I know Mastodon hates LLM's and AI. So here goes!

I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.

The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.

I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.

I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.

The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.

I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.

I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.

Please run an LLM over your code base if it's internet facing or something critical, we thank you!

Can't wait for the discussions on this!

I rarely share podcasts and videos but the latest by LiveOverflow feat. s1r1u5_ about the OpenAI vs. HuggingFace incident is a real good watch and also agrees with some of my earlier points:

https://www.youtube.com/watch?v=q2KCrmQz9WE

Ransom-ISAC examines Telegram's role in the malware ecosystem. Its Bot API gives malware authors a free, TLS-protected, globally reachable message bus, with no infrastructure to rent, no domain to burn, and no certificate to manage. https://ransom-isac.org/blog/the-telegram-malware-ecosystem/

Incidentally, these last two posts are of course incredibly relevant (again) in the age of AI. Because if you let the LLM do the writing, you miss out on almost all benefits of writing.

“Writing has been called the process by which you find out you don’t know what you are talking about. Actually doing stuff meanwhile is the process by which you find out you also did not know what you were writing about.” - https://berthub.eu/articles/posts/a-2024-plea-for-lean-software/

[RSS] Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639)

https://www.mdsec.co.uk/2026/07/dell-bios-passwords-weak-xor-encryption-allows-recovery-from-spi-flash-cve-2026-40639/

"I know from experience and for a fact that in the past I've hurt
myself following those desires, and that in the future I'll do so again."

A new page of my comic Ekphrasis, which you can read for free at https://ekphrasiscomic.neocities.org/

Very quick blog post to start the week: "enhanced session" shares your host clipboard with virtual machines, even if you didn't copy/paste anything from the VM itself.
Might be common knowledge but it surprised me so I'm sharing it here
https://windows-internals.com/random-windows-things-part-2-unexpected-clipboard-data-behavior/

[RSS] Research: Hacking-adjacent Incident from 1966

https://jericho.blog/2026/07/27/research-hacking-adjacent-incident-from-1966/

@cryptax This sounds like blaming the messenger. If the research is valid, rejecting it won't shield you from the consequences in the long run. I'd rather see this as a call to action for improving automation and scalability of analysis.

The Orphaned Sources At The Hacker Camp: What Happened Next

https://hackaday.com/2026/07/28/the-orphaned-sources-at-the-hacker-camp-what-happened-next/

36 years ago, on January 15, 1990, a software bug in the 4ESS switch triggered a cascade of failures that took down most of the AT&T long distance telephone network for about nine hours.

It was treated as a national crisis. There were investigations and task forces, both internal and external, and detailed findings were published and scrutinized. The case is still studied today in networking and software engineering courses.

Today's national T-Mobile failure will be forgotten by next week.

[RSS] Random Windows Things Part 1: PreviousMode Mitigation

https://windows-internals.com/random-windows-things-part-1-previousmode-mitigation/

[RSS] Random Windows Things Part 2: Unexpected Clipboard Data Behavior

https://windows-internals.com/random-windows-things-part-2-unexpected-clipboard-data-behavior/

Apple MIE exploitation challenge

https://blog.calif.io/p/apple-mie-exploitation-challenge

"In this blog, we'll share the details of the two vulnerabilities behind our [MIE bypassing] exploit"

[RSS] From Virtual Share to Physical Shell: Leveraging Windows' Inconsistent Access Control for LPE

https://blog.exodusintel.com/2026/07/27/from-virtual-share-to-physical-shell-leveraging-windows-inconsistent-access-control-for-lpe/

New issue - #9 - of the free @PagedOut zine is here!
90 pages of pure technical awesomeness!
Please help spread the news ❤️

Web: https://pagedout.institute/webview.php?issue=9&page=1
PDF: https://pagedout.institute/download/PagedOut_009.pdf
Wallpaper: https://pagedout.institute/download/PagedOut_009_wallpaper.png
Patreon: https://www.patreon.com/cw/PagedOut

Enjoy!

How is the Bun rewrite in Rust going? https://lockwood.dev/ai/2026/07/27/how-is-the-bun-rewrite-in-rust-going.html

It seems like if the initial token costs are to believed, the cost is approaching $1m USD, but it's likely, as the article says, that there were a lot of non-reported costs being spent from Anthropic helping the project along and continuous CI/CD.

I see LLMs as a continuation of the Silicon Valley obsession with 'problem solving' and their specific definition.

Back when I was an undergrad, the refrain we heard from big tech recruiters was 'we're not interested in specific skills, we want to hire problems solvers'. This always struck me as odd: everyone in my year could solve problems, it wasn't a rare skill, the difficult thing was identifying the correct problems to solve.

Digging a bit deeper, it turns out that they didn't even want people capable for solving generic problems, they wanted people who had learned a load of problem-solution pairs and would do closest-fit matching. People who would look at a problem and say 'ah, this looks like this well-known problem, the solution is therefore a variation of this well-known solution'. Not people who would create novel solutions but people who could pattern match and apply off-the-shelf solutions with small tweaks.

They wrote books about how to hire people with that skill, all without being explicit that this is what they were looking for.

And now they have machines that can do this: ingest a load of problem-solution pairs and match problems to some space of problems and infer a solution from the nearby solutions.

It's not surprising that they believe this is the same as novelty, because they've spent three decades incentivising their employees to avoid true novelty.

The @EUCommission has just published guidance documents clarifying how the Cyber Resilience Act #CRA affects (among other things) #OpenSource. This is the result of the extensive engagement of many open source community members.

https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation