Recent articles
May 22, 2026
Friday Squid Blogging: Regulating Squid Fishing in the South Pacific
The South Pacific Regional Fisheries Management Organization (SPRFMO) needs to regulate squid fishing in the South Pacific.
As usual, you can also use this squid post to talk about the security sto...
www.schneier.com
May 22, 2026
CISA Security Leak
Crazy story:
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly...
www.schneier.com
May 21, 2026
macOS Kernel Memory Corruption Exploit
A group used Anthropic’s Mythos AI model to help find a kernel memory corruption vulnerability and exploit on Apple’s M5.
News article.
www.schneier.com
May 20, 2026
On AI Security
Good report:
Executive Summary: Let’s say you wanted to make sure that your AI is secure. Can you just maximize the security and privacy benchmark and call it a day? Nope, because benchmarks don’t ...
www.schneier.com
May 19, 2026
Laurie Anderson Is Quoting Me
Not by name, but Laurie Anderson quotes me in one of the tracks of her new album:
My favorite quote is from a cryptologist who said “If you think technology will solve your problems, you don’t unde...
www.schneier.com
May 18, 2026
Zero-Day Exploit Against Windows BitLocker
It’s nasty, but it requires physical access to the computer:
The exploit, named YellowKey, was published earlier this week by a researcher who goes by the alias Nightmare-Eclipse. It reliably bypas...
www.schneier.com
May 16, 2026
Friday Squid Blogging: Bigfin Squid
Article about the bigfin squid.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Blog moderation policy.
www.schneier.com
May 15, 2026
Bypassing On-Camera Age-Verification Checks
Some AI-based video age-verification checks can be fooled with a fake mustache.
www.schneier.com
May 14, 2026
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak:
I’m giving a virtual talk on “The Security of Trust in the Age of AI,” hosted by the Financial Women’s Association of New York, at...
www.schneier.com
May 14, 2026
How Dangerous Is Anthropic’s Mythos AI?
Last month, Anthropic made a remarkable announcement about its new model, Claude Mythos Preview: it was so good at finding security vulnerabilities in software that the company would not release it...
www.schneier.com
May 13, 2026
OpenAI’s GPT-5.5 is as Good as Mythos at Finding Security Vulnerabilities
The UK’s AI Security Institute evaluated GPT-5.5’s ability to find security vulnerabilities, and found that it is comparable to Claude Mythos. Note that the OpenAI model is generally available.
Her...
www.schneier.com
May 12, 2026
Copy.Fail Linux Vulnerability
This is the worst Linux vulnerability in years.
TL;DR
copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working...
www.schneier.com
May 11, 2026
LLMs and Text-in-Text Steganography
Turns out that LLMs are really good at hiding text messages in other text messages.
www.schneier.com
May 8, 2026
Friday Squid Blogging: Giant Squid Live in the Waters of Western Australia
Evidence of them has been found by analyzing DNA in the seawater.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Blog moderation p...
www.schneier.com
May 8, 2026
Insider Betting on Polymarket
Insider trading is rife on Polymarket:
Analysis by the Anti-Corruption Data Collective, a non-profit research and advocacy group, found that long-shot bets—defined as wagers of $2,500 or more at o...
www.schneier.com
May 7, 2026
Smart Glasses for the Authorities
ICE is developing its own version of smart glasses, with facial recognition tied to various databases.
www.schneier.com
May 6, 2026
Rowhammer Attack Against NVIDIA Chips
A new rowhammer attack gives complete control of NVIDIA CPUs.
On Thursday, two research teams, working independently of each other, demonstrated attacks against two cards from Nvidia’s Ampere gener...
www.schneier.com
May 5, 2026
DarkSword Malware
DarkSword is a sophisticated piece of malware—probably government designed—that targets iOS.
Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multi...
www.schneier.com
May 4, 2026
Hacking Polymarket
Polymarket is a platform where people can bet on real-world events, political and otherwise. Leaving the ethical considerations of this aside (for one, it facilitates assassination), one of the iss...
www.schneier.com
May 1, 2026
A Ransomware Negotiator Was Working for a Ransomware Gang
Someone pleaded guilty to secretly working for a ransomware gang as he negotiated ransomware payments for clients.
www.schneier.com
April 30, 2026
Fast16 Malware
Researchers have reverse-engineered a piece of malware named Fast16. It’s almost certainly state-sponsored, probably US in origin, and was deployed against Iran years before Stuxnet:
“…the Fast16 m...
www.schneier.com
April 29, 2026
Claude Mythos Has Found 271 Zero-Days in Firefox
That’s a lot. No, it’s an extraordinary number:
Since February, the Firefox team has been working around the clock using frontier AI models to find and fix latent security vulnerabilities in the br...
www.schneier.com
April 28, 2026
What Anthropic’s Mythos Means for the Future of Cybersecurity
Two weeks ago, Anthropic announced that its new model, Claude Mythos Preview, can autonomously find and weaponize software vulnerabilities, turning them into working exploits without expert guidanc...
www.schneier.com
April 27, 2026
Medieval Encrypted Letter Decoded
Sent by a Spanish diplomat. Apparently people have been working on it since it was rediscovered in 1860.
www.schneier.com
April 24, 2026
Friday Squid Blogging: How Squid Survived Extinction Events
Science news:
Scientists have finally cracked a long-standing mystery about squid and cuttlefish evolution by analyzing newly sequenced genomes alongside global datasets. The research reveals that ...
www.schneier.com
April 24, 2026
Hiding Bluetooth Trackers in Mail
It was used to track a Dutch naval ship:
Dutch journalist Just Vervaart, working for regional media network Omroep Gelderland, followed the directions posted on the Dutch government website and mai...
www.schneier.com
April 23, 2026
FBI Extracts Deleted Signal Messages from iPhone Notification Database
404 Media reports (alternate site):
The FBI was able to forensically extract copies of incoming Signal messages from a defendant’s iPhone, even after the app was deleted, because copies of the cont...
www.schneier.com
April 22, 2026
ICE Uses Graphite Spyware
ICE has admitted that it uses spyware from the Israeli company Graphite.
www.schneier.com
April 21, 2026
Mexican Surveillance Company
Grupo Seguritech is a Mexican surveillance company that is expanding into the US.
www.schneier.com
April 20, 2026
Is “Satoshi Nakamoto” Really Adam Back?
The New York Times has a long article where the author lays out an impressive array of circumstantial evidence that the inventor of Bitcoin is the cypherpunk Adam Back.
I don’t know. The article is...
www.schneier.com