@cR0w "at the cost of research velocity while the vulnerabilities are patched."

I've spent enough time in enterprise settings to recognize that this translates to "security is a cost center and we spend as little on it as we legally can". I do love how they manage to also blame due diligence as a cause of not whacking more moles!

🎶 Here comes another bubble.
The VCs are backing,
Baby let's get cracking. 🎶

Here Comes Another Bubble (2007):
https://www.youtube.com/watch?v=I6IQ_FOCE6I

@nullandnull I need something for one-off diagrams, I don't want to write a formal declaration this time. My best idea so far is to annote the bytes in some GUI that supports this (IIRC 010 does?), and take a screenshot...

i don’t usually respond to these kinds of emails, but this one made me so fucking mad that i blacked out and regained consciousness with this in my outbox

Dotcom bubble nostalgia in the local pubs restroom

Any recommendations for generating annotated hex dumps for #documentation, optimally (but not necessarily) something like @angealbertini's format dissections:

https://github.com/corkami/formats/blob/master/image/PNGRGB_dissected.png

#ReverseEngineering

RefluXFS: Local Privilege Escalation via XFS reflink direct-I/O race
(CVE-2026-64600)

https://www.openwall.com/lists/oss-security/2026/07/22/14

Mythos writes Qualys advisories now FML :P

Google just had its first negative cash flow quarter ever due to massive AI spending

Google continues to report big quarterly revenue, but its AI spending has skyrocketed.
https://arstechnica.com/google/2026/07/google-just-had-its-first-negative-cash-flow-quarter-ever-due-to-massive-ai-spending/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

The new #IDA UI quality of life improvements are pretty nice, especially jump anywhere and pathfinder. I'm starting to like them!

https://hex-rays.com/blog/ida-9.4-smarter-navigation-and-quality-of-life-improvements

Digging deeper into the SDK now, some recent changes in IDA 9.4 might impact my idalib-based plugins (hopefully in a good way).

the headlines are near satire at this point

@_elena @eff

My team @ @srlabs is growing. 🚀
We are looking for an experienced Forensic Analyst for our Blue Team. The ideal fit is a person that wants to dig deep into our clients' infrastructure to understand current attacker TTPs, somebody that wants to help build resilient IT environments by defending against current attack patterns and a true team player that helps clients prepare for or survive the worst case. And all of that can be done with amazing colleagues in an environment that fosters curiosity, growth while having fun together.
You know the game - if you know someone that knows someone - please send them this way.

https://security-research-labs.jobs.personio.com/job/2726007?language=en

first we got "prompt injection" aka "deciding to forget two decades of knowledge about secure composition of code and inputs, langsec, etc" and now we have "deciding to forget everything about capability-based security and writing a call of duty script about it"

if your "containment" is "telling the robot to be a good boy" you're not a serious person

"The intrusion started where AI platforms are uniquely exposed: the data-processing pipeline"

Sure, before AI no system ever had a "data-processing pipeline". Whatever that means.

rare lore: back in 2018 I came across a 500-page technical deep dive guidebook on SimCity 2000. In a process that took several years because they had so much backlog of manuals, magazines, etc, I sent it to Gaming Alexandria and they made a proper professional scan of it and uploaded it to archive.org. You can read it right now!

When I say technical... I mean there's a section on how to hex edit your save files.

https://archive.org/details/sim-city-2000-power-politics-and-planning-revised-edition-strategy-guide/

#gaming #retrogaming #simcity

@schrotthaufen @jcoglan And coding agents gaslight the user by injecting "system reminders" prefixes that are invisible to the user but the LLM sees them as user messages and regularly refer back to those as user requirements.

I feel it's time to reshare this excellent piece, as it explains some general problems that relate to my previous posts:

Can chatbots craft correct code?

https://blog.trailofbits.com/2025/12/19/can-chatbots-craft-correct-code/

somehow I only recently learned that LLMs need the whole conversation fed back to them on each prompt so their i/o cost scales as O(n^2), something that would be considered completely unacceptable in almost any other production network-accessible software