Writes "Starting Up Security" @ https://xitter.cf/t.co/Rv0MaSThQ1, tweets horror stories @badthingsdaily

Joined March 2009
Ryan McGeehan retweeted
There was no payout because PHP2Shell came out of Patch the Planet (trailofbits.com/patch-the-pl…), a pro bono initiative where we (Trail of Bits, OpenAI, Calif and HackerOne) use AI to audit and secure open source software for free. If we were paid for every bug from PTP we’d all be driving Lambos by now.
My non-hacking buddy asked me how much the person who found the php2shell made. Then he made a good observation: Hack a small company, make a little. Hack a big company, make a lot. Hack 70% of the world, make nothing.
2
6
53
4,458
Ryan McGeehan retweeted
Today I'm parting ways with Fly.io. It's been a privilege. I'm off to tilt at a big old windmill with Kurt, again. sockpuppet.org/blog/2026/09/…
47
22
26
740
186,715
Ryan McGeehan retweeted
.@1Password's FLAWED report says AI models produce a clean security fix only 26% of the time. Defenders shouldn't take that number seriously. • The six vulnerabilities were handpicked because their fixes were complex. Clean-fix rates ran from 3% to 60% depending on the bug, and the report averaged them together. • Agents set up to fail were counted in the headline figure. Two of 1Password's prompts instructed the agent to apply the wrong fix. Those trials make up 22% of the data. One evaluation mode prevented the agent from compiling or running any code, and it accounts for 36% of the data. • The report ran two models, GPT-5.5 at medium effort and Opus 4.8 at high. Neither was tested at its highest available setting, so the report says nothing about how more effort or stronger models change the results. • Several instruction and grading errors further undercut the headline, and are elaborated upon in the attached blog. We've spent four months submitting hundreds of AI-authored patches to widely adopted open-source projects as part of Patch the Planet. Our experience didn't match 1Password's report, so we did a full analysis across 186 AI-authored pull requests and 33,500 subsequent commits, benchmarked against 2,265 human-authored patches we graded across years of security engagements. blog.trailofbits.com/2026/09…
24
49
13
267
557,081
Ryan McGeehan retweeted
1,535 potential bugs found, 1,017 awaiting patches, 326 fixes open upstream, 192 merged. Since Aug 4: +398 bugs, +46 merged, 55 codebases under review, and scapy has overtaken vllm as the most-reported codebase in Patch the Planet. trailofbits.com/patch-the-pl…
1
12
1
36
4,780
Ryan McGeehan retweeted
858 potential bugs found, 595 awaiting patches, 120 fixes open upstream, 143 merged. Our new Patch the Planet dashboard breaks down the latest results from our audits of curl, OpenSSL, Kubernetes, and 38 other open-source projects. trailofbits.com/patch-the-pl…
5
15
3
95
9,145
Ryan McGeehan retweeted
Rust maintainers assumed a team of engineers was behind our bug reports. It was one engineer using Codex's /goal.
7
10
4
390
42,441
Ryan McGeehan retweeted
Here's the big thing @trailofbits was cooking: xitter.cf/trailofbits/status/206…
Patch the Planet is our joint initiative with @OpenAI to help maintainers strengthen critical open-source software. In one week, we used Codex and GPT-5.5-Cyber to find hundreds of bugs inside OSS like cURL, Python, and the Go project. 37 patches merged, with more in flight. 🧵
5
7
61
9,540
Ryan McGeehan retweeted
🚀 We're out of stealth. Today we're introducing Ent, the industry’s first intent-aware Workspace Security platform for human and AI-driven work 🎥 See what it means to protect work as it happens. #IntentAware #LaunchFromStealth #WorkspaceSecurity #CyberSecurity
49
33
48
152
352,756
Ryan McGeehan retweeted
I strongly believe there are entire companies right now under heavy AI psychosis and its impossible to have rational conversations about it with them. I can't name any specific people because they include personal friends I deeply respect, but I worry about how this plays out. I lived through the great MTBF vs MTTR (mean-time-between-failure vs. mean-time-to-recovery) reckoning of infrastructure during the transition to cloud and cloud automation. All those arguments are rearing their ugly heads again but now its... the whole software development industry (maybe the whole world, really). It's frightening, because the psychosis folks operate under an almost absolute "MTTR is all you need" mentality: "its fine to ship bugs because the agents will fix them so quickly and at a scale humans can't do!" We learned in infrastructure that MTTR is great but you can't yeet resilient systems entirely. The main issue is I don't even know how to bring this up to people I know personally, because bringing this topic up leads to immediately dismissals like "no no, it has full test coverage" or "bug reports are going down" or something, which just don't paint the whole picture. We already learned this lesson once in infrastructure: you can automate yourself into a very resilient catastrophe machine. Systems can appear healthy by local metrics while globally becoming incomprehensible. Bug reports can go down while latent risk explodes. Test coverage can rise while semantic understanding falls. Changes happens so fast that nobody notices the underlying architecture decaying. I worry.
