itsme retweeted
Breaking news turns out if we throw millions, potentially billions, of dollars at finding bugs in software, we’re going to find bugs. It’s almost a self fulfilling prophecy.
The security industry has spent decades operating under the assumption that we’ll never eliminate every bug. Instead, we’ve built layers of mitigations that raise the cost of exploitation and shift the economics in favor of defenders.
itsme retweeted
These two live to cast themselves as the main characters in a little soap opera of their own making.
It’s not the rise of skynet to find a fucking php vuln and your warnings mean jack when they don’t come with an effective mechanism for replacing technical debt at scale so go ahead and climb up off that cross.
itsme retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
top 3 AI products for me this month:
1. @FactoryAI droid missions. Nothing like it. Feels like magic. Frees my time.
2. Grok @bot I'm coming around to it. Quite useful to keep up with things without spending all day scrolling.
3. @claudeai is constantly shipping great useful things.
itsme retweeted
‼️ NEW: Candiru spyware infected devices at Al Jazeera through ordinary online ads — no click, the ad only had to load.
The vendor that delivered it, Discover-Tech, was a Google-certified ad vendor.
Researchers call it the first proven case of spyware spread via targeted ads.
Read - thehackernews.com/2026/10/ci…
Food for thought.
Are human attackers "misaligned?" Do they "go rogue" and "escape sandboxes?" If we don't use this language with humans why are we using it with agentic processes?
In cybersecurity we use the language that an attacker "used a sandbox escape" yet frontier labs use the language that an agent "escaped the sandbox."
What is going on here? It's like agents are super anthropomorphized.
"better than any human hacker" lol, really think the best hackers are on hackerone? cute
Two years ago, I said we were going to build the world’s best hacker.
Many laughed.
Then we did it.
In January 2025, I told everyone at @XBOW’s annual kick-off that we needed to top the global HackerOne leaderboard before BlackHat, the main security event of the year.
The whole company groaned: "Oh no, here goes the mad professor again…”
But in all seriousness, I meant it. I wanted to prove XBOW’s ability, and I believed our AI could become better than any human hacker.
Competing against real white-hat hackers on HackerOne was the only true benchmark because you only score once a company confirms your bug is real.
Every day, our team of experts would select the targets and point XBOW in their direction. We’d all rush in the next morning to see what it had found overnight.
XBOW kept finding bugs. Palo Alto Networks, Wells Fargo, Netflix, Sony, Uber, Toyota… these weren’t Mickey Mouse systems.
By June, XBOW was the #1 hacker in the United States. It was the first time a machine had ever topped the leaderboard.
By August, it was the #1 hacker in the world, and we made global headlines. XBOW found 54 critical bugs over 90 days.
Our hypothesis that AI could hack as well as humans (or even better) had been proven beyond doubt.
So we stepped off the leaderboard and put XBOW to work.
Today, XBOW extends security teams at some of the world's most important businesses. Driving better defense with better offense.
I can tell overreliance on AI even from experienced security researchers. Quite telling on the latest iOS vuln ITW. Not the writing but the analysis itself. Check manually, you'll find better paths.
itsme retweeted
A Threat Actor operating under the moniker "Rey" has been apprehended by authorities on Jordan, working inconjunction with the United States Federal Bureau of Investigation.
Rey is believed to be a core member of ShinyHunters extortion group and potentially a person responsible for the recent compromise of the FBI.
reuters.com/world/middle-eas…
