Security blogs

Cloudflare's engineering and policy team posts on network infrastructure, security incidents, DDoS attacks, and internet protocols.

Top post: Why We Terminated Daily Stormer

Bruce Schneier, a security technologist and cryptographer, writes about security, cryptography, privacy, and the policy around them.

Top post: Write Down Your Password

Brian Krebs, a former Washington Post reporter, investigates cybercrime, data breaches, and fraud.

Top post: Try This One Weird Trick Russian Hackers Hate

Simon Willison, a developer and co-creator of Django, writes about LLMs, prompt injection, and AI-assisted programming.

Top post: AI agent lethal trifecta: private data, untrusted content, exfiltration vectors

The Signal Foundation's blog announces features and explains design choices for the Signal encrypted messenger, including privacy technology previews.

Top post: Why federated protocols don't work (2016)

Sophos's Naked Security blog explains security incidents, bugs, and best practices in plain terms, covering SSL, passwords, and certificates.

Top post: Anatomy of a “goto fail” – Apple’s SSL bug explained (2014)

Microsoft's Tech Community hosts official posts from product teams on Windows, Azure, Microsoft 365, Edge, and enterprise administration.

Top post: Lambda: Turn Excel formulas into custom functions

The Chromium Blog is Google's official channel for Chrome and Chromium news on extensions, privacy, performance, and web platform changes.

Top post: From Chrome Apps to the Web

Troy Hunt is a security researcher and Microsoft MVP who writes about data breaches, HTTPS, passwords, and the Have I Been Pwned service.

Top post: "Pwned Passwords" V2 With Half a Billion Passwords

Google's Security Blog covers its security research and engineering, including memory safety in Android, Chrome certificate policy, and cryptography.

Top post: Memory Safe Languages in Android 13 Reduce Vulnerabilities

An independent journalist-owned outlet covering technology, surveillance, hacking, and AI, founded by former Vice Motherboard reporters including Joseph Cox.

Top post: The Pitch Deck for 'Active Listening' Ad Targeting

Daniel J. Bernstein's site, with his cryptography and security software, such as qmail and djbdns, and papers and essays on security.

Top post: The IPv6 Mess

Daniel Stenberg, lead developer of curl, writes about maintaining the project, security reports, and internet protocols.

Top post: Death by a Thousand Slops

The blog of Let's Encrypt, the nonprofit certificate authority that issues free TLS certificates, covering policies, rate limits, and statistics.

Top post: Challenge types

Google's Project Zero security team publishes detailed write-ups of vulnerabilities and exploits, mainly in iOS, Android, and browsers.

Top post: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

The Tor Project's official blog covers the anonymity network, Tor Browser, security advisories, and privacy tools.

Top post: Tor security advisory: “relay early” traffic confirmation attack

Matthew Green, a cryptography professor at Johns Hopkins, explains cryptographic engineering, encryption products, and surveillance topics.

Top post: What's the Matter with PGP?

Lawfare is a blog on national security law and policy, with posts on surveillance, cybersecurity, encryption, and executive power.

Top post: What Ben Franklin Said (2011)

Andrew "bunnie" Huang, a hardware hacker, writes about open hardware, chip inspection, manufacturing in Shenzhen, and his legal and design projects.

Top post: On Hacking MicroSD Cards

The research blog of Kaspersky's GReAT team, publishing malware analyses, APT reports, and investigations of state-linked cyber espionage.

Top post: Operation Triangulation: What you get when attack iPhones of researchers

Robert Graham writes about cybersecurity, hacking, encryption and surveillance, often with a political angle.

Top post: How the Intercept Outed Reality Winner

Google's Android team announces platform changes, developer policies, and security features, including developer verification and sideloading rules.

Top post: Google adds 24-hour wait and mandatory reboot to Android sideloading flow

Adam Langley, a Google security engineer, writes about TLS, certificates, browser security, and authentication such as WebAuthn.

Top post: Overclocking SSL

Bellingcat is an investigative group that uses open-source intelligence to identify people behind poisonings, military attacks and intelligence operations.

Top post: How We Identified Navalny's FSB Stalkers

Filippo Valsorda, a cryptography engineer and Go maintainer, writes about cryptography, security tools like age, and open source work.

Top post: The most backdoor-looking bug I’ve ever seen (2021)

The Open Whisper Systems blog, later Signal's, covering the Signal Protocol, the WhatsApp encryption partnership and private contact discovery.

Top post: Reflections: The ecosystem is moving

PortSwigger, maker of Burp Suite, publishes web security research on HTTP request smuggling, HTTP/2 flaws and browser-based attacks.

Top post: Burp

Matthew Garrett is a Linux developer who writes about UEFI Secure Boot, firmware, power management, TPMs and free software licensing.

Top post: Implementing UEFI Secure Boot in Fedora

lcamtuf is Michal Zalewski, a security researcher and author of AFL and p0f who also writes about machining, electronics and robotics.

Top post: American fuzzy lop – a security-oriented fuzzer

Colin Percival is the founder of Tarsnap and a FreeBSD developer, and writes on cryptography, security and operating systems.

