Does anyone have any info about the Ahold Delhaize cybersecurity incident? Seems like all of their subsidiary grocery store websites were immediately taken down.

They said “payment info not believed to have been affected” but we have heard that before where a large company will give an update and say there was a compromise.

Stop and Shop is the only online website I can thing of where I actually store my credit card, so not sure if I should be cancelling it.

Anyone have the inside scoop?

Hi everyone,

I've tried this on the r/hue board with no luck. Trying here now. I'm talking the Philips Hue lighting system and the dimmer switch. If you don't know, it's a bunch of different lights that are controlled by a hub and, I think, the Zigbee protocol of IoT things. There are also stock and 3rd party apps

I have 2 dimmer switches, and I noticed recently that there's a large light jump when hitting the dimmer's brighter/dimmer buttons. The app has a brighness scale of 0-100, and the physical dimmer switches jump the brightness by 20 for each press, up or down.

I'm told there is definitely a way to change that number for something else, but the agent was reluctant to tell me specifically how. I want to change the skip steps so that the brightness changes like 5 steps each button push.

Anybody know anything about it? TIA!

Someone claims he hacked Denmark's national registry, CPR, thanks to a '123456' password at a small Danish IT and data service comapny (Pays ApS).

He sais he found 3 different accounts with the '123456' password.

This person got access to 8.8 million people records - and while Dennmark has only ~5.5 million living residents the rest seem to be deceased or former residents.

I'd say this is a good way to start a hacking career. Minimal effort, maximun gain.

Hypothetically, suppose you discover several reasonably critical vulnerabilities in systems belonging to different organisations. You develop working exploits that can be used to gain unauthorised access to restricted systems or data.

Assume you've successfully tested the exploits and confirmed that they work, but you haven't stolen, modified or destroyed any data, and you haven't used the access for anything malicious.

Now imagine a random buyer offers you a substantial amount of money for one of these exploits.

Have you already committed a crime simply by exploiting the vulnerability to gain unauthorised access, even if you haven't done anything further?

Is possessing and selling a working exploit itself illegal, or does it depend on the circumstances?

Could you face prison time for selling it, even if you never personally use it for malicious purposes?

If the buyer subsequently uses the exploit to attack the organisation, could you be held criminally liable?

Would it make a legal difference if you genuinely didn't know what the buyer intended to do with it?

This is a hypothetical scenario.

I’m running arch but I installed the correct httpx via yay and I also have go installed, but whenever I try to run httpx it gives me command not found. I’m so confused, what else am I missing?
Yes I already know it’s the correct httpx not the python one

the craziest part is that he didn't even need real admin credentials. Microsoft's internal API never verified JWT signatures, letting him forge an authentication token. After getting past its other checks, changing the username field to "admin" gave him administrator-level access lmao.

to be clear, the 17.3 trillion figure refers to estimated rows potentially accessible across 17 analytics databases, not records he downloaded. He reported the vulnerability to Microsoft, and the reward? just $5,000.

holy crap, how does something like this make it into production tho?

PS: the 17 trillion users records i wrote in the title is wrong, the article only says db records

TL;DR: NVIDIA DCGM Exporter is a widely used monitoring tool that collects GPU metrics like utilization, memory, temperature, and power consumption from AI servers.
We discovered that thousands of these monitoring endpoints are exposed to the public internet, allowing anyone to inspect GPU infrastructure. Worse, we found a high-severity vulnerability (CVE-2026-47483, CVSS 8.2) that lets unauthenticated attackers exhaust server resources, crash GPU monitoring, and potentially disrupt AI workloads remotely.
A few other interesting findings:
2,100+ exposed GPU servers, revealing telemetry from 12,000+ GPUs worth ~$100M, including H100s, H200s, and Blackwell GPUs.
60% of exposed GPUs reported 0% utilization across our scans.
12,096 additional servers exposed infrastructure details, including OS, firmware, and networking information.
NVIDIA fixed the vulnerability following our responsible disclosure.
Full research: https://lava.security/research/cve-2026-47483-nvidia-dcgm-exporter-vulnerability

Hi Hacking Community,

I’ve got a laptop that I’m trying to flash the BIOS and clear the old password out but I’m not sure if I’m doing something wrong with the WSON8 pogo pins. Do you have any advice or suggestions for me to try? Every time I dump the ROM, there is a hash mismatch.

im using jermey's it lab's free ccna course but it's kinda long and exam focused. is there any other networking course more hacking focused or good in general.

Hello, Chrono Mock is an app which let's you manipulate other app time/date without changing the system clock, we can freeze time in other app, speed it up, jump in date and tons more. There is even built-in calendar for various dates problems (like 2038 and more).

Rust + WPF (GUI)

*I'm author of the tool, if you like it please give it a star on GitHub

I don’t want to pay a ridiculous $230+ yearly subscription fee. It’s too expensive. I just want to keep track of my sleep, rest, heart, lung health.

Did anyone else receive this notification supposedly from ASOS?

Based in UK

Where can I find a good hacking forum or a forum like hackforums.net that ISNT a honeypot.

Any onions ?

homepage now reads:

"So, Dread has been hacked! What's next?

If you are reading this, you are already on our site — just on Dread's domain, in case anyone missed that.

The condition for Dread is this: leave this domain alone. Get in the way, and the data can be published. A deal is on the table — we can hand the domain back, or pass it to someone else if they want it. The contacts further down are how that conversation starts."

apparently this happened several days ago but i'm baffled, i can't find any news discussing this and i accessed the site literally yesterday. not sure whether posting onions is allowed, you can find find the link on tor.taxi.

https://i.postimg.cc/3R7LCP09/image.png

I’m the author of Super Trouper, a single-binary MCP server that exposes Frida to coding agents for authorized app reverse engineering. It lets an agent connect to a device, inspect apps and processes, manage sessions, and run instrumentation scripts without a Python-based Frida setup.

We released v0.4.0 a few days ago; it updates the bundled Frida Core DevKit to v17.19.0 and adds four MCP tools: memory_read and memory_write for working with memory in an attached process, plus module_list and thread_list for inspecting loaded modules and threads. app_list and others now have several query scopes, and we renamed the MCP tools into clearer namespaces. If you already have workflows built around the old tool names, check them when updating.

Quick catch-up on the two previous releases: v0.3.0 added npm installation, Frida CodeShare snippet search/use, and general cleanup. v0.2.0 moved the project to the MIT license, added first-party Frida language bridges for ObjC, Java, and Swift, and enabled TypeScript in scripts and evaluations.

I’d appreciate feedback from people using Frida in iOS research: are these tool boundaries and the new app-list scopes useful in practice? What’s missing or awkward in your workflow, and which features would you like to see next? Let me know what you think.