Security asked me to identify every unauthorized SaaS tool employees are using. Our discovery software found 14. I didn't trust it. So I sent a company-wide email: “SAAS AMNESTY WEEK: If you're paying for a work tool on your personal card, submit it here and IT may move it to centralized billing. No questions asked.” By lunch I had 73 submissions. Six CRMs. Nine AI meeting tools. Four different project-management platforms. A personal Dropbox containing customer contracts. And one $899/month “competitive intelligence” tool being used exclusively by an intern. Security asked how I found all of this. I said people become extremely honest when they think they're about to get reimbursed. Finance then noticed the phrase “may move it to centralized billing.” Not “will reimburse you.” Correct. Nobody was promised anything. Our $80,000 security platform found 14 shadow apps in three months. The possibility of free money found 73 before lunch. Sometimes the best network scanner is greed.

An open letter for a global surge in cyber defense, signed by over 100 organizations including Anthropic, AWS, Google, Microsoft, OpenAI, and Oracle.

@signalapp's Contact Discovery Service (CDSI) lets you securely discover which of your contacts are on Signal. It's on by default, and the app sends your full contacts list every 48h. Queries run inside an SGX enclave, so even Signal's servers can't see them. SGX encrypts the enclave's memory, so the host can't read the queries directly, and uses ORAM to hide the access pattern.

Forget lidar. One single camera. Runs in real time & is open source: A streaming 3D model that reconstructs scenes live, at ~20 FPS, over long sequences. End-to-end. Optimization tricks, cleanup steps? Nope. And it beats both streaming and even some offline methods. Perception is becoming software-first. Closer to machines that see and understand the world as it unfolds. Thanks for sharing, @YinghaoXu1 📍Models: huggingface.co/robbyant/ling… Project page: technology.robbyant.com/ling… Code: github.com/Robbyant/lingbot-… Paper: arxiv.org/abs/2604.14141 —— Weekly robotics and AI insights. Subscribe free: 22astronauts.com

The Redump preservation project, responsible for documenting and gathering metadata for over 132 000 video game-related discs, has finally moved to a new website: redump.info It's maintained by the same staff and now on an updated web server with modern technologies!

TIL ssh added keystroke timing obfuscation in 2023. Sends garbage packets to avoid revealing what you may be typing based on timing patterns. Another great blog post by @itseieio eieio.games/blog/ssh-sends-1…

Just a reminder that we're having a meetup on the 19th at 7pm. Among other things, we'll be talking about CTF stuff meetu.ps/e/Q4Vfx/Hq0dP/i

Comedy of AI errors: Lawyers on both sides of a case misuse AI, cite fake hallucinated cases. At the show-cause hearing, "each of the attorneys expressed embarrassment and apologized to the Court." "Neither of them verified the legal authority output by AI before filing their briefs." In other words, there were two clients who basically were paying for ChatGPT (or whatever LLM) to argue against itself. Neither of them realized this until the court issued the OSC! Fines all around (between $1,000 and $3,500), other sanctions include pro hac status revoked, disqualified from practicing in the district for 2 years, among other things:

🚨🇺🇸BREAKING: The CIA officer caught with $40 million in gold bars allegedly invented an entire fake top-secret spy program to steal the money. As if this story couldn't get and wilder: -David Rush allegedly built a sham "special access program," the blackest box in U.S. intelligence, so secret even top-clearance officials couldn't look inside without authorization -The fake program posed as "continuity of government" work, the doomsday planning that keeps Washington running after a nuclear war -He allegedly read in two colleagues as unwitting accomplices and used a made-up government contract to funnel millions, persuading a defense contractor to buy huge amounts of gold -The FBI raid on his home seized 303 gold bars worth roughly $40 million, $2 million in cash, and 35 luxury watches -Investigators say he lied about his college degrees, faked being a Navy pilot, and still sailed through the CIA's notoriously brutal vetting -A judge ordered him held as a flight risk, and several CIA officials are now on leave as the probe widens The scheme worked because of the system, not in spite of it. The secrecy walls built to hide operations from China and Russia hid the fraud from the CIA itself. A man with a fake résumé ran a fake doomsday program inside the most paranoid institution in America, and for years nobody noticed... Source: Washington Post

Next meetup on the 19th at 7pm. More info to come.

