SectionResearch
New techniques, papers and threat intelligence.
DOJ Seizes Nearly 400 Illegal World Cup Streaming Domains
U.S. authorities took down close to 400 sites illegally broadcasting World Cup matches, warning that pirate streams expose viewers to malware and…
WhatsApp Launches Username Reservations to Shield Phone Numbers
Meta is letting WhatsApp users reserve a username now, ahead of a broader rollout later this year that will allow contacts to…
Supreme Court: Geofence Searches Require a Warrant Under Fourth Amendment
In a 6-3 ruling, the Supreme Court held that police must obtain a warrant before accessing cellphone location history from tech companies,…
Android Expands Theft Protection with Smarter Locks and Default-On Safeguards
Google has rolled out a suite of Android theft protection updates, tightening authentication controls, extending Identity Check coverage to third-party apps, and…
Chrome Bets on Merkle Tree Certificates for Post-Quantum HTTPS
Google is developing a new certificate ecosystem built on Merkle Tree Certificates to deliver quantum-resistant HTTPS without the bandwidth penalties of traditional…
Project Zero Examines the Limits of Mutational Grammar Fuzzing
A Google Project Zero researcher outlines two fundamental weaknesses in coverage-guided grammar fuzzing and describes a practical technique for working around them.
Google VRP Pays Out Record $17M in 2025, Marking 15-Year Anniversary
Google's Vulnerability Reward Program hit an all-time high in 2025, awarding over $17 million to more than 700 researchers worldwide, a 40-plus…
Chrome Launches Device Bound Session Credentials to Block Cookie Theft
Google's DBSC feature ties authentication sessions to hardware security modules, making exfiltrated cookies useless to attackers. It is now publicly available on…
Google Integrates Rust DNS Parser into Pixel 10 Modem Firmware
Google's Pixel team has embedded a memory-safe Rust-based DNS parser into the Pixel 10 cellular baseband, targeting a class of memory-safety vulnerabilities…
CISA Contractor Leaked AWS GovCloud Keys and Plaintext Passwords on GitHub
A public GitHub repository maintained by a Nightwing contractor exposed highly privileged AWS GovCloud credentials, plaintext passwords, and internal CISA system files…
Cisco Talos Uncovers BadIIS Malware-as-a-Service Ecosystem Tied to Chinese-Speaking Cybercrime
Cisco Talos researchers have identified a commodity BadIIS malware variant powering a mature malware-as-a-service operation used by Chinese-speaking threat actors to conduct…
Netherlands Seizes 800 Servers, Arrests 2 in Russian Cyberattack Infrastructure Bust
Dutch financial crime investigators arrested two men and seized over 800 servers tied to hosting infrastructure used to support Russian-linked DDoS attacks,…