Top all-time · #754
DoublePulsar
Personal blog · doublepulsar.comsecurity
DoublePulsar is a personal blog at doublepulsar.com about security. Since 2017, 85 different Hacker News readers have linked it 111 times, most often “Recall: Stealing everything you've ever typed or viewed on your own Windows PC”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Sometimes recommended · 7 of 40 sampled comments recommend it, 3 are critical?
Why HN links it
HN readers link Kevin Beaumont's DoublePulsar Medium blog for security write-ups, often as the original source behind a headline, on incidents such as the xz backdoor and Windows Recall.
- Recommended for · 7 comments
- Commenters call the posts good write-ups, more informative than alternatives, accurate, and worth reading.
- Criticised for · 3 comments
- Called reductive and clickbaitish; evidence said not to back its headline; one quote disputed by other reporting.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Recall: Stealing everything you've ever typed or viewed on your own Windows PC11 people · 14 mentions · first linked 2024-05-31
- Outsourcing of IT and cybersecurity functions risks UK economic security7 people · 7 mentions · first linked 2025-09-16
- Small numbers of Notepad++ users reporting security woes4 people · 4 mentions · first linked 2025-12-02
- Merry Christmas Day Have a MongoDB Security Incident4 people · 4 mentions · first linked 2025-12-27
- CyberSlop – meet the new threat actor, MIT and Safe Security4 people · 4 mentions · first linked 2025-11-04
- Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set3 people · 3 mentions · first linked 2018-01-09
- Claude Code VS Code extension with backdoor released on Cursor marketplace3 people · 3 mentions · first linked 2026-10-30
- Inside the failed attempt to backdoor SSH globally that got caught by chance3 people · 3 mentions · first linked 2024-04-01
- Hijack of Amazon’s domain service used to reroute web traffic for two hours3 people · 3 mentions · first linked 2018-04-24
- Windows 10 x64 LPE zero-day2 people · 2 mentions · first linked 2018-08-28
What Hacker News says?
Why was version 2.1.313 silently deleted from OpenVSX, Visual Studio Marketplace and Cursor then? https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
Comment linking /anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2
on “Backdoor in Claude Code for VS Code extension on the Cursor Marketplace”Submitted Hijack of Amazon’s domain service used to reroute web traffic for two hours as a story · 1048 points
HN discussionFrom https://doublepulsar.com/anthropic-hacked-to-deliver-remote-... Notable customers who run Claude Code and Cursor on laptops include Binance, amongst thousands of others. Did the Claude Code plugin hack cause the Binance theft? The timing seems like an incredible coincidence.
Comment linking /anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2?gi=cdd002d52f6f
on “Backdoor in Claude Code for VS Code extension on the Cursor Marketplace”Submitted Oracle attempt to hide cybersecurity incident from customers? as a story · 638 points
HN discussionSome more details https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
Comment linking /anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2
on “Backdoor in Claude Code for VS Code extension on the Cursor Marketplace”Submitted Recall: Stealing everything you've ever typed or viewed on your own Windows PC as a story · 443 points
HN discussionAdditional information about the Kaseya angle: https://doublepulsar.com/kaseya-supply-chain-attack-delivers...
Comment linking /kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
on “US companies hit by 'colossal' cyber-attack”Submitted Claude Code VS Code extension with backdoor released on Cursor marketplace as a story · 399 points
HN discussionThat's probably because of this (as mentioned in the timeline): >2024-02-29: On GitHub, @teknoraver https://github.com/systemd/systemd/pull/31550 to stop linking liblzma into libsystemd. It appears that this would have defeated the attack. https://doublepulsar.com/inside-the-failed-attempt-to-backdo... that knowing this was on the way may have accelerated the attacker’s schedule. It is unclear whether any earlier di…
Comment linking /inside-the-failed-attempt-to-backdoor-ssh-globally-that-got-caught-by-chance-bbfe628fafdd
on “The xz attack shell script”Submitted Inside the failed attempt to backdoor SSH globally that got caught by chance as a story · 221 points
HN discussionMicrosoft has made misleading statements regarding encryption [0] and it doesn’t help much. Encryption at rest doesn’t much matter if the user being logged in is enough for the data to be decrypted. This is the context malware runs in. https://doublepulsar.com/recall-stealing-everything-youve-ev...
