cfsolve is a Rust library and command-line tool that solves Cloudflare Turnstile widgets and challenge pages through HTTP requests, without launching a headless browser. It returns a widget token or, for a challenge page, a cf_clearance cookie and the protected page. Widget solving typically needs the page URL and sitekey; challenge solving fetches the page or accepts its HTML. The tool imitates a browser using a profile that describes its fingerprint and includes recorded responses to Cloudflare’s browser checks. A Safari-on-iPhone profile is provided, while Safari and Chrome-based profiles are supported. Creating additional profiles involves capturing and organizing response data, with a real browser and capture proxy helping collect it.
The project includes a CLI and an async Rust API. Users can select a widget by sitekey and provide its action or custom data, supply existing page HTML, or render a widget on a blank page when they have only its URL and sitekey. A unified operation handles either a widget or a challenge, and requests can use HTTP, HTTPS, or SOCKS proxies. Building requires the pinned Rust toolchain, CMake, a C/C++ compiler, libclang, and Git. The library can be reused across operations, which receive separate connections and cookies; clearance must be used with the same IP address and user agent as the profile. Errors distinguish retryable network or rejection failures from configuration issues and unsupported challenge changes.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
CVE-2026-98432 is a critical Linux IPv4 TCP handshake use-after-free, remotely exploitable without authentication and potentially allowing root command execution on servers with multipath TCP listeners. Upstream fixes are available, but Ubuntu and RHEL had not yet shipped patched kernels as of October 29, 2026. (atlasum.net)
Colin Percival discovered that Intel Hyper-Threading could leak cryptographic secrets and developed an exploit to recover an RSA key. He argues scholars who find security flaws should coordinate quietly with affected teams so patches are ready before public disclosure. (daemonology.net)
Binance says it has covered 90% of the $6.3 billion in cryptocurrency stolen in a hack and will absorb the losses rather than pass them to users. It has set aside more than $6.34 billion and says sourcing the remaining assets may take longer. (bbc.com)
Plymouth canceled its Flock license-plate camera contract after the system wrongly tracked a couple, but the company did not respond to removal requests. The police chief disconnected the cameras’ power to ensure they stopped recording vehicles. (thedrive.com)
A hacking group said it exploited a vulnerability in software used to manage LED advertising screens, displaying pornographic footage on a highway billboard in Egypt and accessing screens in several other countries. Egyptian authorities opened an investigation and suspended roadside displays, while the incident raised questions about security at the billboard operator. (cairoreport.org)
VOLTA infostealer steals credentials, financial data, and personal details, then sends an evidence bundle to an LLM to rank victims by potential value. If a model refuses, the malware tries a chain of other models, making AI a key part of its intelligence-gathering workflow. (blog.talosintelligence.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.