New: hackers tore down a Flock camera and managed to extract the software running on it. We then analyzed the data to find how a Flock camera really track cars and people. The amount of data this single camera gathered in a short period was huge, 50,000+ vehicles https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/

@algernon @gaborudvari I agree that's cringe but I'd also like to note that the largest companies in the world are built on AdTech. People/societies are weird when it comes to desires and consumption.

@stf @mhoye barbaric!

“The AI Reversing Panel: Are we all powerful, or out of a job?” I moderated at @recon is now out on YouTube.

REcon doesn’t often do panels, but Hugo Fortier asked us to do our best - and we said yes.

We’re all trying to figure out the future of security, research, and what to do next. Is the future all about being super hackers, or re-skilling as washing machine technicians?

My deepest appreciation to our panelists:
John McIntosh, Marion Marschalek, and Aaron Portnoy

To those joining us over Zoom in the middle of their night:
Thomas Dullien and Thai Duong

Guests:
Dragos Ruiu and Sergey Bratus

Video:
https://www.youtube.com/watch?v=iDJDmie8XaQ

With a special note of thanks to our editors:
Ido Kenan Nathan Van Horn

Quick reminder: deadline for Paged Out! Issue #10 is in 2 weeks!

"People and their AI agents are making the act of being on the internet extremely annoying, and the problem is about to get much worse. " https://www.404media.co/theres-a-100-chance-ai-agents-are-already-ruining-the-internet/?ref=daily-stories-newsletter

Great, turns out my TTD trace failed to record some memory and instead of a) displaying an error b) at least marking it unmapped it went with c) filling it with 0x00 just so I could spend half day figuring out how some values magically appeared in a struct.

#ReverseEngineering #WinDbg

My binary so thick it stores data in the base pointer

[RSS] Apple Reference Image: A New Approach for Verified Photography

https://security.apple.com/blog/apple-reference-image

[RSS] Multiple Vulnerabilities in Frappe LMS Leading to Remote Code Execution

https://rhinosecuritylabs.com/research/multiple-vulnerabilities-in-frappe-lms-leading-to-remote-code-execution/

Cybersecurity has an AI doomer problem https://www.youtube.com/watch?v=KMf2RDC5Dyg

The AI industry's proximity to cybersecurity is causing clueless AI doomers to flood the zone. Experts and real issues are now being drowned out by increasingly absurd cyber-apocalypse fantasies imagined by people with no real world experience. From self-replicating AI models, to turning the entire internet into a botnet. The doomers are losing their minds and taking the cybersecurity industry with them.

@django I was hoping this exchange actually happened IRL and found Naomi Kleins blog (at least is seems like it):

"Trouble is, both my image and my quote are AI-generated, built from patterns of photographs that do exist and from very similar words I’ve actually said and written elsewhere."

https://naomiklein.substack.com/p/welcome-to-my-substack

Did you update to iOS 27? Congratulations! You've now possibly have been re-enrolled in Apple Intelligence, because Apple knows better about what you want than you do.

1. Starting with iOS 27, there is no top-level Apple Intelligence setting that you can turn off.
2. If you had Apple Intelligence disabled on iOS prior to 27, the features that use Apple Intelligence will be automatically re-enabled upon upgrading to 27.
3. If you do want to turn off an example Apple Intelligence thing in iOS 27, you can:
   • Settings → Screen Time
   • Content & Privacy Restrictions → turn it on (It's off by default)
   • Siri → Writing Assistance → Don’t Allow

Confusingly, on this same settings page, you can select Siri Classic, as opposed to the default-in-27 Siri AI (Beta). However, after making this change, none of the settings below it change at all. So is Siri AI (Beta) with Writing Assistance (and all other settings there) set to Don't Allow less AI-ish than Siri Classic with the default associated settings of Allowed? I have no idea.

Are there any Apple Intelligence settings outside of the Content & Privacy Restrictions settings for Siri? I also have no idea.

You will embrace your AI overlords and you will like it.

"Shiva is a specialized runtime ELF linker and JIT binary patching engine for Linux X86_64 and AArch64"

https://arcana-research.io/shiva/

#ReverseEngineering

This is fine.

1Password's FLAWED report puts the AI clean-fix rate at 26%. That figure includes trials where agents were told to apply the wrong fix (22% of the data), trials with no build or test access (36%), and six CVEs selected for difficult fixes.

We analyzed 186 agent-authored Patch the Planet PRs. Maintainers merged 126 (67.7%). In 72% of merged PRs, maintainers kept the security fix we proposed. https://blog.trailofbits.com/2026/09/15/1passwords-ai-patching-benchmark-is-misleading/

Abusing ID3 chapters to turn videos into glanceable podcasts: https://alexwlchan.net/2026/glancecast/

If you create hundreds of second-long chapters which have a video frame as cover art, you can get a video into an audio-only podcast player.

[RSS] Microcode in Intel's 8087 floating-point chip: the scale instruction

https://www.righto.com/2026/09/8087-microcode-reverse-engineering-fscale.html

This IT Crowd episode predicted the AI boom (except instead of covering bad team dynamics we try to prevent $NVDA go down):

https://www.youtube.com/watch?v=uyV0IVItlM4

From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX

https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/