"you type fast" i have to type fast or i can't get the thoughts out before the buffer gets cleared and they get replaced with different thoughts

The US will try anything but gun control

Some tracks can't be saved even by a schrantz remix

#KylieMinogue

RE: https://infosec.exchange/@raptor/116941213445764051

In light of the recent news on the demise of #Infiltrate conference videos on #vimeo, I’m happy to announce that I’ve uploaded the videos of my two talks here:

INFILTRATE 2019 - Marco Ivaldi - A bug’s life: story of a Solaris 0day
https://youtu.be/e6hYrFHkXcU

INFILTRATE 2020 - Marco Ivaldi - The INFILTRATE effect: 6 bugs in 6 months
https://youtu.be/G8vhifVUmg4

For older videos, see also the @InfoCon archive:
https://infocon.org/cons/Infiltrate/

Okay, we have a new contender for Most AI Thing to Ever Happen

1) July 25th: someone messes around with an LLM and posts a proof of the Collatz conjecture that does, in fact, verify in the theorem prover. (The AI use is not disclosed on the github page) https://github.com/xrchz/CollatzLean

2) July 26th: several serious bugs are posted in the theorem provers, that in principle could allow a false statement to be "proven" true. They're serious, yes, but no need for panic, because you're not going to blunder into accidentally exploiting the bugs while writing a proof, probably.
https://github.com/leanprover/lean-kernel-arena/pull/81

3) July 28th: someone who was right to be very skeptical of the Collatz proof, and had the expertise to study it with a fine-toothed comb, discovered it was exploiting a bug https://github.com/leanprover/lean4/issues/14576

4) The "proof" turns out to be exploiting multiple similar but distinct bugs to pass different solver variants!

5) the human who posted the proof acknowledges the AI use and claims they did not knowingly point it towards the bugs it exploited. https://leanprover.zulipchat.com/#narrow/channel/270676-lean4/topic/Counterexample.20to.20the.20Lean.20Conjecture.20.28Soundness.20Bug.29/near/613135216

Note that the proof was posted shortly before the related bug reports were posted. It is an open question if the AI found people discussing the bugs shortly before they were formally posted and "decided" to exploit them, if the AI "knew about it" as a learned strategy from the training stage (putting every single "proof" it's ever made and ever will make into profound doubt), or if it's recently been repeatedly blundering into it by sheer stupidity and that's how people noticed the bug at about the same time.

Theorem provers aren't magic, and have bugs just like all other programs. They are tools to help us double-check our reasoning. When you skip the reasoning and ask an AI to "prove" something for you that's over your head, you're entering an adversarial pact with the monkey-pawed Devil of Customer Satisfaction.

my initial source for investigating this myself: https://lipn.info/@mevenlennonbertrand/116997927457012577

[RSS] ColdFusion Under Fire: Breaking Down CVE-2026-48283 and CVE-2026-48313

https://horizon3.ai/intelligence/blogs/coldfusion-critical-cves/

[RSS] The Cipher Behind QSYRUPWD: Reconstructing IBM i Password Hashes

https://blog.silentsignal.eu/2026/07/28/the-cipher-behind-qsyrupwd-reconstructing-ibm-i-password-hashes/

IBM may be overselling their local password protection: my old friends show some neat #IBMi reversing tricks to reveal how the platform hashes passwords at different security levels (QPWDLVL)

HuggingFace incident report:

https://huggingface.co/blog/agent-intrusion-technical-timeline

The report itself reeks of LLM slop with gems like the "kill chain", consisting of phases like recon, exfil, c2...and k8s 🤡 Nuances are overemphasized (like how code execution was used to execute code) while important steps are blurry (e.g. they had some kind of "allowlist" in the dataset processor, that allowed everything which didn't look like a URL?).

I feel sorry for blue teams not because they'll have to respond to more incidents but because they'll have to wade through reports like this...

I'm looking for a new job.

I've been in security for 13 years. I spent the last year at Trail of Bits doing code reviews and security assessments on desktop/web apps, kernelmode code, and firmware. I co-wrote the C/C++ testing handbook we published recently, contributing the Windows usermode and kernel sections. I've got strong hardware skills and industrial experience.

UK based but flexible on operating hours. Looking for similar work, full-time remote.

CV: https://poly.nomial.co.uk/graham_sutherland.pdf

#fedihire

So Claude apparently creates a “secret” URL for the conversations people have with it.

URLs can be indexed if they can be reached. So users’ private conversations with Claude, predictably, started showing up in Google search results.

“But but but we had a robots.txt file!” says Anthropic, unironically.

https://www.wired.com/story/private-claude-chats-exposed-in-google-and-bing-search-results/

#noai #ai #consent #badideas

Hacker Wipes Romania's Entire Land Registry Database https://it.slashdot.org/story/26/07/20/172249/hacker-wipes-romanias-entire-land-registry-database?utm_source=rss1.0mainlinkanon

"This meeting could have been an email"

This meeting would have been an email if you had responded to your email

Some people will tell you that PQC resilience is a maths issue, but I'm arguing it's a hygiene issue.

Dozens of Robotaxi Riders Are Falling Asleep, Sparking Frantic Calls For Emergency Services https://tech.slashdot.org/story/26/07/19/236218/dozens-of-robotaxi-riders-are-falling-asleep-sparking-frantic-calls-for-emergency-services?utm_source=rss1.0mainlinkanon

The PSF is hiring a Security Developer! Help triage vulnerabilities in CPython, fight malware/supply-chain attacks on PyPI, and build tools to keep the #Python ecosystem safe for millions of users 🐍🔒 This is a global, remote, 1 year term role, with the possibility of renewal. #Security

Apply today:
https://pythonsoftwarefoundation.applytojob.com/apply/ei03ut60y4/Security-Developer

NEW: I delved into the mystery of Phineas Fisher, probably the most prolific and public hacker never to have gotten caught.

This is what we know about the infamous hacktivist and their spectacular hacks against spyware makers FinFisher and Hacking Team.

There will be even more in my upcoming book.

https://techcrunch.com/2026/07/25/the-hacker-who-humiliated-spyware-makers-and-was-never-caught/

I know Mastodon hates LLM's and AI. So here goes!

I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.

The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.

I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.

I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.

The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.

I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.

I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.

Please run an LLM over your code base if it's internet facing or something critical, we thank you!

Can't wait for the discussions on this!

I rarely share podcasts and videos but the latest by LiveOverflow feat. s1r1u5_ about the OpenAI vs. HuggingFace incident is a real good watch and also agrees with some of my earlier points:

https://www.youtube.com/watch?v=q2KCrmQz9WE

Ransom-ISAC examines Telegram's role in the malware ecosystem. Its Bot API gives malware authors a free, TLS-protected, globally reachable message bus, with no infrastructure to rent, no domain to burn, and no certificate to manage. https://ransom-isac.org/blog/the-telegram-malware-ecosystem/

Incidentally, these last two posts are of course incredibly relevant (again) in the age of AI. Because if you let the LLM do the writing, you miss out on almost all benefits of writing.