There’s a famous Usenet story about a programmer (Mel) who refused higher level abstractions. It was the late 1950s, and even in that era, Mel was…well today we’d call him a boomer. Mel only wrote in raw hexadecimal. He didn’t approve of compilers, and refused to use optimizing assemblers. "You never know where it's going to put things”, he said. Everyone else in the company was moving on to FORTRAN, and they didn’t understand why Mel was so stubborn about using new tools. He *loved* self-modifying code. “If a program can’t rewrite its own code”, he asked, “what good is it?” Mel eventually left the company, and other engineers were tasked with understanding what was left. Mel’s hand-optimized routines always beat the assemblers; but some of it looked absolutely bizarre. One engineer took ~2 weeks to understand why there were loops with no exit condition…yet the program worked fine. I won’t spoil all the details, you should really read it, it’s short. But it’s a fantastic piece on “what defines a real programmer?”…which is becoming increasingly relevant in this vibe-coded era. I strive to understand computers as deeply as Mel! If we aren’t careful, we’re going to lose the “Mels” of this world to time. That’s part of why I go so deep in my youtube videos. I hope that younger viewers are genuinely fascinated by the inner workings of our machines, instead of handing everything off to higher abstractions.

you never think this will happen to you, but this happened to me today. a DPRK actor posed as somebody i previously worked with at the arbitrum foundation to have a catchup call. they reached out via telegram, in a channel where we had an existing messaging history. the DPRK actor sent me what looked to be a legitimate teams link, but when i opened it, it said a software update was necessary, which entailed downloading and running a malicious file. in the group call, there was video of everybody on the call, including the person i had previously worked with. stay vigilant and be safe! don’t be afraid to send out your own video conferencing links if you see something suspicious.

i built a site that explores which books are most popular across the brooklyn public library system! + see what's most popular borough-wide or by select neighborhoods + compare book tastes across neighborhoods + see ratings on goodreads + NYT best sellers borrowed-brooklyn.vercel.app…

Important free resource that teaches you how to rotate secrets on lots of different platforms. Seems we're in the everyone leaking secrets phase of supply chain attacks lately. Keep this handy. Thanks @trufflesec! howtorotate.com/

Interesting! Anthropic spent $10B building a model so dangerous they wouldn't release it to the public. then a private Discord group accessed it because they guessed the URL. Cybersecurity is officially a comedy.

GOOGLE BUILT A VULNERABILITY SCANNER AND OPEN-SOURCED IT most devs ship code without knowing half their dependencies are ticking time bombs osv-scanner fixes that it scans your entire project lockfiles, containers, even vendored c/c++ code and maps every dependency against the osv.dev database supports 11+ ecosystems. npm, pip, cargo, maven, go modules, gem. all of it. the guided remediation feature is the real unlock... it doesn't just tell you what's broken.... it tells you exactly which version upgrades fix the most issues with the least risk call analysis built in. so you only get alerts for vulnerable functions your code actually calls. no noise works offline too. download the db once, scan without internet one command to scan your whole directory: osv-scanner scan source -r ./ github.com/google/osv-scanne…

The FBI cut the phone lines during the 1977 disability rights sit-in. Then they turned off the hot water. They locked the doors from the outside. One hundred and fifty people were trapped on the fourth floor. Half of them used wheelchairs. The government assumed they would leave. Kitty Cone was thirty-three. She had muscular dystrophy. Her muscles were failing, but her logistics were flawless. She knew how to organize people. The federal government had promised to sign regulations protecting disabled Americans from discrimination. The policy was known as Section 504. They printed the promise on paper. Then they stalled. Without a signature, it was just typography. The protesters entered the regional Health, Education, and Welfare building in San Francisco on a Tuesday morning. They took the elevators to the director's office. They brought sleeping bags and catheters. They informed the staff they were not leaving until the law was signed. By sunset, the police surrounded the exits. Kitty sat near the windows. She organized the floor plan. She assigned committees for security and sanitation. She kept her medication in a small cooler. According to federal memorandums released decades later, the strategy to end the occupation relied on medical attrition. The building was not equipped for long-term habitation. The FBI calculated that a population requiring ventilators, specialized diets, and daily medical aides would voluntarily evacuate if the environment became sufficiently hostile. They instituted a blockade. The blockade went into effect immediately. No food deliveries allowed. No medical supplies permitted through the lobby. Guards stood at the main doors checking identification. Kitty's muscles deteriorated faster under the physical strain. She couldn't walk. When the phone lines went dead, the fourth floor lost contact with the press. The government waited for the quiet. Kitty dropped to the floor. She realized the barricades were designed for standing adults. The police had blocked the hallways at waist height. They hadn't blocked the linoleum. The floors were covered in cigarette ash and spilled coffee. She dragged her body through it. She crawled under the barricades to reach the restricted elevator shafts and unguarded offices. She carried notes in her pockets. She found a single working payphone the FBI missed. She called the local news desks. She called the mayor's office. She crawled back. When her arms failed, someone pulled her by her ankles. The Black Panthers heard the news reports. They crossed the police lines with hot meals. The FBI could not stop them without a riot. They shut off the elevators, so she crawled. The occupation lasted twenty-five days. It remains the longest non-violent occupation of a federal building in American history. On April 28, the Secretary of HEW signed the regulations without a single alteration. The protesters left the building the next morning. They went back to their apartments. The Rehabilitation Act regulations laid the groundwork for every accessibility law that followed. The HEW building still stands on United Nations Plaza. The elevators run on a schedule. The doors are heavy glass. Kitty Cone: the woman who crawled under the barricades.

idk how else to say this, but... build your dream projects now. I feel like all the tools are giving away a LOT for free/cheap now. It's only gotten more pricey over time, and will keep getting more expensive. Your ideas are subsidized now, think of it as a fire sale and build!

A Russian hacker made $5 MILLION A DAY faking ad views from his apartment Aleksandr Zhukov ran a company called Media Methane out of a Bulgarian apartment On paper it was a real ad agency that placed video ads for companies like Nestle, Comcast, and The New York Times Except he wasn’t placing them anywhere real He built 6,000 fake websites that looked exactly like ESPN, CNN, Vogue, and Fox News Then rented 2,000 servers in Dallas and Amsterdam, bought 650,000 IP addresses, and registered them to Verizon and Comcast so the traffic looked like regular Americans He coded a fake web browser that scrolled pages, clicked ads, moved the mouse and solved CAPTCHAs like a real person His bots watched 300 million video ads a day Advertisers paid $13 per thousand views At peak he was pulling $5 million a day while he slept Got caught because he got into a fight with a client and spammed their inventory so hard it tripped every fraud alarm at a cybersecurity firm FBI arrested him in Bulgaria, extradited him to the US, 10 years in federal prison When he got to court he told the judge: “I’m a weaponless soldier in front of a tank with name FBI”

Last week, Anthropic announced Project Glasswing alongside Claude Mythos Preview, a model they described as so powerful at finding vulnerabilities they couldn't release it. The announcement featured AWS, Microsoft, Google, and Apple as partners, $100M in compute credits, and a clear message: this is dangerous, and only we can be trusted to deploy it safely. The results were real. Thousands of zero-days across every major OS and browser. A 27-year-old bug in OpenBSD. A 16-year-old bug in FFmpeg. Fully autonomous exploit chains that would have taken human researchers weeks. But here's what bothered me: all the credit went to the model. Read the technical blog carefully and a different picture emerges. The real innovation isn't the model. It's the workflow: - Rank every file in a codebase by attack surface - Fan out hundreds of parallel agents, each scoped to one file - Use crash oracles (AddressSanitizer, UBSan) as ground truth - Run a second verification agent to filter noise - Generate exploits as a triage mechanism for severity That's a pipeline. And pipelines are model-agnostic. At Lazarus AI, we spend our days deploying custom AI in places where "just use the closed API" isn't an option: regulated industries, enterprise, and government. When I saw Glasswing, my instinct was the same one I have every week: strip out the proprietary model, keep the architecture, run it on whatever model is best for the customer. Clearwing is a fully open-source vulnerability discovery engine. Crash-first hunting, file-parallel agents, oracle-driven verification, variant hunting, adversarial verification. Works with any LLM. I tested it with OpenAI Codex 5.4 and reproduced Glasswing's findings. I'm now reproducing results with our own ReAligned model - Qwen3.5 finetuned to Western alignment. Mythos is certainly a great model. The N-day exploit walkthroughs in Anthropic's blog show real reasoning depth. But it's an incremental improvement over Opus, the same way Opus was over Sonnet, and Sonnet over Haiku. It's not a leap to superintelligence. It's the next point on a curve we've been watching for years. What actually changed the game was the workflow. Defenders shouldn't have to wait for access to a gated model to secure their software. These vulnerabilities have been sitting in codebases for decades. The tools to find them should be available to everyone: the open source maintainer running FFmpeg on a Saturday, the startup that can't afford $125/M output tokens, the researcher in a country where Anthropic doesn't operate. Clearwing is MIT licensed and available now. github.com/Lazarus-AI/clearw… Clearwing enables a wide variety of security activities. Handle with care. It is sharp.