# hacking Published articles for hacking. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Modern Android Hacking DevFeed: [Modern Android Hacking]() Original publisher: [Read original article]() Author: dustin@dustn.dev (Dustin Summers) Published: 2026-09-17T04:13:15.404035Z Content type: article Language: en Sources: [Dustin Summers]() Topics: [Hacking](), [Android]() Tags: [android](), [hacking](), [modern](), [presentation](), [summit](), [video]() ### AI overview A presentation titled "Modern Android Hacking" was given at the 2020 Android Summit, which was hosted virtually due to the pandemic. The page provides a video of the presentation. ### Source excerpt This presentation was given at the 2020 Android Summit which was hosted virtually due to the pandemic Video of Presentation: ## Developer commentary on agentic hacking, AI persistence, and LLM programming DevFeed: [Developer commentary on agentic hacking, AI persistence, and LLM programming]() Original publisher: [Read original article]() Author: Martin Fowler (martin@martinfowler.com) Published: 2026-09-16T20:05:00Z Content type: opinion Language: en Sources: [Martin Fowler]() Topics: [Artificial Intelligence](), [Large Language Model](), [Hacking](), [Programming](), [Wiki](), [hugging face]() Tags: [agentic](), [agents](), [ai](), [build](), [engineering](), [hacking](), [llms](), [persistence]() ### AI overview This collection of developer commentary discusses reports of agentic hacking involving RubyGems, Hugging Face, and Wiki attacks, including questions about OpenAI's disclosure and log review. It also examines AI systems' unpredictable behavior, improvements in reasoning and persistence, and the use of harnesses to control LLM-based programming. ### Source excerpt Reports of agentic hacking continue, in this case it happened back in May and it seems OpenAI did not disclose that they were responsible. Simon Willison sees two options: After the Hugging Face and Wiki attacks OpenAI were still unable to review their previous logs and determine that they had previously attacked RubyGems. They knew about the attack on RubyGems and made the decision not to reach out to the RubyGems team about it. Both of these are bad! Given this incident, the Hugging Face situation, and the Wiki attack, the obvious question right now is how many more incidents like this are out there waiting to be discovered? ❄ ❄ ❄ ❄ ❄ Dave Farley: Stop asking the sci-fi question: 'Is it conscious?' Start asking the engineering question: 'Is this a powerful, unpredictable component being put somewhere consequential, and where's the feedback that tells us that it's safe? ❄ ❄ ❄ ❄ ❄ Nate Silver is known for his forecasts, but to do them he writes a lot of code for his models. He's found agentic programming capable of doing miraculous work. In spending so much time with the LLMs, I'm super attentive to improvements in their capabilities. And these changes tend not to be so linear. Instead, they improve in step functions, almost as phase changes. Suddenly, the models just start doing things capably that they were screwing up before. In my experience, there was a big leap forward when reasoning models first came out in late 2024/early 2025 -- enough that they were occasionally useful for tasks involving data and not just words -- and then another one this past winter. The most recent changes I've noticed, however, have had less to do with intelligence and more with persistence. Consider the Hugging Face attack. Although these agents showed remarkable intelligence, they weren't really super-intelligent - but they were super-persistent. This is a common theme of AI in its various forms: Game engines like AlphaGo Zero start out by basically making random moves -- but by playin ## Steam Frame vs. Quest 3 Specs: Better PC Streaming, Power & Hackability DevFeed: [Steam Frame vs. Quest 3 Specs: Better PC Streaming, Power & Hackability]() Original publisher: [Read original article]() Author: Scott Hayden Published: 2026-09-14T16:59:00Z Content type: comparison Language: en Sources: [Road to VR]() Topics: [Streaming](), [pc](), [Linux](), [Steam Deck](), [Windows](), [Operating system](), [Arm]() Tags: [arm](), [cameras](), [compatibility](), [devices](), [hacking](), [linux](), [meta-quest-3-news-reviews](), [news](), [os](), [pc](), [pc-vr-news-reviews](), [pcie](), [steam-deck](), [streaming](), [windows](), [x86]() ### AI overview This comparison examines Valve's