Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
93 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_21d43dfae5b42186a2Collection status unverifiedLast successful batch: Unverified
src_85b5039c8403974534Collection status unverifiedLast successful batch: Unverified
src_cfc4f5388458c6f7fcCollection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
SonicWall patched a CVSS 10 pre-auth SSRF flaw in SMA1000 appliances that could let unauthenticated attackers reach internal functions. SonicWall released hotfixes for four vulnerabilities in its SMA1000 remote access appliances, including a critical flaw tracked as CVE-2026-102255 (CVSS score of 10.0. The issue is a pre-authentication SSRF bug in the WorkPlace portal that could […]
First reported Oct 07, 2026 18:17 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
Connection Allowlist is a new browser security mechanism that lets a document declare, up front, the exact set of destinations it's permitted to open network connections to. Anything not on the list is blocked by the browser before the connection leaves the machine. It's currently a
First reported Jul 08, 2026 16:11 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
We’ve open-sourced dbsc-php, a small PHP library that makes it easier to deploy Device Bound Session Credentials and turn stolen session cookies into something far less useful. It's MIT-licensed, pure-PHP, and available on Packagist now!What is DBSC?If you'd
First reported Jun 08, 2026 14:00 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
Device Bound Session Credentials (DBSC) is Chrome's answer to session cookie theft, usually by InfoStealer malware. Instead of a cookie being a bearer token that works anywhere it's pasted, DBSC binds the session to a private key that lives in your device's hardware and
First reported Aug 11, 2026 14:25 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
This week, I published a blog post about Device Bound Session Credentials, a new technology that will significantly hamper the efforts of Infostealers and reduce the damage caused by stolen cookies. Today, we're announcing the beta of DBSC at Report URI!Device Bound Session CredentialsYou should definitely
First reported Jun 05, 2026 14:22 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
This is part two of the ten-year anniversary Top 1 Million Analysis. Part one covered the broad state of the web — HTTPS, the security headers, cookies, email and DNS hygiene. This part is the bit I've been most excited to write: a focused look at the
First reported Jul 01, 2026 11:57 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
A stolen session cookie can be vastly more powerful than a stolen password. The attacker doesn’t need to phish the user, bypass MFA, or defeat their passkey; they simply replay the cookie and step straight into a fully authenticated session. That’s why info-stealers love browser
First reported Jun 02, 2026 10:59 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
Every other web platform feature I've ever written about, I've been able to test in some easy way. Open DevTools, type the name of the thing, see if it's there. Device Bound Session Credentials doesn't work like that: there is no way
First reported Aug 21, 2026 13:42 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
Back in 2017, Troy Hunt and I built a little website called whynohttps.com. The idea was simple: take the most popular sites on the internet, check which ones still weren't redirecting visitors to HTTPS, and put the laggards on a list for everyone to see. No lecture,
First reported Jun 22, 2026 13:22 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
A single support ticket became the front door to 275 million student records. The Canvas breach shows how quickly untrusted user content can become a serious security incident when it is rendered inside privileged internal tooling. This was not an exotic attack chain; it was stored XSS, over-scoped access,
First reported Jun 15, 2026 12:21 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
We shipped Device Bound Session Credentials at Report URI, open-sourced the server-side implementation, and then discovered a long list of things the specification doesn't prepare you for.Some caused random logouts. One could deadlock a browser tab indefinitely. Two silently turned a device-bound session back
First reported Aug 10, 2026 16:06 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
Passkeys are the best thing to happen to web authentication in years, but a passkey ceremony is only as secure as the stack enforcing it. The browser, the relying party, the authenticator, and any extension sitting between them all need to honour the same rules.While investigating WebAuthn behaviour, I
First reported May 21, 2026 14:40 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
It's been a long time since the last one of these! The previous Top 1 Million Analysis was way back in June 2022, and a lot has happened since then. But there's a much bigger reason to dust off the crawler and publish another report: this
First reported Jun 29, 2026 13:40 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
On 27 August 2026, Manchester Airports Group told customers that "an unauthorised third party" had stolen their data. Car park bookings, lounge bookings, Fast Track purchases for airport security and passport control, along with airport WiFi sign-ups across Manchester, Stansted and East Midlands. Roughly 8.8 million
First reported Sep 07, 2026 09:13 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
I recently went on an epic road trip around Europe, covering 1,645 miles (2,647 km), and we took in some amazing sights and locations. As a tech geek, I was worried about my connectivity on the trip, so before we set off, I came up with a plan!
First reported Aug 24, 2026 13:50 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
Every now and then I go digging through Report URI's Threat Intelligence data feeds, looking for domains that show up in CSP reports where they really shouldn't. Last week one jumped out at me: netdna-ssl.com. If you've been around the WordPress world
First reported Jun 24, 2026 13:11 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
Researchers at Northeastern University, in collaboration with Consumer Reports, evaluated how much modern cars spy in their drivers: The new Northeastern study shows, for the first time, data flowing among the vehicles, the vehicle apps you download when you buy your car, and third-party companies, documenting exactly what kind of data gets siphoned from our vehicles and which companies are receiv
First reported Oct 01, 2026 11:06 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
Apple just released a system called “Reference Image.” It can verify the image is exactly as taken by an iPhone—new models only—without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone. Other industry solutions require a photographer or institution to vouch for an image using their own credentials. We are concerned this puts some phot
First reported Oct 07, 2026 11:07 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
The EU is recommending import controls to combat unregulated squid fishing in the Southwest Atlantic. I’m not optimistic. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
First reported Oct 02, 2026 21:02 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
St. Lucie County in Florida discovered (alt link) a dozen Flock cameras whose ownership it can’t identify, and that the county government had not permitted. I am reminded of the decade-old story of StingRay cell phone surveillance devices in Washington, DC, whose operators were also unknown. My guess is that in the StingRay case, the devices were operated by foreign actors. This Flock case is more
First reported Oct 02, 2026 14:52 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
Modern messaging apps allow users to link their phone accounts to their computer desktop. Eavesdroppers are taking advantage of this capability: Apps such as WhatsApp Web and Signal Desktop allow people to use their accounts on other devices, such as laptops or desktop computers. Germany’s Customs Office has been using these features to connect a police-controlled computer to a suspect’s account.
First reported Sep 29, 2026 11:02 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
This essay was written with Nathan E. Sanders, and originally appeared in The Guardian. New campaign finance disclosure data shines a light on which US political campaigns are using AI tools and how much they are spending on them. Candidates’, parties’ and committees’ spending reveals that AI is fast becoming an essential tool of politics. The candidates themselves are quiet about how they are usi
First reported Oct 02, 2026 11:02 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
ArsTechnica is reporting on a “new” attack against RSA, one that bypasses factoring. First, this attack isn’t new. The original research is from 2007. What is new is the implementation. Second, it is a forgery attack. It allows an attacker to forge digital signatures. It does not recover the private key from the public key. Third, the attack only works against pure signatures. That is, signatures
First reported Sep 28, 2026 11:02 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
AI systems are regularly completing tasks in ways that their prompters don’t want or intend. Some of them are disturbing, and some of them are dangerous. This is something I’ve been calling “genie behavior,” because I think that really gets at the core of what’s happening. I wish the popular press would report on this better. I don’t like the “going rogue” framing because it deflects the responsib
First reported Sep 30, 2026 11:05 UTCCatalog metadata updated Oct 08, 2026 03:49 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.