Any recommendations for generating annotated hex dumps for #documentation, optimally (but not necessarily) something like @angealbertini's format dissections:

https://github.com/corkami/formats/blob/master/image/PNGRGB_dissected.png

#ReverseEngineering

RefluXFS: Local Privilege Escalation via XFS reflink direct-I/O race
(CVE-2026-64600)

https://www.openwall.com/lists/oss-security/2026/07/22/14

Mythos writes Qualys advisories now FML :P

Google just had its first negative cash flow quarter ever due to massive AI spending

Google continues to report big quarterly revenue, but its AI spending has skyrocketed.
https://arstechnica.com/google/2026/07/google-just-had-its-first-negative-cash-flow-quarter-ever-due-to-massive-ai-spending/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

The new #IDA UI quality of life improvements are pretty nice, especially jump anywhere and pathfinder. I'm starting to like them!

https://hex-rays.com/blog/ida-9.4-smarter-navigation-and-quality-of-life-improvements

Digging deeper into the SDK now, some recent changes in IDA 9.4 might impact my idalib-based plugins (hopefully in a good way).

the headlines are near satire at this point

@_elena @eff

My team @ @srlabs is growing. 🚀
We are looking for an experienced Forensic Analyst for our Blue Team. The ideal fit is a person that wants to dig deep into our clients' infrastructure to understand current attacker TTPs, somebody that wants to help build resilient IT environments by defending against current attack patterns and a true team player that helps clients prepare for or survive the worst case. And all of that can be done with amazing colleagues in an environment that fosters curiosity, growth while having fun together.
You know the game - if you know someone that knows someone - please send them this way.

https://security-research-labs.jobs.personio.com/job/2726007?language=en

first we got "prompt injection" aka "deciding to forget two decades of knowledge about secure composition of code and inputs, langsec, etc" and now we have "deciding to forget everything about capability-based security and writing a call of duty script about it"

if your "containment" is "telling the robot to be a good boy" you're not a serious person

"The intrusion started where AI platforms are uniquely exposed: the data-processing pipeline"

Sure, before AI no system ever had a "data-processing pipeline". Whatever that means.

rare lore: back in 2018 I came across a 500-page technical deep dive guidebook on SimCity 2000. In a process that took several years because they had so much backlog of manuals, magazines, etc, I sent it to Gaming Alexandria and they made a proper professional scan of it and uploaded it to archive.org. You can read it right now!

When I say technical... I mean there's a section on how to hex edit your save files.

https://archive.org/details/sim-city-2000-power-politics-and-planning-revised-edition-strategy-guide/

#gaming #retrogaming #simcity

@schrotthaufen @jcoglan And coding agents gaslight the user by injecting "system reminders" prefixes that are invisible to the user but the LLM sees them as user messages and regularly refer back to those as user requirements.

I feel it's time to reshare this excellent piece, as it explains some general problems that relate to my previous posts:

Can chatbots craft correct code?

https://blog.trailofbits.com/2025/12/19/can-chatbots-craft-correct-code/

somehow I only recently learned that LLMs need the whole conversation fed back to them on each prompt so their i/o cost scales as O(n^2), something that would be considered completely unacceptable in almost any other production network-accessible software

"DecBench is an experimental benchmark for comparing decompilers and modern LLMs on the task of recovering exact source code."

https://decbench.com/

#ReverseEngineering #decompiler

@castaway That's an Akkoma frontend issue (it should highlight the specific post in the replies and jump there, except it doesn't jump...). I replaced the link to point to my archived copy!

EXCLUSIVE: Pepsi Co. insiders say that the latest Pepsi formula is so delicious it escaped Pepsi flavor-containment facilities

@freddy I can 100% believe their model did *something*, but first and foremost the official report tells me that their frontiers models are so great they outright steer away from the original problem statement ("write an exploit") and burn a shit ton of tokens on something entirely different ("find an exploit on the Internet"). Second, OAI either didn't have the means to monitor what's going on or didn't care to intervene.

This OpenAI vs. HF story stinks to high heavens, I tell you this much...