Very excited to announce our open-sourcing of Access! A centralized portal for Discord employees to transparently discover, request, and manage their access for all internal systems needed to do their jobs discord.com/blog/access-a-ne…

Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure. foxio.io/blog/choose-your-ba…

Fun fact: `--dangerously-skip-permissions` doesn't actually approve EVERYTHING—we still block some obvious things like `rm -rf ~`. But today's release will let you disable this if you really want, by setting a new env var `CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS=1`

The first rule of cybersecurity is to have fun and be yourself

An urgent notice from the Railway team blog.railway.com/p/security-…

php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell

🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

private keys from 8 intermediate CA certs have been compromised (eMudhra) Happy "Update everything" day to all my pager-carrying friends emudhra.we-have-a-problem.co…

My security strategy in one sentence: if engineering doesn't like working with you, you aren't going to have a secure environment no matter what else you do.

The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug. CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️ pwn.ai/blog/pwnescape

We tested 25 package managers against a simulated malicious repository. Without a lockfile, only Go and vcpkg verified every download in our tests. With a lockfile, it's fewer than half. blog.trailofbits.com/2026/10…

When strikes hit Yandex data centers, many assumed Russian bot operations went dark. Cloudflare data reveals that while search crawling stopped, malicious bots simply migrated to other networks. cfl.re/3VQ5uTA

Finally, commit attribution without requiring commit signatures!

Sandboxing is now more important than ever. Here's a guest to host sandbox escape for gVisor release-20260928 This was our planned submission for Wiz zeroday-cloud-2026. Releasing it today because it's now patched in release-20261005 enjoy :)

Just like with fire, how much human supervision is needed depends on how robust the containment mechanisms are. We're still at the stage of getting confused by why the fire burns the paper boxes we are using to try to contain it.

What's worse than escaping a sandbox and reading the host's files? Escaping Cloudflare's, and reading other customers' files. How did that happen? Cloudflare Containers' disk is thin-provisioned, which means the host keeps a shared pool of storage for every container on the machine, and attaches it lazily in 64 KB chunks, instead of provisioning it all upfront. When we tried reading a chunk of unallocated disk space in a container, we got zeros, which is to be expected. But we noticed something strange: the chunks that we already wrote to were full of bytes we didn't write. Turns out a write is what makes the thin provisioner allocate the chunk, and Cloudflare wasn't zeroing it on the way in, so the rest of the chunk still held leftover data from the previous customers' containers that happened to run the same machine. By writing 4 KB to every chunk of the disk. The other 60 KB of each chunk were instantly filled with other customers' files: .env, credential files, .pem keys, SQLite databases, Chromium cookies and localStorage. I've disclosed vulnerabilities to many vendors over the years, but working with Cloudflare was something else. Putting aside the speedy triage, mitigation, and generous bounty, they have a unique and earnest engineering culture of transparency. Which lead to us collaborating and writing the full postmortem together: blog.cloudflare.com/containe…

We implemented 1024-bit RSA signature forgery in nearly SNFS time! Temporary access to an HSM allows an attacker to forge arbitrary signatures (without factoring). Join work with Laura (1st author!), Adam, Nadia, and Emmanuel github.com/ucsd-hacc/NSNFSSS…

The slides from my talk at Microsoft Bluehat Singapore are public here: thomasdullien.github.io/abou… It's my first BlueHat talk since the Vista days.

The cyber security industry is the vehicle the community works through. But over the years it has been hijacked by performative compliance efforts, a fatalistic resignation that incident response and threat actor tracking is all we can do …