502
1,890
394
15,239
1,624,552
Ryan McGeehan retweeted
“Detection is a problem I describe as deceptively tractable.” @Magoo on 🔍 Prioritizing Detection Engineering Proposed implementation order: 1. Get logging in order, focusing on query-ability and minimum viable logs. 2. Spend time on hardening before formalizing detection. 3. Introduce high-quality detections and alerts, starting with a reference alert and focusing on invariants. 4. Address management challenges before scaling detection efforts. 5. Fully embrace an engineering approach to detection, with the ability to throttle or accelerate work as needed. medium.com/starting-up-secur…
2
17
1,611
1/ Thrilled to announce we’ve raised $150mm Series C at a $2.45bn post valuation led by @sequoia alongside our existing investors @ycombinator, @CrowdStrike, @craft_ventures, @Atlassian, @Workday, and @HubSpot and new friends @GoldmanSachs and @jpmorgan. The terms on this round are exactly as we aim Vanta experiences to be: straightforward and clean.
80
48
43
824
281,615
Ryan McGeehan retweeted
Sundar Pichai
@sundarpichai27 Mar 2024
New report from our Threat Analysis Group + @Mandiant observed 97 zero-day vulnerabilities exploited in the wild in 2023, up 50% from 2022. Good news: investments are making a difference - vulnerabilities once common are virtually non-existent today. blog.google/technology/safet…
47
104
8
592
163,796
Ryan McGeehan retweeted
In the hype around offensive uses of AI it's important to remember that there is an existing defense for every attack an LLM can instrument. A good defense is never based on the tool the attacker is using, thats called 'patching the exploit' and it's an anti pattern to avoid.
In the debate around how AI will affect the balance between offense and defense, and how AI can be used by bad actors, I often see people confuse “things you can do with AI” with “things you need AI to do”. The difference is important, especially when the bar for successful attacks is already so low relative to the cost of operating a successful and sustained defense.
2
7
34
13,133
🚀Big news @material_sec today! All the Material goodness (instant search, data classification, data protection) is now available for Google Drive. 🎉 Full announcement and demo video here: material.security/blog/intro… #DataProtection #GoogleDrive #Security
1
3
12
819
Ryan McGeehan retweeted
We're naming names 🔥 because the harm is not hypothetical. Today we share "Buying Spying", our new report diving into the commercial surveillance/spyware industry. We dive into the players, the campaigns, the spyware, & the harm it perpetuates. blog.google/threat-analysis-…
10
268
22
595
135,458
Ryan McGeehan retweeted
💥New ITW 0-days discovered by @_clem1 and @benoitsevens . CVE-2023-6345 in Chrome (Skia) and CVE-2023-42916 and CVE-2023-42917 in Safari. Chrome bug patched on Tuesday only 4 days after report 😍 and... chromereleases.googleblog.co…
3
84
1
223
52,099
Ryan McGeehan retweeted
I've always thought that having the ability to set tripwires on arbitrary files on an endpoint would be a huge defensive advantage. Today, that is now a reality for all users of osquery in macOS: material.security/blog/prote…
7
33
4
91
19,996
Ryan McGeehan retweeted
.@Hacker0x01 Hacktivity now helps predict the likelihood that a particular CVE will be exploited in the wild! Introducing the addition of Exploit Prediction Scoring System (EPSS) to HackerOne: hackerone.com/vulnerability-….
1
7
56
7,819
Ryan McGeehan retweeted
PSA: we have seen the vague viral reports alleging a Signal 0-day vulnerability. After responsible investigation *we have no evidence that suggests this vulnerability is real* nor has any additional info been shared via our official reporting channels.
43
823
110
3,901
1,129,145