STM32MP2 silicon bug discovered in custom firmware project
Author finds security-impacting silicon bug in STM32MP2 while developing custom firmware without vendor SDKs.
Stories per day · 30 days
Relatedbug-bounty3ai-marketing1akamai1apple1github1hackerone1ios1iphone1php1research-skills1responsible-disclosure1silicon-bug1stm32mp21tailscale1threat-intelligence1
12 stories, newest first · one card per story
Stories tagged #security-research
HackerOne CEO says humans still better than AI at judging business impact of vulnerabilities
According to HackerOne CEO Kara Sprague, humans excel at assessing business consequences of flaws while AI finds vulnerabilities at scale
1
Blogger rejects LLMs for research and criticizes AI security marketing
The post contrasts Calif, OpenAI and Wiz narratives on PHP flaws and says a Tailscale hash drop was not responsibly disclosed.
1
Apple accepts Security Research Device applications through October 30
Approved researchers get a 12-month loaner iPhone with shell access, custom entitlements, and kernel changes.
Bug bounty sharpens researcher security skills
GitHub spotlight researcher r31n who improves skills through validation and proof of concepts on GitHub Enterprise.
1
Akamai post outlines rapid response and AI threat intelligence
The October 22 post by Akamai Security Intelligence Group is truncated after an outline point on pre-disclosure preparation.
2
The False Allure of "Security by Obscurity": A Game-Theoretic Approach
A game-theoretic model shows obscured systems suffer more successful attacks in equilibrium than open systems.
SAML: A fractal of bad design
Security research argues SAML is a legacy protocol with fundamental design flaws and should be deprecated for OpenID Connect.
2
Some cheap smart glasses are a security disaster
NSB Cyber and Abstract Shield found a dozen flaws in cheap smart glasses, including unauthenticated Bluetooth pairing letting attackers hijack cameras and intercept data.
1
I accidentally turned LLM memory into program analysis
A pwning.systems write-up describes how LLM memory functionality was unexpectedly repurposed into a program analysis technique.
Just a rumour of a bug is enough to find a security exploit these days
Commentary argues that an unverified rumor of a software bug is now enough for researchers or attackers to develop a working exploit.
A revisit of remote Spectre attacks on Cloudflare Workers
Cloudflare details its 2024-2025 reassessment of remote Spectre attacks on Workers, covering new attack primitives and hardened defenses.