96 posts
On September 19, 2026, SlowMist together with OKX's security team disclosed that iOS app FomoPeek versions 1.1 and 1.2 shipped with an iOS kernel exploit framework, able to break out of the sandbox and read and decrypt the system Keychain — exposing private keys, seed phrases and login credentials. Affected iOS versions: 12.0–18.7 and 26.0–26.1.
Citing severe storage constraints, Tsinghua University's TUNA mirror site has removed its Anaconda, OpenWrt, Flutter and GitLab EE mirrors. Existing URLs now redirect to the CERNET joint mirror site or to upstream.
GitLab has notified users that it will stop serving accounts in Mainland China, Hong Kong and Macao, and plans to delete those accounts after September 7, 2026. If you got the email, back up your code, project data and CI configuration as soon as possible.
Some Coldcard firmware releases seeded keys from a predictable software pseudo-random number generator, which means private keys could be brute-forced offline.
After 1Password raised prices by 33%, I nearly switched to Bitwarden — but one critical problem made me stay. This post compares the mainstream password managers, analyzes the risks of Passkey lock-in, and shares how to boost security with a YubiKey and successfully negotiate a 25% renewal discount.
Recently, Chinese developers logging into GitLab Global (gitlab.com) were shown a notice titled 'Important Change to Your GitLab.com Account'. The gist: individuals and organizations in Mainland China, Macao and Hong Kong need to migrate their accounts to GitLab China (JiHu) within 60 days, after which the accounts will be deleted.
On December 3, 2024, Cloudflare updated its 'Cloudflare Self-Serve Subscription Agreement', explicitly banning IP cherry-picking (deliberately selecting specific Cloudflare edge IPs) and building proxies (circumvention tunnels) on its platform.
In early February 2024, Freenom reclaimed every free domain — yes, all of them. Log into Freenom and check your domain status: everything shows PENDING.
Recently a new extortion scheme targeting webmasters has emerged from the black/gray industry, and even Baidu is powerless against it — no fix yet. Today I'm exposing how it works from a technical angle.
Fellow webmasters: on November 30, 2023, Baidu's webmaster platform revoked all [Quick Index] and [sitemap] submission privileges. For the record: the revocation has nothing to do with using my [webmaster push tool]. See Baidu Search Resource Platform's December 1, 2023 announcement.