Comment linking /recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e
on “Microsoft will switch off Recall by default after security backlash”Submitted Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set as a story · 188 points
HN discussionOn 2024-02-29, a PR was sent to stop linking liblzma into libsystemd [0]. Kevin Beaumont speculated [1] that "Jia Tan" saw this and immediately realized it would have neutered the backdoor and thus began to rush to avoid losing the very significant amount of work that went into this exploit; I think he's right. That rush caused the crashing seen in 5.6.0 and the lack of polish which could have eliminated or reduced…
Comment linking /inside-the-failed-attempt-to-backdoor-ssh-globally-that-got-caught-by-chance-bbfe628fafdd
on “The xz sshd backdoor rabbithole goes quite a bit deeper”Submitted HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10 as a story · 171 points
HN discussionNeither these two paragraphs or the source they’re paraphrasing ( https://doublepulsar.com/recall-stealing-everything-youve-ev... ) indicate anything matching the headline at all. The source article is a QA with himself. There’s 1 tweet references, that shows a screenshot of a truncated SQLite db that shows a log of the applications opened via the user UI shell: https://x.com/gossithedog/status/1796218726808748367?s…
Comment linking /recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e
on “Recall: Stealing everything you've ever typed or viewed on your own Windows PC”Submitted Regarding Marcus Hutchins aka MalwareTech as a story · 119 points
HN discussionMicrosoft does not make it easy to give them the benefit of the doubt. See, for example, the Recall debacle. https://doublepulsar.com/recall-stealing-everything-youve-ev...
Comment linking /recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e
on “Microsoft blocks Windows 11 workaround that enabled local accounts”Submitted How the new Microsoft Recall feature fundamentally undermines Windows security as a story · 89 points
HN discussionThere's a lot of confusing information out there as you have found out. This link helps clarify the steps needed. https://doublepulsar.com/important-information-about-microso... Pay specific attention to the dataflow. Registry keys have to be set in a certain order in order for a) the patch to download and install and b) actually enable. If there is not a BIOS fix (I'm in the same boat as you), the other hope is tha…
Comment linking /important-information-about-microsoft-meltdown-cpu-security-fixes-antivirus-vendors-and-you-a852ba0292ec
on “Microsoft disables Windows Update when Meltdown/Spectre registry key isn't set”Submitted Burning Zero Days: FortiJump FortiManager vulnerability used by nation state as a story · 39 points
HN discussion> The security concerns apply regardless of Recall existing. Not quite. Because there is a world of difference between an attacker being able to grab information that is being entered or temporarily present, or permanently present and encrypted, and an attacker being able to, within seconds, grab everything the user ever did, watched, saw, entered, etc. on his machine in one fell swoop: https://doublepulsar.com/reca…
Comment linking /recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e
on “Stealing everything you've ever typed on your Windows Recall PC is now possible”Submitted Things to know before getting into cyber security (2018) as a story · 37 points
HN discussionIMO the link should point at the original source: https://doublepulsar.com/recall-stealing-everything-youve-ev... The blog post is insanely reductive and clickbaitish
Comment linking /recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e
on “Stealing everything you've ever typed on your Windows Recall PC is now possible”Submitted Lockergoga took down Hydro–ransomware used in targeted attacks on business as a story · 34 points
HN discussion.do is struts, well known for a myriad of security holes. https://webmasters.stackexchange.com/questions/9907/in-a-uri... https://doublepulsar.com/apache-struts-and-the-three-leading...
Comment linking /apache-struts-and-the-three-leading-us-credit-agencies-7c2bf1c9661e
on “The Fed Is Down”Submitted Citrix forgot to tell you CVE-2025–6543 has been used as a zero day since May as a story · 26 points
HN discussionThis is a good write-up and I like the diagrams. What appears to still be notably missing from eBPF is an "off switch". AFAIK there are still no kernel boot time commands [0] to disable eBPF entirely. I have to recompile the kernel to disable it and it is known that most people will not do this. eBPF has the potential for file-less malware to run hidden from detection and I foresee the ability to tickle ring -3 (and…
Comment linking /bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896?gi=a1053e659852
on “eBPF – Adding functionality to OS at runtime”Submitted Anthropic hacked to deliver remote access trojan to Claude developer laptops as a story · 14 points
HN discussionThat quote is interesting because all of the period reporting I’ve seen says that the attackers did NOT successfully get an HTTPS certificate and the only people affected were those who ignored their browsers’ warnings. https://doublepulsar.com/hijack-of-amazons-internet-domain-s... https://blog.cloudflare.com/bgp-leaks-and-crypto-currencies/
Comment linking /hijack-of-amazons-internet-domain-service-used-to-reroute-web-traffic-for-two-hours-unnoticed-3a6f0dda6a6f
on “Why do we need DNSSEC?”Submitted BPFDoor – an active Chinese global surveillance tool as a story · 13 points
HN discussion