Top post: Hacker News Daily

Freedom to Tinker is a Princeton CITP blog on security, privacy, tech policy and Bitcoin, with posts by Ed Felten and colleagues.

Top post: The Linux Backdoor Attempt of 2003 (2013)

Auth0's company blog covers identity and authentication for developers, including JWT vulnerabilities, JavaScript history and engineering hiring.

Top post: Auth0 announces a free production ready free plan and a free unlimited oss plan

Phrack is a long-running hacker e-zine, started in 1985, publishing technical papers on exploitation and security along with hacker culture writing.

Top post: Hacker’s Manifesto (1986)

Microsoft's official TechNet blogs cover Windows, SQL Server, security guidance and engineering announcements from various teams.

Top post: Me too

Trail of Bits, a security research and consulting firm, writes about cryptography, program analysis, VPN tooling, and smart contract audits.

Top post: RSA is a fragile cryptosystem

Intel's corporate newsroom, posting official announcements on processors, memory, chip manufacturing, and responses to security vulnerabilities.

Top post: Intel Responds to Security Research Findings

Ted Unangst, an OpenBSD developer, writes about C, security, cryptography, and operating system internals.

Top post: Honk: An ActivityPub server with minimal setup and support costs

Malwarebytes, a security software company, writes news and analysis on malware, scams, privacy issues, and data breaches.

Top post: GrayKey iPhone unlocker poses serious security concerns

Darknet Diaries is a podcast by a cybersecurity professional telling true stories of hackers, breaches, and cyber crime.

Top post: Being spied on by the makers of Pegasus, then lured them into a trap

David A. Wheeler writes on software security, open source, and safe coding, and is the creator of the SLOCCount tool.

Top post: Countering Trusting Trust Through Diverse Double-Compiling (DDC)

News site covering the OpenBSD operating system, with release notes, security advisories such as OpenSSH bugs, and developer write-ups.

Top post: Cgi

Bert Hubert, a Dutch engineer, writes on telecom security, European digital sovereignty, open source regulation, and technical reverse engineering.

Top post: Reverse Engineering the Source Code of the BioNTech/Pfizer SARS-CoV-2 Vaccine

Daniel Miessler, a security professional, writes about infosec, Unix tools, tutorials, and more recently AI.

Top post: Building a Successful Information Security Career (2008)

Microsoft's Security Response Center publishes vulnerability disclosures, incident investigations, and security policy posts such as those on memory-safe languages.

Top post: A proactive approach to more secure code

Google's security team blog covering bug bounties, certificate authority actions, encryption, SHA-1 retirement, and reCAPTCHA.

Top post: Google bug bounties: $500-$3133.7 for security flaws in *.google.com

The official blog of npm, the JavaScript package manager, covering policy changes, security incidents, and new features.

Top post: Kik, left-pad, and npm

The CircleCI engineering blog covers continuous integration, incident reports, security incidents, and engineering practices at the company.

Top post: “It's The Future”

Coda Hale is a software engineer who writes on password storage, cryptographic timing attacks, distributed systems theory, and how organizations work.

Top post: How To Safely Store A Password

Moxie Marlinspike, the founder of Signal, writes about cryptography, privacy, TLS, GPG, and web3.

Top post: My First Impressions of Web3

Michał Zalewski (lcamtuf), a security researcher and author of the fuzzer AFL, writes about vulnerabilities, fuzzing, and web security.

Top post: Pulling JPEGs out of thin air

Nick Berry wrote DataGenetics, with math and data analyses of PIN numbers, puzzles, games, and QR codes.

Top post: Analysis of bank PIN numbers

The security company CrowdStrike's blog, covering threat intelligence, intrusion analyses, and its post-incident reviews of the July 2024 outage.

Top post: Bears in the Midst: Intrusion into the Democratic National Committee

The blog of Snyk, a security company that scans open-source dependencies for vulnerabilities, with reports on npm, JVM, and Node.js security.

Top post: NPM package compromised by author: erases files on RU / BY computers on install

ESET's security research blog, reporting on malware, rootkits, backdoors, and attacks by state-linked groups.

Top post: LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group

Netcraft's news blog, reporting web server market share surveys, hosting trends, and TLS certificate issues.

Top post: IIS is 0.15% away from beating Apache as most popular web server

The SANS Internet Storm Center diary is a daily log by security handlers covering malware, vulnerabilities, internet threats, and practical security tips.

Top post: How to Find Hidden Cameras in Your Airbnb

Legal and policy analysis site covering national security, international law, surveillance and U.S. government actions, written by lawyers and academics.

Top post: Litigation Tracker: Legal Challenges to Trump Administration Actions

Neal Krawetz writes on image forensics, fake photo detection, online abuse material detection, Tor and other security topics.

Top post: One Bad Apple

Kaspersky's security blog covers malware discoveries, vulnerability research, and threat investigations.

Top post: CamScanner, a malicious Android app with more than 100M downloads in Google Play

A group blog by law professors, including Orrin Kerr, on constitutional law, criminal law, surveillance, and court rulings.

Top post: The Criminal Charges Against Aaron Swartz – Part 2: Prosecutorial Discretion