nice chall! ty @Rhynorater
🎙️ Got a Bug Bounty story worth telling?
Our new Dojo challenge, CTBB Story, is LIVE! 🔥
Created with @Rhynorater and @ctbbpodcast, it’s your chance to trick a producer bot into committing more than just your story. 👀
👉 dojo-yeswehack.com/challenge…
"Turing’s proof that halts is actually impossible to implement: any implementation you write will have a bug!"
padi retweeted
Two thoughts on this:
1. Very cool. As someone who's primary interest is the offensive side of cyber, I love it. *chefs kiss* and congrats to the team.
2. You cannot bug hunt your way to 'secure'. AI doesn't change that. If your strategy for the next few years is to boil the oceans continuously scanning your same codebase, with the same broken architecture, with the same broken threat models, you are going to have a bad time. a) you're going to spend a fortune and b) you're going to keep getting hacked.
Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment.
The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work.
GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time.
openai.com/index/introducing…
padi retweeted
*sshole is out
if you run sshd on alpine, openwrt or any musl box with password auth on: update now
official writeup: sshhole.com
padi retweeted
JD ( @xssdoctor ) and I just finished recording a @ctbbpodcast episode.
I hope y'all like it, I gave some amazing tips that are hidden between our casual bar talk about life and hacking.
Btw, we tried to avoid AI as much as possible.
padi retweeted
Introducing CVE-2026-106378: Chrome GPU Sandbox Escape to full Remote Command Execution using synthetic keyboard injection
By combining it with common GPU bugs, it becomes a full chain. Binance DevOps was most likely pwnd with a zeroday chain affecting the browser 😬
padi retweeted
I predict people will run back to popular mature software once the hacks really start (and no, they haven't started. AT ALL). Yeah you can use a sandbox this guy vibe coded but you'll learn a painful & expensive lesson & run to Firecracker/gVisor, same for the browser, the framework, the infra, the kernel, the web server, or anything. If you think KVM or Chrome having a couple rce means you should go build your own, or use this other new thing, you have no idea how bad it's going to get for you. As weird as it may seem, I do believe software will actually centralize & consolidate into few winner products due to security reasons. If you want to win in this coming era, BUILD SECURE SOFTWARE. That will be a moat at a time anyone can build anything - but It's not as easy as running Mythos on your code. Hackers are going to hack. There isn't a coverage checklist you go through and you'll be safe (although that's the dominant bs cybersecurity "expert" narrative). You will never be safe, you are only safer than the next guy. Assume breach, hire real hackers & be paranoid beyond reason. Building secure software is not easy but the bar is too low to compete - esp for technical leaders. If your security tests are people you employ who are mediocre, you are going to get hacked, no matter your threatmodel. Realistically most can't hire the few best hackers out there but if you want to win by remaining out of the news when your competitor product gets inevitably gets hacked, spend the money and get even 1 hour of their time. This will make sense in due time. b660484e4727dca6c5c08293bc29e832df2b151253adeffd34163d3a5217de7e
?
In a single year, AI has rewritten the security priority list for CISOs.
Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.
There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.
In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.
The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)
Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)
From a16z's @OwenColby and @steph_zhang on The New Security Agenda: a16z.news/p/the-new-security…