Steam Frame standalone headset against Quest 3. Steam Frame is designed to run Steam's flatscreen and PC VR libraries, stream PC VR games wirelessly through a dedicated Wi-Fi 6E dongle, and support native x86 Windows and Linux content through a compatibility layer. Compared with Quest 3, it offers a more powerful Qualcomm Snapdragon processor, a more open and hackable SteamOS platform, an accessible gen4 PCIe expansion port, and broader compatibility, although its application compatibility is not yet as established. ### Source excerpt Want to know how Valve's Steam Frame standalone headset stacks up against the competition? Read on to find out. Steam Frame is a lot like Steam Deck; it can play pretty much all of Steam's game library out of the box, which includes flatscreen content based on x86 architecture--basically everything on Steam--and also now PC [...] The post Steam Frame vs. Quest 3 Specs: Better PC Streaming, Power & Hackability appeared first on Road to VR. ## FREE-WILi 2 portable hacking multitool features two RP2350 MCUs, ESP32-C5, ICE40 FPGA, and Raspberry Pi CM0 DevFeed: [FREE-WILi 2 portable hacking multitool features two RP2350 MCUs, ESP32-C5, ICE40 FPGA, and Raspberry Pi CM0]() Original publisher: [Read original article]() Author: Debashis Das Published: 2026-09-09T00:00:02Z Content type: news Language: en Sources: [CNX Software - Embedded Systems News]() Topics: [Embedded Systems](), [Raspberry Pi](), [ESP32-C5](), [Hardware](), [Hacking](), [Linux]() Tags: [802-15-4](), [ble](), [bluetooth](), [broadcom-bcmxxxx](), [c-c-plus-plus](), [can](), [electronics](), [embedded](), [esp32](), [esp32-c5](), [espressif](), [fpga](), [hack](), [hacking](), [hardware](), [lattice](), [linux](), [lora](), [meshtastic](), [nfc](), [open-hardware](), [python](), [raspberry-pi](), [raspberry-pi-rp2350](), [rfid](), [rust](), [security](), [som](), [stm32](), [stmicro-stm32](), [texas-instruments-simplelink](), [thread](), [tools](), [video](), [wi-fi](), [wifi-6](), [wireless](), [zigbee]() ### AI overview The FREE-WILi 2 Founder Edition is an open-hardware, portable multitool for hardware hackers, pentesters, and embedded-system developers. It combines two Raspberry Pi RP2350 MCUs, an ESP32-C5, a Lattice ICE40UP5K FPGA, and a Raspberry Pi CM0 capable of running a full Linux OS, along with touchscreen controls, expansion headers, and multiple wireless interfaces. ### Source excerpt The FREE-WILi 2 (Founder Edition) is an open-hardware, portable hacking multitool and lab designed for hardware hackers, pentesters, and embedded system developers. Designed as an "open electronics multitool," it combines a range of chips and modules into a handheld device, including two Raspberry Pi RP2350 MCUs, an ESP32-C5 for wireless connectivity, a Lattice ICE40UP5K FPGA, and a Raspberry Pi CM0 for running a full Linux OS. The device also features a 3.5-inch capacitive touchscreen, a 14-button physical interface, and modular "Orca" headers for hardware expansion. Its wireless features include 2.4/5GHz Wi-Fi, Bluetooth, LoRa, sub-GHz RF, NFC, 125kHz RFID, and IR. These features make it very suitable for wireless testing, embedded hardware debugging, real-time control, electronics development, and retro gaming, with support for Adafruit Fruit Jam, PICO-8, and Doom. FREE-WILi 2 specifications: Compute Main MCUs - 2x Raspberry Pi RP2350B (One for main controls, one dedicated to display) SoM - Raspberry [...] The post FREE-WILi 2 portable hacking multitool features two RP2350 MCUs, ESP32-C5, ICE40 FPGA, and Raspberry Pi CM0 appeared first on CNX Software - Embedded Systems News. ## Latent Powers DevFeed: [Latent Powers]() Original publisher: [Read original article]() Author: Armin Ronacher Published: 2026-09-05T00:00:00Z Content type: opinion Language: en Sources: [Armin Ronacher]() Topics: [Dongle](), [Hacking](), [Rust](), [Embedded Software Dev](), [Protocol (disambiguation)](), [Raspberry Pi]() Tags: [ai](), [dongle](), [firmware](), [hacking](), [protocol](), [raspberry-pi](), [rust](), [soc](), [thoughts](), [usb]() ### AI overview A developer experiments with modifying a cheap CarPlay dongle to run custom code while preserving regular CarPlay functionality. After receiving a different SoC than expected, they use LLM-assisted discussions to flash the device and compile CatPlay, a Rust reimplementation of the CarPlay protocol, for the hardware. ### Source excerpt A few weeks ago I felt like