I'd like to introduce Kuna, a new Rust-based decompiler that explores a highly experimental direction: self-refining decompiler development and usage. Or: a decompiler constantly improved by agents, made for agents.

Kuna rivals the best in structuring now. Let's talk about it.1/

I am baffled why people are going "oh no what is to be done" about openai breaking into a competitors computers, when it is incredibly obvious: Charge them under the CFAA. "Oh but their research". Sandbox it from the Internet. "Oh it's too hard to do that". Skill issue, get good.

As I said: Weird that Robert Morris got charged for all of the computers his worm broke into. After all, he didn't do it, the computer program did it, that's completely different, apparently. https://en.wikipedia.org/wiki/Morris_worm

@whvholst we've been trained extensively over the last decade or so that software bug are just a fact of life and nothing can be done about it. CrowdStrike bricking a whole bunch of devices 2 years ago had zero consequences.

Now, you can just point in the general direction of any model, shrug, say it did it, and nobody will question it, because software doesn't matter. Yes, I am bitter.

Heh, Google now rubs your nose in it: they have a new report for webmasters that shows you how many times AI summaries / Gemini "cited" your website. There is no click count because of course there isn't.

Is that a metric I'm supposed to optimize for, against, or what

I like that cargo whips the LLMs butt so I don't have to

@XauriEL a flawed proof goes around the world before a bug report gets its pants on 😩

russia’s FSB reported bringing charges against Telegram founder Pavel Durov for facilitating terrorist activity and placing him on the international wanted list.

According to the security service, the administration of the messaging app fails to delete channels and bots that, according to the russian side, are used to coordinate terrorist attacks and acts of sabotage in russia.

https://en.interfax.com.ua/news/general/1188849.html

Ghidra SNES: Ghidra extension for loading and working with SNES ROMs #ReverseEngineering #SNES https://github.com/joshleaves/ghidra-snes

"you type fast" i have to type fast or i can't get the thoughts out before the buffer gets cleared and they get replaced with different thoughts

The US will try anything but gun control

@landelare It doesn't look fake at all, but the whole story draws a really bad picture of both model reliability and company competence. OAI+HF noticing the behavior and deciding not to intervene (or even support the actions) would be the most generous interpretation for the companies IMO.

Some tracks can't be saved even by a schrantz remix

#KylieMinogue

RE: https://infosec.exchange/@raptor/116941213445764051

In light of the recent news on the demise of #Infiltrate conference videos on #vimeo, I’m happy to announce that I’ve uploaded the videos of my two talks here:

INFILTRATE 2019 - Marco Ivaldi - A bug’s life: story of a Solaris 0day
https://youtu.be/e6hYrFHkXcU

INFILTRATE 2020 - Marco Ivaldi - The INFILTRATE effect: 6 bugs in 6 months
https://youtu.be/G8vhifVUmg4

For older videos, see also the @InfoCon archive:
https://infocon.org/cons/Infiltrate/

Okay, we have a new contender for Most AI Thing to Ever Happen

1) July 25th: someone messes around with an LLM and posts a proof of the Collatz conjecture that does, in fact, verify in the theorem prover. (The AI use is not disclosed on the github page) https://github.com/xrchz/CollatzLean

2) July 26th: several serious bugs are posted in the theorem provers, that in principle could allow a false statement to be "proven" true. They're serious, yes, but no need for panic, because you're not going to blunder into accidentally exploiting the bugs while writing a proof, probably.
https://github.com/leanprover/lean-kernel-arena/pull/81

3) July 28th: someone who was right to be very skeptical of the Collatz proof, and had the expertise to study it with a fine-toothed comb, discovered it was exploiting a bug https://github.com/leanprover/lean4/issues/14576

4) The "proof" turns out to be exploiting multiple similar but distinct bugs to pass different solver variants!

5) the human who posted the proof acknowledges the AI use and claims they did not knowingly point it towards the bugs it exploited. https://leanprover.zulipchat.com/#narrow/channel/270676-lean4/topic/Counterexample.20to.20the.20Lean.20Conjecture.20.28Soundness.20Bug.29/near/613135216

Note that the proof was posted shortly before the related bug reports were posted. It is an open question if the AI found people discussing the bugs shortly before they were formally posted and "decided" to exploit them, if the AI "knew about it" as a learned strategy from the training stage (putting every single "proof" it's ever made and ever will make into profound doubt), or if it's recently been repeatedly blundering into it by sheer stupidity and that's how people noticed the bug at about the same time.

Theorem provers aren't magic, and have bugs just like all other programs. They are tools to help us double-check our reasoning. When you skip the reasoning and ask an AI to "prove" something for you that's over your head, you're entering an adversarial pact with the monkey-pawed Devil of Customer Satisfaction.

my initial source for investigating this myself: https://lipn.info/@mevenlennonbertrand/116997927457012577

@ozu

Yes: https://infosec.place/notice/B8dh429Gf6p490VuJU

And HF also didn't notice someone is messing with their k8s in the noisiest way possible for days.

This other diagram is supposed show the time distribution of events. What are considered as "events"? What is the vertical scale of this diagram? What is 461? Why do stripes contain different colors sometimes?

This diagram is also bad, but at least it shows the high-level flows.

Notice that "Third party code sandbox" is marked as "Compromised", while the post text explicitly states that "Modal’s infrastructure was not compromised in any way". Also, how do you even compromise a *sandbox*? WTF is Lateralize?!

[RSS] ColdFusion Under Fire: Breaking Down CVE-2026-48283 and CVE-2026-48313

https://horizon3.ai/intelligence/blogs/coldfusion-critical-cves/

[RSS] The Cipher Behind QSYRUPWD: Reconstructing IBM i Password Hashes

https://blog.silentsignal.eu/2026/07/28/the-cipher-behind-qsyrupwd-reconstructing-ibm-i-password-hashes/

IBM may be overselling their local password protection: my old friends show some neat #IBMi reversing tricks to reveal how the platform hashes passwords at different security levels (QPWDLVL)

HuggingFace incident report:

https://huggingface.co/blog/agent-intrusion-technical-timeline

The report itself reeks of LLM slop with gems like the "kill chain", consisting of phases like recon, exfil, c2...and k8s 🤡 Nuances are overemphasized (like how code execution was used to execute code) while important steps are blurry (e.g. they had some kind of "allowlist" in the dataset processor, that allowed everything which didn't look like a URL?).

I feel sorry for blue teams not because they'll have to respond to more incidents but because they'll have to wade through reports like this...