nol retweeted
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish?
Expert: No, software is constantly evolving.
Philomena: So they've been writing the same website for 20 years?
Expert: No, different projects.
Philomena: Have they tried finishing one before starting another?
Expert: That's not how software development works.
Philomena: My mate Paul spent 20 years building a shed. Turned out he was just an alcoholic.
Expert: Right.
Philomena: Is PHP like that?
nol retweeted
I just love the fact that this week everyone pretends like there is zero chance that some people might have been sitting on the PHP vuln for YEARS, and kept a low profile, rather than competing over days for winning more internet points.
nol retweeted
THIS!! In all the excitement of AI'ing the vuln hunting process, people forgot to update their own perspectives. Collisions are happening all over the place, because AI. What.. did you think that the 2000% increase in Patch Tuesday CVEs was because everyone got smarter? 🤣
french dream AI
ML4 was trained on 3,800 NVIDIA Grace Blackwell GPUs in our European datacenters -- our cluster in Bruyères-le-Châtel built using our Series B fundraise.
We are investing heavily in infrastructure, with our Series C and D clusters coming online soon. This additional compute will let us train longer, pursue more ambitious post-training, and iterate faster.
We expect large and rapid improvements in the weeks and months ahead.
2/n
nol retweeted
HEIF Heist (The image format bug that hacked everything or could have) got me thinking, I'd prefer running complex binary image parsers in a memory safe language. So I told the computer to build ImageMagick with Fil-C, and it seems to work fine. Enjoy:
github.com/scriptjunkie/mems…
nol retweeted
Yeah, this. You have 100s of detections, you only need one to go off. You have dozens of honey tokens, you only need one to get used. You have layers of address space mitigations, only one has to kill the chain.
It's not nearly as asymmetric as people would like to think.
'Attackers only have to get it right once. Defenders have to get it right every time.'
this is 100% nonsense!
as a defender:
> some things will get through
> it's how we prepare, responding and recover that matters
> some incidents have zero to minimal impact
> near misses are a thing
I do not need to be right every time!
only sales dick heads who have never done the job say shit like 'Attackers only have to get it right once. Defenders have to get it right every time.'
It's not how this game works!
#Cyber #Reality
nol retweeted
Not a big name but this is very clearly true and we have strong evidence for it. Mythos failed to crack Firecracker.
It has largely exploited systems that are not particularly hard targets.
Existing tech can handle this when deployed properly.
nol retweeted
The official IDA MCP Server is here. It's free, open source, and works with any LLM.
Your agent writes IDAPython, uses ~20% fewer tokens, and can share an IDB with you in real time.
𝚞𝚟𝚡 𝚒𝚍𝚊-𝚑𝚌𝚕𝚒 𝚖𝚌𝚙 𝚒𝚗𝚜𝚝𝚊𝚕𝚕
hex-rays.com/blog/hex-rays-i…
(copy-paste: uvx ida-hcli mcp install)
nol retweeted
Playing around with Jev to see how it performs with offsec.
Its speed and insane low cost certainly opens up novel concepts, like this POC doing real-time scoring of command opsec in Mythic, and identifying the expression type.
It's not great at cyber yet, but exciting to see!
nol retweeted
Write-up for MS06-040 and MS08-067
iss4cf0ng.github.io/2026/09/…
nol retweeted
🚨 Casse-Spip: pre-auth RCE on SPIP, the CMS behind thousands of French public and media sites.
🔎 Our auditor @WaykoDev found the SQLi with Claude Opus 4.8.
⚡ Chained into RCE: 4 anonymous requests, no account.
✅ Fixed in 4.4.18 (CVE-2026-72708/9/10)
blog.lexfo.fr/casse-spip-sql…
nol retweeted
that Astra really is that good
Sam Altman says Trump and Xi would win the Nobel Peace Prize for a one-page AI agreement
“I think Presidents Trump and Xi would get the Nobel Peace Prize together if they could agree on something that should be easy to agree to. And it would be wonderful.”
“I think that clearly the two countries are going to compete in lots of ways, and this is going to be important socioeconomically, geopolitically. But they should be able to agree that no one should be taking a certain level of risk with the development process of this.”
“And even if just the US and China could agree on some shared standards and testing for development of this technology, I think that'd be a wonderful accomplishment that the two of them can deliver.”
“I don’t think this is hard. This is like a one page document.”
nol retweeted
Claude is the largest honeypot in foreign intelligence history.
Among the revelations everyone should read in this report:
🇨🇳 CHINA :
• Copied Claude at huge scale to train Chinese AI models
• Used Claude to watch social media, find critics, and track people overseas
• One government office replaced its human analysts with Claude
• Multiple companies hacked
• Used Claude to help write software for weapons
🇷🇺 RUSSIA :
• Used Claude like an automated hacking team against Ukraine and Europe (targetting members of governments, military, diplomats)
• AI rewrote malware when antivirus caught it
• Phishing, hotel Wi-Fi traps, WhatsApp takeovers
• Stole drone tech
• Tried to design kamikaze drone swarms
• Ran influence / propaganda campaigns
🇮🇷IRAN :
• Built tools to spy on Iranians (thousands of people profiled)
• Made a fake browser add-on to steal identities
• Used Claude to pick U.S. Navy targets
• Built a domestic surveillance system
• Ran propaganda campaigns
🇲🇱MALI :
• One consultant built a nationwide phone-spying system with Claude
• Watched about 25 million SIM cards from all mobile operators
• Made target files without the usual court-order step
🇾🇪YEMEN :
• A group in the north used Claude as their software engineer
• Worked on a guided rocket, a long-range ballistic missile, and a hypersonic missile design
🇹🇷TURKEY :
• Ran online influence campaigns (same type of election-timed propaganda as Russia and Iran)
nol retweeted
JetBrains got breached through an unpatched TeamCity server.
JetBrains makes TeamCity.
🫠
thehackernews.com/2026/09/at…
nol retweeted
i can't update my computer because
1. you need to provide an access token for github to avoid the rate limit
2. if you are a member of the nixos org (i. e. submitted a pull request) you can't have tokens that live longer than 365 days, even though the token doesn't touch the org
