Hacker. Co-founder Veracode. Former L0pht security researcher. GenAI Auto-repair of vulns is the future
Boston, MA
Joined March 2008
- Tweets30.6K
- Following1K
- Followers55.6K
- Likes8.2K
Pinned Tweet
28 years ago today, 7 members of the hacking group @L0phtHeavyInd told the U.S. Senate they could "shut down the internet in 30 minutes."
Chris Wysopal retweeted
Remember how Anthropic said Project Glasswing (Mythos) found tens of thousands of software vulnerabilities?
Security firm VulnCheck just audited the actual 7-month Glasswing ledger, and the numbers are wild:
- Out of 37,966 total findings, 30,617 (80.6%) aren't even in the public ledger yet
- Only 217 findings (0.57%) have actually been fixed
- Between Sept 8 and Nov 2, total findings jumped by +11,813, while fixes went up by only +15 (from 202 to 217) and duplicates exploded from 2 to 1,670
Even worse: Anthropic's unreviewed OSS Scanner sent 45 vulnerability reports to `curl` creator Daniel Stenberg and out of the 34 published so far, 19 of them (55.9%) were rejected as `vuln:NONE` (not a real vulnerability).
Chris Wysopal retweeted
The time to develop exploit code for a vulnerability, is different from when adversaries first try it in the wild, and it’s different from when it’s first exploited in a breach.
In 1998, we at L0pht told the Senate software makers weren’t building security into products. 28 years later, users still pay for preventable flaws. Congrats to Lauren Zabierek & @boblord on launching the Software Safety Institute. Long overdue.
softwaresafety.org
Now this is a hackathon I can get behind. More of this please!
College Hackathon Roots LG TV, Finds It Sharing Location Data
securityledger.com/2026/10/c…
Supply chain attack through trusted 3rd party monitoring script that was replaced with malicious code.
POLYMARKET HALTS TRADING AFTER HACKERS DRAIN USER FUNDS WITHOUT PASSWORDS OR SEED PHRASES
Attackers allegedly exploited users’ active sessions to sell their positions and withdraw funds directly through Polymarket’s own system.
The attack reportedly originated from a compromised DebugBear website performance monitoring script, which was replaced with malicious code that users’ browsers trusted.
Trading resumed after roughly one hour. Polymarket says affected users will be reimbursed and the incident has been referred to UK law enforcement.
Chris Wysopal retweeted
Technology will change. The fundamentals of software security won't.
For #CybersecurityAwarenessMonth, Veracode CTO @WeldPond shares 10 security practices built to stand the test of time.
Read more: darkreading.com/cyberattacks…
Veracode's GenAI code security benchmark average has improved for the 1st time. LLMs are starting to write more security code!
The average security pass rate jumped from 56% to 62%. The new high water mark is 73%, shared by two models. Ten models now clear 60%, up from four, and cross-site scripting (CWE-80) is finally climbing.
veracode.com/blog/fall-2026-…
At @unpromptedconf, @schneierblog stresses the need for Integrity in AI systems as the internet becomes civilization’s control plane with AI. He is bringing back the word “integrous”.
The leader board. Save time fixing and verifying security bugs by getting the code right the first time.
103
Chris Wysopal retweeted
My forward to the 40th anniversary Phrack, released today at [un]prompted. A true honor, and responsibility, I will not soon forget.
Thank you to the Phrack team for all you do, and for being what this community is about for so long. We owe you so much
Chris Wysopal retweeted
AI-driven threats demand collective resilience.
This Wednesday at 3 PM CDT, join @WeldPond at #FSISAC in Austin to explore how financial institutions can strengthen cyber defenses.
Connect with Veracode at Booth #68!
fsisac.com/events/americas-f…
Does anyone remember the time in the 90s when people thought the antivirus vendors were releasing viruses so companies had to buy their products?
Now AI is finding vulnerabilities, writing exploits, and creating threats so fast that the only way to defend yourself is to buy more AI.
It’s starting to feel like the 90s all over again.
Chris Wysopal retweeted
PHP2Shell exposed critical vulnerabilities in core PHP, affecting every PHP version released in the last decade
Patching still matters, but it cannot be the whole strategy.
@Weldpond on why resilience must be built in.
veracode.com/blog/the-week-s…
I'm excited to speak with @manicode tomorrow on how LLMs often write code with vulnerabilities if you don't give them any security intent and how we can improve GenAI secure coding.
AI writes more code than ever, but security isn't keeping pace.
Our 2026 GenAI Code Security Report found an average security pass rate of just 56%.
Tomorrow, join @WeldPond and @manicode to explore the findings and practical ways to close the gap. veracode.com/resources/webin…
Chris Wysopal retweeted
I'm going to be on a podcast tomorrow with @Veracode and the OG himself, @WeldPond
Please join us!
veracode.com/resources/webin…