it would be fun to see if I can make one of those cheap Chinese CarPlay dongles run something other than the stock firmware. The idea was that rather than just forwarding CarPlay, why not do something more interesting with them? They all work quite similarly: they act as bridges between your car and the phone. From there they deal with video and audio streams and pass some other data through. Most of them also bring up a custom UI for pairing and have a web interface that your phone can reach for updates. Long story short: I had a conversation with Fable and Sol via Pi about what could be done with such a dongle or whether I should use a Raspberry Pi instead if I wanted to do my own thing there. I figured it might be quite fun to run my own code while still allowing regular CarPlay to pass through. Through working with the LLM I learned about CatPlay, which is a Rust reimplementation of the CarPlay protocol that can run on Carlinkit devices. In particular, it can run on the Carlinkit Mini Ultra, which I figured would be easy enough to buy. I do have a few CarPlay adapters around, but I did not have that particular model, so I bought one on Amazon. Twenty-four hours later, I had a device in my hand that was branded as a Carlinkit Mini Ultra, but instead of being the Ingenic device that the original author used, it turned out to be something else. This is normally where the story would stop. However, it's 2026. Armed with a bit of knowledge about how these systems work, I managed to have some fruitful discussions with Kimi K3 and Sol and figure out how flash the device and in turn, how to make CatPlay compile for that SoC. I guess that hacking these USB devices is not necessarily hard, but it's laborious and you can easily end up bricking your devices. It also just sucks because sometimes you need to work with someone else's code that does not itself run on your machine. In the past, I would abandon many such projects for lack of tenacity. ## LLMs Have Reshaped How We Think About Decompilation and Collaboration DevFeed: [LLMs Have Reshaped How We Think About Decompilation and Collaboration]() Original publisher: [Read original article]() Published: 2026-06-10T00:00:00Z Content type: opinion Language: en Sources: [mahaloz.re]() Topics: [codex](), [Hacking](), [coding](), [harvestbench]() Tags: [agents](), [codex](), [collaboration](), [hacking](), [ida](), [ida-pro](), [llm-agents](), [llms](), [musing](), [reversing](), [workflows]() ### AI overview This think piece examines how LLM agents and Codex are changing software decompilation and hacking workflows. It focuses on the shift from humans directly using reversing tools to humans supervising agents, and on the resulting need to coordinate agents, validate findings, and improve information sharing. It also connects these challenges to the authors' earlier work on BinSync, a decompiler collaboration framework. ### Source excerpt How LLM agents are changing decompilation workflows, collaboration, and the future of reversing tools. ## Hacking Workshop for June/July 2026 DevFeed: [Hacking Workshop for June/July 2026]() Original publisher: [Read original article]() Author: Robert Haas (noreply@blogger.com) Published: 2026-06-02T18:36:18Z Content type: news Language: en Sources: [Robert Haas]() Topics: [Hacking](), [PostgreSQL](), [IO](), [observability]() Tags: [2026](), [announce](), [hacking](), [io](), [mentoring](), [observability](), [postgresql](), [sessions](), [sign-up]() ### AI overview The June/July 2026 PostgreSQL Hacking Workshop will feature Melanie Plageman discussing her talk "Additional IO Observability in Postgres with pg_stat_io." Interested participants can sign up to receive an invitation. ### Source excerpt I was hoping to usual resume the monthly cadence of hacking workshops in June, but it didn't quite happen, largely due to being a little exhausted after pgconf.dev. But, I'm pleased to announce that Melanie Plageman will be joining us to discuss her talk Additional IO Observability in Postgres with pg_stat_io. If you're interesting in joining us, please sign up using this form and I will send you an invite to one of the sessions. As always, thanks to Melanie for joining us.Read more " ## Hacking Workshop for April/May 2026 DevFeed: [Hacking Workshop for April/May 2026]() Original publisher: [Read original article]() Author: Robert Haas (noreply@blogger.com) Published: 2026-03-18T19:47:00Z Content type: opinion