The YubiKey user who thinks they are safe We recorded an attack on an account protected by a YubiKey. An infostealer on the victim’s laptop copies the browser session cookies, the attacker loads them on their own machine, and they are logged in without the YubiKey ever being asked for. The key did its job at login, but the session created after login is a separate thing it does
On October 21, 2026, PHP released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell". Their severity is rated 9.2 out of 10. PHP2Shell allows an attacker to run code on your server remotely, without logging in or having an account on your website. A single crafted request can be enough. What is PHP? PHP is the language that runs
On October 17, 2026, a security researcher reported that 8 private keys belonging to eMudhra, an Indian certificate authority, were compromised. The problem? These keys were so weak that anyone could calculate them. Six of the affected certificates could be used to issue fake HTTPS certificates for legitimate websites, including banks, crypto exchanges, and wallet interfaces. An attacker could potentially impersonate a real website, intercept your connection, and access sensitive
At 04:59 UTC on 9 October, 30 TRON wallets quietly handed control to a new key. Their owners had not touched them. Eight minutes later, the money started moving, and within an hour the attacker had emptied wallets on six blockchains. Bitquery's on-chain investigation counts $93.2 million taken from 315 wallets. The victims had one thing in common: they bought their Ledger hardware wallets from
You think you're smart enough to spot any scam? Good. We built something to check. 99% of stolen funds in Web3 today are not smart contract hacks anymore, they're Operational Security issues: social engineering, fake job interviews, malicious Zoom calls. Most Web3 hacks don't start onchain, they start on someone's laptop. The Bybit hack ($1.4bn) started with a developer getting social
When you set up a YubiKey, you get two main options: register it as a security key, or save a passkey on it. Both are phishing-resistant, both use the same crypto under the hood. So what's the actual difference, and which one should you use? This article breaks down what each mode is, what it does inside your authentication flow, and which setup is the strongest. If
Subscribe to get the latest updates, straight to your inbox.