Engineering &
Security Wire
Curated from Hacker News, Lobsters, Krebs on Security, and other top sources. Updated every 6 hours.
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service (PhaaS) operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion, artificial intelligence (AI)-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts. Distributed via Telegram and costing $400 a month (or $3,800 per year), attack chains leverage phishing
I'm Making Strandfall, a Solarpunk Orienteering Larp
53 points, 11 comments on Hacker News
Java News Roundup: TornadoVM 5, JHipster, Google ADK, OmniFish Build of Payara, Introducing Vidocq
This week's Java roundup for July 6th, 2026, features news highlighting: the GA release of TornadoVM 5.0; point releases of JHipster, Keycloak and Google ADK; maintenance releases of GraalVM Native Build Tools and Micronaut; the OmniFish Build of Payara and introducing Vidocq, a new implementation of the Jakarta EE 11 Core Profile and MicroProfile 7.1. By Michael Redlich
Empowering India’s next generation of innovators with ATL Saathi
Google and AIM launched ATL Saathi, a Gemini-powered AI tool empowering Indian educators in robotics labs.
Presentation: Road to Compliance: Will Your Internal Users Hate Your Platform Team?
Davide de Paolis discusses the realities of rolling out cloud infrastructure compliance without fracturing developer relations. Drawing from a real-world platform team reboot at Sevdesk, he explains how to implement "minimum viable governance" on AWS, utilize event-driven Slack alerting to automate policy feedback, and shift from rigid enforcement to high-empathy, data-driven collaboration. By Davide de Paolis
Land Atlas – soil, farmability, and crop analysis for land listings
18 points, 3 comments on Hacker News
Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling
Meta has filed a patent application for an AI that listens to your voice throughout the day, works out how it thinks you are feeling from the way you sound, and keeps a timestamped log of every read. Each read gets pinned to the moment it happened: the time, your location, what you were doing, even how you were using your phone. Some versions in the filing would listen all day; others would
Show HN: DOM-docx – HTML to native, editable Word docs (MIT)
Article URL: https://github.com/floodtide/dom-docx Comments URL: https://news.ycombinator.com/item?id=48891267 Points: 74 # Comments: 22
Control the Ideas, Not the Code
Article URL: https://antirez.com/news/169 Comments URL: https://news.ycombinator.com/item?id=48891184 Points: 152 # Comments: 107
Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots
A few days ago, I was sitting with the CISO of a Fortune 50 company, walking through how his security team was thinking about AI agents in the SOC. Smart team. Serious program. They had already connected Claude to a few detection tools and were seeing real value in specific investigations. But as we mapped out the broader architecture, something kept nagging at me. The design they were building
crates.io: development update
Comments
A voxel Tokyo in real Japan time – ride the Yamanote line and study Japanese
Article URL: https://jivx.com/densha Comments URL: https://news.ycombinator.com/item?id=48890959 Points: 189 # Comments: 21
Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory
Cybersecurity researchers have flagged an intrusion in which an unknown threat actor leveraged a vibe-coded PowerShell script for Active Directory (AD) enumeration. "The script looked for the Domain Controller (DC) and mapped users, computers, and domains, before creating a directory and exporting out a number of files, and finally creating AD_Report.html to measure the success of the
Article: Removing a Hidden Round Trip from a Multi-Region AWS API
When a series of regional outages forced a rethink of a multi-region AWS API, the team discovered that an obstacle to global failover was hiding in plain sight: a pre-flight discovery call baked into every client session years earlier as the only available option. This article describes what it took to remove it, and what the rollout actually cost. By Suresh Gururajan
Podcast: Governance in the Age of AI: A Conversation with Sarah Wells
In this podcast, Michael Stiefel spoke to Sarah Wells about the relationship of governance to software architecture. Governance enables teams to work effectively by establishing procedures that minimize system complexity, improve security, and reduce repetitive tasks. Targeted checklists help engineers by reducing the stress over these procedures. By Sarah Wells
What are you doing this week?
What are you doing this week? Feel free to share! Keep in mind it’s OK to do nothing at all, too.
IPv6 over drainage pipe
Comments
Zig Creator Calls Spade a Spade, Anthropic Blows Smoke
152 points, 86 comments on Hacker News
Berkshire's $397B Bet Against an Overheated Market
26 points, 7 comments on Hacker News
Interrail: 6,379Km and 13 Countries over 7 weeks
45 points, 37 comments on Hacker News
WebExtension to query any HTML table with PRQL
Comments
Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365
An attacker running a live Microsoft 365 phishing operation left a Python web server listening on a public port with directory listing switched on. The command that did it: python3 -m http.server 8080, was still sitting in the readable .bash_history. From that one lapse, French security firm Lexfo lifted the operator's entire toolkit and pivoted through it to two more
How to Build More Resilient Local-First Applications With AT Protocol Infrastructure
Jake Lazaroff discussed the AT Protocol as a framework for distributed applications beyond social networking. He emphasised a local-first architecture where users maintain data in PDSs while leveraging shared infrastructure for synchronisation and updates. The presentation included experiments showcasing collaborative tools and highlighted the benefits of reduced reliance on app-specific backends. By Olimpiu Pop
A WWDC 27 Update on Building a Mac-assed App with SwiftUI
Comments
Hacker Fables - A satirical cyberpunk novella you can read as a man page
And with "GNU Info" too Comments
Backtrack-Free Cursive
84 points, 39 comments on Hacker News
Sam Neill has died
141 points, 34 comments on Hacker News
iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild. The vulnerabilities, both rated 10.0 on the CVSS scoring system, are below - CVE-2026-48939 - A vulnerability in the
The Graph That Should Be Front-Page News
48 points, 21 comments on Hacker News
Beavis Ultrasound PnP ISA Sound Card Replica
60 points, 21 comments on Hacker News
Aggregated from public RSS feeds & the Hacker News API · All links point to original sources · Clawship does not republish full articles