CTO @TrustedSec | Former Optiv/SecureWorks/Accuvant Labs/Redspin | Race cars
/tmp/.a
- Tweets 67,863
- Following 5,021
- Followers 75,522
- Likes 146,050
I’m stuck in this loop:
“Use LLMs to find all the bugs”
Okay, which model?
“Model X found a bunch of bugs”
“Wait, another lab’s model found bugs that one missed.”
“Actually, a startup with a better harness found more using the same model.”
“Now another startup with a local model, a different harness, and talented researchers found bugs everyone else missed.”
“Hold on, the next frontier model just found another batch.”
All in the same attack surface that’s already been reviewed by everyone above.
21
21
145
7,284
Happy Saturday
Imagine if we had something called Active Directory or Windows, where some of the most impactful attack paths involve abusing legitimate functionality, trust relationships, and authentication mechanisms rather than memory corruption.
Finding novel ways to abuse these systems requires understanding how functionality interacts across complex environments, not just identifying bugs in code.
Weird how we aren’t seeing a flood of novel discoveries here from LLMs.
It raises an interesting question about whether the models and harnesses we’re building are even well suited to finding these types of issues.
Now consider how often ransomware groups, pentesters, and other attackers have actually relied on memory corruption exploits in these environments over the last 6–7 years.
Maybe we’re getting dramatically better at finding one class of security problem while overlooking much of what makes real world attacks successful.
8
7
58
3,729
Whoever is running around doing community notes
Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619).
Pure logic bug — no memory corruption,
ASAN-clean, orthogonal to the CVE-2026-109618/19 class.
Receipt: uid=33(www-data) over HTTP, one-shot
#infosec #php2shell #php
Community note
The claimed RCE on fully-patched PHP 8.5.12 requires a custom lab app with a destructor gadget plus deliberate session.serialize_handler mismatch (php_serialize writes, legacy php reads) and non-default settings like cleanup=Off; this is an app flaw, not core PHP RCE.
github.com/rafalohaki/php…
php.net/manual/en/sess
2
2
14
1,917
CVE-2026-109618 and CVE-2026-109619 currently have no universal working PoC.
If you want to read the reason 👇
berardinellidaniele.com/post…
1
26
3,002
Fun video from a friend when your front end alignment isn’t setup for racing with a bunch of caster
1
12
1,857
Happy Monday!
"What's that, MiniDisc or some shit? What? We supposed to be impressed you got mad technology?"
piped.video/watch?v=ex6qyu8e…
1
5
1,848
When the AI worm tries breaking into my IoT devices…
piped.video/keQFOml8s1E
3
1
31
2,673
Bump
OPENAI to EMPLOYEES: If someone is trying to seduce you, first consider — could they be a spy???
OpenAI is warning its employees about honeypot spies and strangers with children in playgrounds ... a very fun one with @georgia_wells and @MeghanBobrowsky:
wsj.com/tech/ai/ai-companies…
14
18
163
10,401
Because based on the last couple years of these types of reports they result in things like this...
2
116
Once again Silicon Valley was ahead of its time
piped.video/HcXu4_K1tMQ
1
1
15
3,066
