Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected. This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled. anthropic.com/research/attac…

Using Claude to reduce the attack surface of code

Automated attack surface analysis and reduction can meaningfully improve the security of deployed software in the near term. In this post, we preview data we’ve collected from applying attack surface...

anthropic.com

972

Tal Be'ery · Oct 21, 2026 · 4:58 AM UTC

Tal Be'ery

@TalBeerySecOct 21

Small D Energy

HD Moore@hdmooreOct 20

arstechnica.com/security/202… The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).

The Internet goes on high alert after discovery of 8 compromised TLS certs

Intermediate certs allow anyone to mint web credentials for any Internet server.

arstechnica.com

1,007

Jeremiah Grossman · Oct 20, 2026 · 12:00 PM UTC

Tal Be'ery retweeted

Jeremiah Grossman

@jeremiahgOct 20

Yes. What he said. And, if you look close, all very knowable in advance when you're able to distinguish between what's possible vs what's probable.

Tal Be'ery

@TalBeerySecOct 7

1/ My new blopost on "Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)?" TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are. medium.com/@TalBeerySec/why-…

Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)? It’s the Economy, Stupid.

TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are.

medium.com

2,268

Tal Be'ery · Oct 20, 2026 · 9:21 AM UTC

Tal Be'ery

@TalBeerySecOct 20

גם אני מתכוון להצביע בנט @naftalibennett

Tal Morgenstern

@TalMorgensternOct 20

מסתבר שהודעת התמיכה שלי במר בנט התחילה איזה גל קטן.. ככה אמרו האנשים המעולים מהמטה שלו שהתקשרו והציעו שניפגש. התלבטתי והסכמתי, כדי להגיע לעוד אנשים. זה אולי אחד השבועות החשובים בהסטוריה של מדינת ישראל - רדו מהגדר! לכו להצביע ושכנעו את כל מי שסביבכם.

188

4,081

Tal Be'ery · Oct 20, 2026 · 7:55 AM UTC

Tal Be'ery

@TalBeerySecOct 20

״הבן שלי סיים תואר בהפרדה מגדרית, ועכשיו אנחנו מחפשים מציאות בהפרדה מגדרית שיוכל להשתלב בתוכה״

♥️𝕋𝕠𝕠𝕝𝕪@Tal202020Oct 19

״הבן שלי סיים מערכת חינוך אנתרופוסופית, ועכשיו אנחנו מחפשים מציאות אנתרופוסופית שיוכל להשתלב בתוכה״ זה זהב טהור 😂

544

Omri Segev Moyal · Oct 20, 2026 · 7:35 AM UTC

Tal Be'ery retweeted

Omri Segev Moyal

@GelosSnakeOct 20

Replying to @TalBeerySec @ProferoSec @Mandiant @Volexity @attrc @uuallan @TalosSecurity @RGB_Lights

We were turning away work before AI. What changed is the mix, not the exploit curve. We’re not seeing more 0-days or 1-days in our cases. That CVE spike barely shows up in our IR queue. What’s driving volume is AI inside the house: AI-written code shipping more vulns and logic flaws AI-generated configs leaving things exposed Agents misbehaving and breaking things on their own. We call it AI-induced destruction. So yes, AI is the root cause, just not the way people think. Breaches aren’t rising because attacks got better. They’re rising because what we ship got worse.

1,719

Tal Be'ery · Oct 20, 2026 · 6:42 AM UTC

Tal Be'ery

@TalBeerySecOct 20

IR folks (@GelosSnake @ProferoSec @Mandiant @Volexity @attrc @uuallan @TalosSecurity others, please tag): trying to put numbers on breaches. Vs. a year ago (or whatever makes sense), how many more cases are you seeing? Are you really "turning away work" as @RGB_Lights says?

Rob Joyce@RGB_LightsOct 19

Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. reuters.com/legal/government…

EXCLUSIVE: How one hacker used AI agents and a few thousand dollars to break into scores of sites

A report found AI agents attempted 1,200 break-ins and compromised more than 100 sites.

reuters.com

4,680

Tal Be'ery · Oct 19, 2026 · 3:02 PM UTC

Tal Be'ery

@TalBeerySecOct 19

The @elder_plinius mystery continues.. Will present @BlackHatEvents Europe event, but remotely blackhat.com/europe/briefing… #BHEU #BHEU26

696

Ian Miers · Oct 19, 2026 · 1:37 AM UTC

Tal Be'ery retweeted

Ian Miers@secparamOct 19

Replying to @TalBeerySec @matthew_d_green

Ironically, after Hillary Clinton got her leaked emails authenticated by DKIM signing, Matt went on to write a blog post "Ok Google: please publish your DKIM secret keys"blog.cryptographyengineering…

Ok Google: please publish your DKIM secret keys

The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major …

blog.cryptographyengineering.com

521

Tal Be'ery · Oct 18, 2026 · 11:50 AM UTC

Tal Be'ery

@TalBeerySecOct 18

1/ "Your Number Is Up: When 3.5 Billion Strangers Can Exploit Your WhatsApp Devices" Our @BlackHatEvents Asia 26 talk video is live. youtube.com/watch?v=FXV0LWPc… #bhasia #bhasia26

Black Hat Asia 2026 | When 3.5 Billion Strangers Can Exploit Your...

