, #494, #495).
Feeders — The Red Hat VEX feeder uses the canonical CSAF metadata URL, and csaf_tibco is disabled by default (the endpoint returns 403).
Documentation — Listed the recently merged feeders in the README and fixed the source gaps.
Dependencies — Updated Python dependencies (including cryptography 48.0.1 via gcve 0.12.1) and bumped the pinned CodeQL actions.
Fixes
Feeders — The cvelistv5 vendor/product indexes converge on the shared CNA+ADP helper, and containers.adp is iterated as a list so the adp:shortName:* indexes are actually populated.
Feeders — The VARIoT feeder paginates its imports itself with small pages, instead of tripping the API's failures on large limits.
Feeders — The Rocky Linux OSV feeder walks all Apollo pages and dedups against the index (the Apollo API shifts records between pages), and the OSV git mirrors are synced with fetch + reset instead of pull.
Sightings — Invalid CVE identifiers are rejected by the vulnerability id regex.
Disclosure — Imported the names is_public_disclosure relies on and fixed test type errors.
🙏 A big thank you to all contributors and testers!
Feedback and Support
If you encounter any issues or have suggestions, feel free to open a ticket on our GitHub repository: github.com/vulnerability-looku… Your feedback is always appreciated!
Motivation
Ingest OSV advisories published by Rocky Linux's Apollo service where no git repo/dump is available by consuming the Apollo paginated OSV API and mapping records into the existing O...
DNS4EU is a privacy-first DNS resolver by the European Union and Whalebone, available for free to all European citizens under the GDPR.
The service is anonymized and offers child protection, ad blocking, DNSSEC, IPv4, IPv6, DoH, DoT, and anycast, ensuring excellent privacy and minimal latency regardless of your location.
Your browsing data stays within the EU and is protected from cyber threats without being monetized!
Experience DNS4EU, the European security ecosystem led by Whalebone. Access our free Public Service for private browsing or upgrade to DNS4GOV for professional-grade government and critical infrastructure protection.
DNS4EU is a privacy-first DNS resolver by the European Union and Whalebone, available for free to all European citizens under the GDPR.
The service is anonymized and offers child protection, ad blocking, DNSSEC, IPv4, IPv6, DoH, DoT, and anycast, ensuring excellent privacy and minimal latency regardless of your location.
Your browsing data stays within the EU and is protected from cyber threats without being monetized!
Experience DNS4EU, the European security ecosystem led by Whalebone. Access our free Public Service for private browsing or upgrade to DNS4GOV for professional-grade government and critical infrastructure protection.