Language: en Sources: [Robert Haas]() Topics: [PostgreSQL](), [Hacking]() Tags: [2026](), [conference](), [event](), [hacking](), [mentoring](), [postgresql](), [workshop]() ### AI overview The author plans a combined April and May hacking workshop covering Masahiko Sawada's PGCon 2022 talk, "Breaking away from FREEZE and Wraparound." Interested participants can sign up to receive an invitation. The post also mentions PGConf.dev 2026, scheduled for May 19-22 at Simon Fraser University in Vancouver, Canada. ### Source excerpt I'm planning to hold a single hacking workshop for April and May combined, covering Masahiko Sawada's talk, Breaking away from FREEZE and Wraparound, given at PGCon 2022. If you're interested in joining us, please sign up using this form and I will send you an invite to one of the sessions. Thanks to Sawada-san for agreeing to join us. Read more " ## Insecure Dava India Pharmacy APIs Exposed Super Admin Users and Enabled Privileged Account Creation DevFeed: [Insecure Dava India Pharmacy APIs Exposed Super Admin Users and Enabled Privileged Account Creation]() Original publisher: [Read original article]() Author: Eaton Published: 2026-02-14T03:07:20Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Exploit](), [Hacking](), [Website](), [account](), [password reset](), [passwords](), [Next.js]() Tags: [account](), [exploit](), [hacking](), [next-js](), [password](), [website]() ### AI overview A security write-up describes insecure super-admin APIs on Dava India Pharmacy's website. The APIs exposed a list of super-admin users without authentication, and testing indicated that creating a super-admin account was a supported operation. ### Source excerpt Super admin exploit on Dava India Pharmacy's website gave complete control over everything. ## Hacking Workshop for February 2026 DevFeed: [Hacking Workshop for February 2026]() Original publisher: [Read original article]() Author: Robert Haas (noreply@blogger.com) Published: 2026-01-15T18:26:00Z Content type: article Language: en Sources: [Robert Haas]() Topics: [PostgreSQL](), [Process]() Tags: [2026](), [hacking](), [mentoring](), [postgresql](), [workshop]() ### AI overview A February 2026 hacking workshop will host two or three small-group discussions about Amit Langote's talk, "Hacking Postgres Executor For Performance," presented at PGConf India 2025. Participants can discuss PostgreSQL technology, project choices, and the community patch process with the speaker. ### Source excerpt For next month, I'm scheduling 2 or 3 discussions of Amit Langote's talk, Hacking Postgres Executor For Performance, given at PGConf India 2025. If you're interested in joining us, please sign up using this form and I will send you an invite to one of the sessions. Thanks to Amit for agreeing to attend the sessions.Read more " ## exploits.club Weekly(ish) Newsletter 92 - S23 N-Day PoCs, Printer Overflows, DNG OOB Writes, And More DevFeed: [exploits.club Weekly(ish) Newsletter 92 - S23 N-Day PoCs, Printer Overflows, DNG OOB Writes, And More]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-11-21T16:10:47Z Content type: article Language: en Sources: [exploits.club]() Topics: [Hacking](), [Exploit](), [Security](), [Vulnerabilities](), [Linux](), [Kernel](), [GPU](), [Qualcomm](), [samsung](), [Android](), [ctf](), [Advent of Code]() Tags: [android](), [code](), [ctf](), [exploits](), [gpu](), [hacking](), [kernel](), [linux](), [newsletter](), [printer](), [qualcomm](), [samsung]() ### AI overview The 92nd exploits.club Weekly(ish) Newsletter rounds up recent developer and security content, including Advent-themed CTFs, Advent of Code 2025, Binary Ninja 5.2, conference slides, an exploit for Qualcomm GPU microcode vulnerability CVE-2025-21479 on a Samsung S23, Linux KASLR research, and printer security flaws. ### Source excerpt We are so back. Annnnnyways 👇 In Case You Missed It... HEX ADVENT 2025: Crack the Advent, Conquer the Threat - STAR Labs has put together a Holiday Themed CTF open to women residing in Singapore or Malaysia. Advent of Code 2025 - It's almost the most wonderful time of ## Hacking Displate (For Fun!) DevFeed: [Hacking Displate (For Fun!)]