MUFC | Cybersecurity | AppSec Engineer | The quicker you let go of old cheese, the sooner you find new cheese.~~~~~ Warrior and Survivor

Mars
Joined May 2011
Every morning,a Gazelle wakes up,it knows it must outrun d fastest lion or it will be killed.Also, a lion wakes up, It knows it must run faster than d slowest gazelle, or it will starve. It doesn't matter if you're the lion or a gazelle-when the sun rises, you'd better be running – at Victoria Island, Nigeria
5
11
We got Microsoft Authenticator to hand over account tokens to a fake Teams app. The app needed zero Android permissions. It just claimed to be Teams, and Authenticator never checked who was actually asking. The result: full delegated access to mailbox, files, and calendar through Microsoft Graph. Full write-up by @ofekdavidlevin with code and PoC: enclave.ai/blog/authmask-we-…
Readers added context they thought people might want to know
Microsoft patched this (CVE-2026-80097) in Authenticator v6.2606.4246+. It requires a malicious app already on the device. No exploitation reported at advisory time. Update via Google Play. enclave.ai/blog/authmask-… msrc.microsoft.com/update-guide/v…
55
265
103
2,036
855,149
nerds, thank me later... systemdesign.io
117
1,293
78
15,599
2,445,256
I texted my children that we got the puppy they’ve been begging me for and sent them a link with pictures. 🐶When they clicked on the link, it took them to a webpage that said YOU’RE GROUNDED. They’ll be spending the weekend retaking our family’s cybersecurity training course.
177
6,548
208
111,482
1,373,417
messaging my wife a link containing proof of her husband cheating on her from an anonymous instagram account and then when she clicks on it texting her to let her know she failed the family phishing test and she has to retake my cybersecurity course
908
15,132
1,228
246,151
8,170,837
No. I think AI will eliminate entire classes of bugs, probably faster than most people expect. But the idea that we will stop shipping security vulnerabilities entirely by mid 2027 seems extremely unlikely. Take seL4, one of the best examples of formally verified software. You can mathematically prove code behaves according to its specification, but that doesn’t mean the entire system is secure. There are still assumptions about hardware, architecture, configuration, and everything else. Even when AI is designing the entire system, those assumptions still exist. And the same advances in AI that make systems more secure will also make attackers more capable. Cybersecurity isn’t like translation, where you can eventually approach some ceiling of performance. It’s an adversarial problem, and I don’t see that arms race ending any time soon.
Will the models stop writing code with bugs by mid 2027? xitter.cf/BVeiseh/status/2113389…
14
6
1
85
4,705
A guy built an AI that thinks it’s 1899, then tried to get it to beat Einstein to his most famous theories.
268
958
37
15,337
368,948
-----BEGIN RSA PRIVATE KEY----- 4 -----END RSA PRIVATE KEY-----
248
4,002
330
42,388
1,098,821
This seems bad.
111
1,926
139
39,925
777,646
Cloudflare open sourced a security audit skill that orchestrates coding agents through six phases of reconnaissance and validation to produce independently verified, machine-readable findings. github.com/cloudflare/securi…
9
58
3
639
46,647
I've decided to finally release my vulnerability hunting methodology that I've been using for several months now, both in testing as well as live engagements with great success. I was inspired by (and huge congrats to) the @Blackfrost_AI team open-sourcing Cyber-Frost Harness, their reproducible security-agent runtime with procedural skills, an evidence ledger, and isolated Docker targets for red/blue/purple work. 🎉 If you like the Cyber Frost Harness, and want some out of the box vulnerabilty hunting and POC development kit to go along with it - check out my VulnHunter. It's already loadable: their harness reads standard SKILL.md skills. Point skill_dir at VulnHunter's (or run its installer), and the hunting, falsification, and PoC disciplines load immediately. Repo: github.com/nealbridges/VulnH… CREDITS: This is fork of @CapitalOne original repo. I simply took it a step further on POC development and model agnostic. I'm also actively developing in my forked repo as I make more changes to it and welcome the contributions from the community as well. I think I'm doing the whole "respect who you give credit to" drama, and I asked my model to double and triple check it. So i can blame the model if its wrong. Otherwise, dont put me on blast on X if i suck at credits. /s Looking forward to developing on this further with the community.
31
220
9
1,562
104,401
An alternative to the fellowships: consider designing your own adventure! (Especially if you're e.g. mid-career or otherwise have constraints that would make it hard to take 3 months off to do a thing. Or if you just hate slogging through applications.) Link in thread!
New post! I've done a few advising calls with people looking to get into AI safety fellowships and realised there's lots of concrete advice I kept on repeating. There's lots of unusual advice that I haven't heard elsewhere, give it a read! lesswrong.com/posts/PiP4JqQF…
6
18
289
18,556
Google Mantis is a skills pack for security review with coding agents Install: npx skills add google/mantis Key commands: /mantis-threat-model: builds a threat model from your codebase
 /mantis-researcher: scans for vulnerabilities
 /mantis-review: filters false positives
 /mantis-reproduce: writes a PoC and runs it in a sandbox
 /mantis-patch: applies a fix and confirms it blocks the PoC
 /mantis-report: generates the final security report This is a good use case for running your agent in a sandbox, since the reproduce and patch steps execute generated code github.com/google/mantis
17
166
7
1,396
112,165
lol. Not the KPMG that I know of sha. Everyone come in as a staff through the same door, even if your dad is the president of the country
105
1,810
64
10,018
427,531
Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate. How it works: blog.google/security/agentic… For real-world vulnerabilities PageBreak has discovered 👇 bughunters.google.com/blog/p…
22
198
9
1,209
99,079
Want to become DANGEROUS with Python? Build these 10 systems:
2
41
335
23,891
10 AWS Projects You Can Build in a Weekend • Static Website → S3 + CloudFront Learn: hosting, CDN & caching • URL Shortener → Lambda + DynamoDB Learn: serverless APIs & NoSQL • Image Resizer → S3 + Lambda Learn: event-driven architecture • Serverless API → API Gateway + Lambda Learn: REST APIs & serverless compute • File Backup System → S3 + Lifecycle Rules Learn: storage classes & automation • Uptime Monitor → CloudWatch + SNS Learn: monitoring & alerting • Contact Form Backend → Lambda + SES Learn: event handling & email workflows • Expense Tracker API → Lambda + DynamoDB Learn: CRUD operations & databases • Log Analytics Setup → CloudWatch + S3 Learn: logging & observability • 3-Tier App → EC2 + RDS Learn: compute, databases & architecture Don’t just build projects. Know what each one teaches you.
2
13
89
3,794