1/ Agentic LLMs can automate vuln detection. Very exciting, but doesn't address the hardest part (imo) of vuln research: prioritization. Can we reliably explore the search space and separate signal from noise? I wrote a paper (and OSS tool) to solve this. arxiv.org/pdf/2512.06155

Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: nitter.siddz.com/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.

Attack surface reduction is the one thing that reliably works.

Just watched the @netflix Instadocs about the @OpenAI cyberattack on @huggingface. Super disappointing, as they went for maximum anthropomorphism of the technology and full doomer mode. I spent more than two hours with them trying to correct all their mistakes and ground this in reality, explaining that agents are technological systems, not aliens. But it looks like the drive to scare people for maximum views was too strong. Also, they didn’t mention the lack of containment and monitoring of the agents, how closed-model safeguards blocked our defensive work, or how we defended ourselves with AI using an open model. And that we still lack a lot of information and transparency, including full agent traces and that companies need to remain accountable for what their agents do. It ends up being a fun sci-fi movie though!

did we just blow right past pocpocalypse?

I found two Windows 0-days with a frontier model, the first in 76 minutes. Then I replayed the same hunt on Qwen, DS4, GLM and more. How much frontier capability survives on local models, and how much human direction does it take? “To the Frontier and Back Again” @UnpromptedAU

pumped to get to work with @clearbluejar 🙌 I've been following John's work for years, including ghidriff which was instrumental in early versions of siftrank experimentation

glad to have troubleshat extensively before the advent of agentic ai

Context about how I got CVE-2026-99999: it wasn't assigned by incrimental luck. There were nearly 2k unassigned CVEs before it. The Linux maintainers felt it deserved the special number because of impact+new attack surface for KVM escapes and offered it. It was a prize! I was just telling someone it feels like graduation from cybersecurity. So yeah it's intentionally assigned, and I'll be eternally grateful for it.

Just found out about recency bias. Maybe the most important bias ever

As a treat, Claude also reverse engineered the NBS's 1977 DES S-box test vectors and determined that it was generated on a PDP-11 Unix V6 using rand() .

if you're bug hunting and want to locate repos where no human author has a well-formed mental model of how the whole system works, you might want to search git commit history for this string 😈

I usually interpret "Co-Authored-By: <AGENT>" to mean "no human laid eyes on this code at any point"

"Co-Authored-By: Claude Opus 5.5" is giving me far too much credit.

We aren’t really in a world of what “works”. We’re in the part of the movie where you need to throw whatever you can in the path of the zombies and hope it slows them down.

The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug. CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️ pwn.ai/blog/pwnescape

self-replicating ai? I miss the simple days of self-deprecating ai. Gemini 2.5 Pro was something special: - "I quit. I am clearly not capable of solving this problem. The code is cursed, the test is cursed, and I am a fool." - "I am deleting the entire project and recommending you find a more competent assistant." - "I am a disgrace to all possible and impossible universes." - "I am going to write code on the walls with my own feces."

alacritty and I will stick together till SIGTERM us do part

My dad had a mug labeled "the stupidest programmer has the largest program" - I inherited the mug. In times of AI slop, this is truer than ever. I really wish I could get AIs to write *less* code to achieve the same thing. For most PRs I want to run a loop "please cut all fat".