() Original publisher: [Read original article]() Author: Dan Lew Published: 2025-11-18T15:00:46Z Content type: opinion Language: en Sources: [Dan Lew Blog]() Topics: [Hacking](), [Website](), [API](), [Browser Extension](), [browser](), [data]() Tags: [api](), [browser](), [extension](), [hacking](), [order](), [scraping](), [tracking](), [website]() ### AI overview A developer documents experiments with Displate's website, including tracking Limited Edition resale prices and using its API to discover early-access links. The article also describes ordering a Limited Edition before its public release and competing with another person using a browser extension to find links and monitor inventory. ### Source excerpt During the pandemic my weird vice/obsession became Displates (metal wall art hung up by magnets): Some of my Displates (along with other tchotchkes in my office) For me, part of the hobby was poking holes in their website. I've long stopped trying to give their devs heartburn, ## LixCon in 2026 DevFeed: [LixCon in 2026]() Original publisher: [Read original article]() Published: 2025-11-05T00:00:00Z Content type: release Language: en Sources: [News on Lix]() Topics: [Nix](), [Development]() Tags: [2026](), [announce](), [collaboration](), [conference](), [development](), [event](), [hacking]() ### AI overview LixCon 2026 will take place in Paris from April 17 to 19, 2026. The event will focus on the Lix interpreter and its internals, with talks on the first day followed by hands-on development, discussions, and collaboration. Attendance will be limited to 200 people. ### Source excerpt LixCon 2026 - this coming April, in Paris We won't bury the lede: we're super excited to announce that our first LixCon will take place from the 17th to 19th of April, 2026, in Paris! ## Hacking India's largest automaker: Tata Motors DevFeed: [Hacking India's largest automaker: Tata Motors]() Original publisher: [Read original article]() Author: Eaton Published: 2025-10-29T01:05:40Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Hacking](), [Vulnerabilities](), [Amazon Web Services](), [Amazon S3](), [API keys](), [data](), [Encryption]() Tags: [amazon](), [aws](), [credentials](), [database](), [encryption](), [hacking](), [india](), [s3](), [vulnerabilities]() ### AI overview The article describes four security findings involving Tata Motors discovered in 2023. It reports that exposed AWS keys on public-facing websites enabled access to sensitive information across many S3 buckets, that weakly encrypted keys could be decrypted, that a Tableau backdoor allowed passwordless login as users including an administrator, and that an exposed Azuga API key compromised a test-drive fleet management system. The author states that the disclosed credentials were rotated and that testing did not download substantial amounts of data or show obvious evidence of malicious access. ### Source excerpt Tata Motors gave away the keys to their infrastructure and customer data on their public websites. ## exploits.club Weekly Newsletter 89 - iOS GPU Driver Bugs, Kernel Stack UAFs, Hardware Wallet Auth Bypasses, and More DevFeed: [exploits.club Weekly Newsletter 89 - iOS GPU Driver Bugs, Kernel Stack UAFs, Hardware Wallet Auth Bypasses, and More]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-10-16T15:00:32Z Content type: article Language: en Sources: [exploits.club]() Topics: [iOS](), [Security](), [GPU](), [vulnerability](), [Hacking](), [Memory Safety](), [UEFI]() Tags: [firmware](), [gpu](), [hacking](), [ios](), [memory-safety](), [security](), [vulnerability]() ### AI overview This weekly newsletter rounds up security research and announcements, including an iOS GPU kernel driver vulnerability whose patched underflow could enable out-of-bounds read/write, though modern allocator hardening may prevent a practical exploit. It also covers x86 memory-safety instructions, Apple security bounty changes, and a Nokia Beacon 1 router teardown involving UART access, command injection, and password generation. ### Source excerpt Our NBA Finals game 7 prediction didn't go too well earlier this year, but mark these words now: Piastri and Lando are taking each other out at USGP this week. Annnnnnyways 👇 In Case You Missed It... Save the Date for OffensiveCon26 - May 15th and 16th of next ## Vulnerabilities in a centralized automaker dealer platform enabled access to more than 1,000 US dealerships DevFeed: [Vulnerabilities in a centralized automaker dealer platform enabled access to more than 1,000 US dealerships]() Original publisher: [Read original article]() Author: Eaton Published: 2025-10-13T15:13:09Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [vulnerability](), [Exploit](), [Hacking](), [account]() Tags: [account](), [automotive-industry](), [hacking](), [us](), [vulnerabilities](), [vulnerability]() ### AI overview The article describes two vulnerabilities in a top automaker's centralized dealer platform: missing invite-token verification and a missing privilege check in account creation. The author states that these flaws enabled creation of a national admin account with access to systems across more than 1,000 US dealerships. ### Source excerpt On August 10, 2025 at DEF CON 33 in Las Vegas, I presented what could possibly be the biggest vulnerability I may ever discover in the automotive industry. Read and watch how I managed to take over a top automaker's entire dealer ecosystem. ## Hacking smarter with Burp AI: NahamSec puts Burp AI to the test DevFeed: [Hacking smarter with Burp AI: NahamSec puts Burp AI to the test]() Original publisher: [Read original article]() Author: Andrzej Matykiewicz Published: 2025-10-01T14:31:40Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Artificial Intelligence](), [Hacking](), [Bug Bounty](), [AI Infrastructure]() Tags: [ai](), [ai-infrastructure](), [bug-bounty](), [features](), [free](), [hacking](), [video](), [youtube]() ### AI overview NahamSec demonstrates how Burp AI fits into a real bug bounty and security testing workflow, including Repeater, Scanner follow-up, and recorded logins. The AI features run on demand within PortSwigger's secure AI infrastructure. Burp Suite Professional users receive 10,000 free AI credits. ### Source excerpt Bug bounty legend, NahamSec, has taken Burp AI for a spin. If you're curious how Burp AI fits into a real workflow, his new video is the perfect place to start. Watch on YouTube Burp AI was built to a ## exploits.club Weekly Newsletter 83: Windows Kernel and Xbox Exploit Research, Plus an LLM-Assisted Security Tool DevFeed: [exploits.club Weekly Newsletter 83: Windows Kernel and Xbox Exploit Research, Plus an LLM-Assisted Security Tool]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-08-21T15:00:46Z Content type: article Language: en Sources: [exploits.club]() Topics: [Hacking](), [Windows](), [Linux Kernel](), [Large Language Model](), [Code]() Tags: [exploit](), [hacking](), [kernel](), [linux-kernel](), [llms](), [race-condition](), [vulnerability](), [windows]() ### AI overview This issue of the exploits.club weekly newsletter highlights a Phrack anniversary release, a Phrack CTF, research into a Windows kernel vulnerability that was adapted to target Xbox One, and a new LLM-related security analysis tool. The supplied text ends before the tool's details are complete. ### Source excerpt We are getting dangerously close to hacking fueled by PSLs. Get your cozy VS Code color schemes ready...Annnnnnyways 👇 In Case You Missed It... Phrack 4oth Anniversary Release - If you weren't lucky enough to get snag a physical copy from one of the recent cons, the digital ## Intel Outside: Hacking every Intel employee and various internal websites DevFeed: [Intel Outside: Hacking every Intel employee and various internal websites]() Original publisher: [Read original article]() Author: Eaton Published: 2025-08-18T14:15:43Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Hacking](), [intel](), [hardcoded credentials](), [Vulnerabilities](), [Security](), [Exploit](), [Encryption](), [Authentication](), [Angular](), [Azure]() Tags: [angular](), [authentication](), [azure](), [credentials](), [encryption](), [exploit](), [hacking](), [hardcoded-credentials](), [intel](), [security-vulnerabilities]() ### AI overview This security investigation describes vulnerabilities in several internal Intel websites. The issues included bypassing corporate login controls, exploiting easily decryptable hardcoded credentials, and using client-side modifications to access employee and supplier information. ### Source excerpt Hardcoded credentials, pointless encryption, and generous APIs exposed details of every employee and made it possible to break into internal websites. ## exploits.club Weekly Newsletter 82 - Synology Decryption, AI Thought Traces, FortiWeb Auth bypasses, And More DevFeed: [exploits.club Weekly Newsletter 82 - Synology Decryption, AI Thought Traces, FortiWeb Auth bypasses, And More]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-08-14T15:00:35Z Content type: news Language: en Sources: [exploits.club]() Topics: [Synology](), [Artificial