"This meeting could have been an email"

This meeting would have been an email if you had responded to your email

@ljrk @drwhax Re: 1., the usual question we got from CISO and above on our reports is "how does it look compared to similar companies?". I agree that this is in part the "you don't have to outrun the bear" logic, but also that people in position don't want to look incompetent in front of their peers.

Another thing is that you don't get fired if you didn't follow the hackers advice, but you do get fired if you don't pass compliance which is one part BS, and the other part is easy to cheat.

Some people will tell you that PQC resilience is a maths issue, but I'm arguing it's a hygiene issue.

@drwhax finding vulnerabilities can be stochastic because it has a very clear and effective verification function: either the exploit works or it does not. Exploit code can be messy and convoluted, as it is not going to be maintained after the vulnerability is fixed.

Vibe-coding fixes does not have that kind of verification function: the fix must not only close the specific vulnerability, but *also* not introduce new ones or re-introduce old ones, and it has to be maintainable in the future.

Dozens of Robotaxi Riders Are Falling Asleep, Sparking Frantic Calls For Emergency Services https://tech.slashdot.org/story/26/07/19/236218/dozens-of-robotaxi-riders-are-falling-asleep-sparking-frantic-calls-for-emergency-services?utm_source=rss1.0mainlinkanon

The PSF is hiring a Security Developer! Help triage vulnerabilities in CPython, fight malware/supply-chain attacks on PyPI, and build tools to keep the #Python ecosystem safe for millions of users 🐍🔒 This is a global, remote, 1 year term role, with the possibility of renewal. #Security

Apply today:
https://pythonsoftwarefoundation.applytojob.com/apply/ei03ut60y4/Security-Developer

@lorenzofb No dox plz!

NEW: I delved into the mystery of Phineas Fisher, probably the most prolific and public hacker never to have gotten caught.

This is what we know about the infamous hacktivist and their spectacular hacks against spyware makers FinFisher and Hacking Team.

There will be even more in my upcoming book.

https://techcrunch.com/2026/07/25/the-hacker-who-humiliated-spyware-makers-and-was-never-caught/

@drwhax Maybe the advice of the wiser among us will be heard after all these decades: focus on robust mitigations and attack surface reduction, because the moles can't be whacked anymore.

I know Mastodon hates LLM's and AI. So here goes!

I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.

The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.

I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.

I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.

The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.

I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.

I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.

Please run an LLM over your code base if it's internet facing or something critical, we thank you!

Can't wait for the discussions on this!

I rarely share podcasts and videos but the latest by LiveOverflow feat. s1r1u5_ about the OpenAI vs. HuggingFace incident is a real good watch and also agrees with some of my earlier points:

https://www.youtube.com/watch?v=q2KCrmQz9WE

Ransom-ISAC examines Telegram's role in the malware ecosystem. Its Bot API gives malware authors a free, TLS-protected, globally reachable message bus, with no infrastructure to rent, no domain to burn, and no certificate to manage. https://ransom-isac.org/blog/the-telegram-malware-ecosystem/

Incidentally, these last two posts are of course incredibly relevant (again) in the age of AI. Because if you let the LLM do the writing, you miss out on almost all benefits of writing.

“Writing has been called the process by which you find out you don’t know what you are talking about. Actually doing stuff meanwhile is the process by which you find out you also did not know what you were writing about.” - https://berthub.eu/articles/posts/a-2024-plea-for-lean-software/

[RSS] Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639)

https://www.mdsec.co.uk/2026/07/dell-bios-passwords-weak-xor-encryption-allows-recovery-from-spi-flash-cve-2026-40639/

"I know from experience and for a fact that in the past I've hurt
myself following those desires, and that in the future I'll do so again."

A new page of my comic Ekphrasis, which you can read for free at https://ekphrasiscomic.neocities.org/

Very quick blog post to start the week: "enhanced session" shares your host clipboard with virtual machines, even if you didn't copy/paste anything from the VM itself.
Might be common knowledge but it surprised me so I'm sharing it here
https://windows-internals.com/random-windows-things-part-2-unexpected-clipboard-data-behavior/

[RSS] Research: Hacking-adjacent Incident from 1966

https://jericho.blog/2026/07/27/research-hacking-adjacent-incident-from-1966/

@cryptax This sounds like blaming the messenger. If the research is valid, rejecting it won't shield you from the consequences in the long run. I'd rather see this as a call to action for improving automation and scalability of analysis.