WhatsApp evolved from a simple text-messaging app serving thousands...

youtube.com

Tal Be'ery

@TalBeerySec30 Aug 2025

A week ago, I reported a privacy vulnerability to @Meta which may allow attackers to discover any @WhatsApp users' devices details, including online status and operating system. This flaw enables adversaries to accurately target a vulnerable iOS (iPhone) device.

1,003

Tal Be'ery · Oct 18, 2026 · 11:50 AM UTC

Tal Be'ery

@TalBeerySecOct 18

2/ Presentation slides i.blackhat.com/Asia-26/Prese…

133

Tal Be'ery · Oct 18, 2026 · 9:03 AM UTC

Tal Be'ery

@TalBeerySecOct 18

Old but gold from @matthew_d_green: OTR/Signal/WhatsApp's "plausible deniability" property — what enables chat history forging — is mostly a vanity feature. "'Dammit, they used a deniable key exchange protocol' said no Federal prosecutor ever." blog.cryptographyengineering…

Tal Be'ery

@TalBeerySecOct 11

Burning a possible @BlackHatEvents submission just to make a point: I modified WhatsApp to permanently rewrite its own chat history by editing the local message DB. Kill the app, reopen it — the altered history is still there. For good. Even the DB cannot prove authenticity.

2,922

Tal Be'ery · Oct 17, 2026 · 5:57 PM UTC

Tal Be'ery

@TalBeerySecOct 17

מעולה! בן שנתיים כמעט, אבל העצה של @DannyLeshem (עם קרדיט ל @OmerAlali7) ירוקת-עד. טריויאלי: לעשות סטארטאפים רק אם יש לך יתרון לא הוגן. לא טריויאלי, ללחוץ על ההדק כשיש הזדמנות נכונה: להכין לעצמך עתודות (כסף ו/או זמן) כדי שתוכל טכנית , ולהתאמן דרך הימורים כדי שתוכל מנטלית.

Danny Leshem ⚡

@DannyLeshem18 Feb 2025

בפרק 21 של הפודקאסט ״כסף חכם״ דיברתי עם @brand_yona93102 על סטארטאפים, פאונדרס, ניצול הזדמנויות (תודה @OmerAlali7!), השקעות הון סיכון, ולמה משתלם לשחק פוקר ולאמן את המוח ב-degenerate gambling. מוזמנים לצפות פה, או להאזין בפלטפורמה המועדפת עליכם :) youtube.com/watch?v=1DCg8TD9…

פרק 21 על הקשר בין פוקר להצלחה בעסקים עם דני לשם - טכנולוג, פאונדר,...

פרק 21 של כסף חכם: דני לשם, טכנולוג, פאונדר, משקיע ומהמר for fun an...

youtube.com

925

Tal Be'ery · Oct 16, 2026 · 7:54 AM UTC

Tal Be'ery

@TalBeerySecOct 16

Finally, the Linux networking stack achieves five nines

Paulos Yibelo

@PaulosYibeloOct 15

The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug. CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️ pwn.ai/blog/pwnescape

995

Tal Be'ery · Oct 16, 2026 · 6:57 AM UTC

Tal Be'ery

@TalBeerySecOct 16

Great read!

Ophir Harpaz@OphirHarpazOct 15

Last month, Meta AI published research on "Unslopping AI", describing their attempt to train models to write better. Ironically, it read a lot like AI slop, so I decided to decode it into plaintext and share it along with some critique... enjoy the read ;) ophirharpaz.com/posts/unslop…

Unslopping AI in Plaintext

A couple of days ago I saw a reference to an interesting piece of research from Meta AI about "Unslopping AI". After reading it, my gut feeling was that the blog reads a lot like AI slop. (I can't...

ophirharpaz.com

652

Tal Be'ery · Oct 15, 2026 · 3:01 PM UTC

Pagers too

🚨 INSIGHT: CZ says all hardware wallets should have see-through cases in the future to help users spot signs of tampering.

431

Tal Be'ery · Oct 15, 2026 · 1:59 PM UTC

Tal Be'ery

@TalBeerySecOct 15

A secure mobile app is a great usability vs. security trade-off. @zengo welcomes Ledger to the club.

CoinDesk

@CoinDeskOct 15

LATEST: @Ledger announces the Atom, an Android-based device launching mid-2027 that combines everyday smartphone apps with hardware-level crypto security. It features a tamper-proof enclosure designed to block the screen-reader implants used in last week’s attack.

393

Tal Be'ery · Oct 15, 2026 · 11:42 AM UTC

Tal Be'ery

@TalBeerySecOct 15

1,000 swordsmen vs. a gun. This cannot be the future.

CNBC

@CNBCOct 14

Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos cnbc.com/2026/10/14/anthropi…

Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos

Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic’s Mythos, offering a rare look at costs involved in defending against AI.

cnbc.com

3,008

Tal Be'ery · Oct 15, 2026 · 11:38 AM UTC

Tal Be'ery

@TalBeerySecOct 15

Good data on the fix-to-CVE gap. But the conclusion that "CVE publication in many cases helps attackers more than defenders" doesn't follow. If anything, the opposite: attackers watching commits get a 39-day head start; the CVE is when defenders finally get the signal.

Cyburger

@CyburgerimOct 13

The Patchless Window

Article · @Cyburgerim

610