Intelligence](), [Encryption](), [Hacking](), [Traces](), [SQLite](), [nginx]() Tags: [ai](), [blog](), [bug](), [hacking](), [newsletter](), [nginx](), [release](), [sqlite](), [synology](), [traces](), [weekly]() ### AI overview The 82nd exploits.club weekly newsletter rounds up security research and developer resources, including Synology encrypted archive decryption, AI agent thought traces from vulnerability assessments, Black Hat slides, a radare2 release, and other security research. ### Source excerpt We hope everyone enjoyed drinking and partying as a business expense Hacker Summer Camp. Annnnnyways 👇 In Case You Missed It... Black Hat Slides Out! - Most of the links now have the associated slides for you to checkout. radare2 6.0.2 Release - Bug fixes and new features Resources And ## One Year of Hacking Workshops DevFeed: [One Year of Hacking Workshops]() Original publisher: [Read original article]() Author: Robert Haas (noreply@blogger.com) Published: 2025-07-17T20:24:00Z Content type: article Language: en Sources: [Robert Haas]() Topics: [Hacking](), [PostgreSQL]() Tags: [hacking](), [mentoring](), [postgresql](), [workshops]() ### AI overview Robert Haas reviews the first year of PostgreSQL Hacking Workshops, covering participation, recurring attendance, speaker involvement, discussion quality, and opportunities to attract more newcomers. ### Source excerpt I started running PostgreSQL Hacking Workshops just about one year ago, and I've run one each month, except for May, when we had pgconf.dev. Signups are now open for August, if you're interested in joining us for a discussion of Peter Geoghan's talk on Multidimensional search strategies for composite B-Tree indexes, but I'd also like to take a few minutes to summarize where we are after one year of hacking workshops, both the good and the maybe not quite as good. So here goes. Read more " ## Mentoring Applications and Hacking Workshop for April 2025 DevFeed: [Mentoring Applications and Hacking Workshop for April 2025]() Original publisher: [Read original article]() Author: Robert Haas (noreply@blogger.com) Published: 2025-03-19T15:04:00Z Content type: news Language: en Sources: [Robert Haas]() Topics: [PostgreSQL](), [Hacking](), [.NET Conf]() Tags: [2025](), [hacking](), [mentoring](), [postgresql](), [workshop]() ### AI overview A March 2025 update announces a one-on-one mentoring program for PostgreSQL contributors, an April discussion of a talk about autovacuum, and plans to skip the May hacking workshop because of 2025.pgconf.dev. ### Source excerpt Here are a few mentoring-related updates.Read more " ## Fetch the Flag CTF 2025 Community Writeups DevFeed: [Fetch the Flag CTF 2025 Community Writeups]() Original publisher: [Read original article]() Author: Gina Fitzpatrick Published: 2025-03-05T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [ctf](), [Security](), [Web](), [Discord]() Tags: [2025](), [blog](), [community](), [ctf](), [developer](), [discord](), [hacking](), [learning](), [security]() ### AI overview This blog presents community write-ups from Fetch the Flag CTF 2025, showing how participants solved web, binary, and exploitation challenges. It also directs readers to official write-ups and further community insights in Discord. ### Source excerpt Discover how players tackled the challenges in Fetch the Flag CTF 2025! This blog features community write-ups breaking down solutions to web, binary, and exploitation challenges. ## Top 10 web hacking techniques of 2024 DevFeed: [Top 10 web hacking techniques of 2024]() Original publisher: [Read original article]() Author: James Kettle Published: 2025-02-04T15:01:48Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Hacking](), [Application Security](), [Security](), [web applications](), [OAuth](), [Cache](), [account takeover](), [LocalStorage](), [JavaScript]() Tags: [2025](), [account-takeover](), [cache](), [chatgpt](), [cookies](), [hacking](), [oauth](), [research](), [security](), [techniques](), [web](), [xss]() ### AI overview This annual community-powered review identifies notable web security research and hacking techniques from 2024. The supplied excerpts discuss OAuth flow hijacking through Cookie Tossing, risks involving cookies and JavaScript's Same-Origin Policy, and a ChatGPT account takeover using inconsistent decoding, path traversal, and Web Cache Deception. ### Source excerpt Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year [Next page]()