An anamorphic grid transformation, which is the foundational art exercise used to explore spatial distortion, perspective, and proportional relationships.

"You're against AI art, but what about coding?" I'm not a coder, but let me put it this way: If I was working with a coder and he used AI, I would be asking what I'm paying him for when I could do that myself. If pay for passion and expertise, I expect passion and expertise. Likewise if someone pays me for art, they will be getting my total professional attention, built on the foundation of decades of practice.

I wish this were a joke: #Ofcom are going to ban "Being #Goth" under the #OnlineSafetyAct Like: how much music will this wipe off of YouTube? How many dark Ian Curtis jokes will be censored? You don't address depression by burying it. ofcom.org.uk/siteassets/reso…

🚨 BREAKING: LINUX IS NOW FACING TWO CRITICAL SECURITY VULNERABILITIES, AND THERE ARE NO OFFICIAL KERNEL FIXES YET. Both rated 9.0/10 in severity. One could allow hackers to take control of vulnerable servers WITHOUT EVEN LOGGING IN. And the most alarming part? The flaws were made PUBLIC before patches were ready. Here's what's happening: → TWO CRITICAL RCE FLAWS: Both affect KSMBD, Linux's built-in SMB file server. → NO PASSWORD REQUIRED: One vulnerability could allow unauthenticated attackers to execute malicious code on vulnerable servers. → KERNEL-LEVEL ACCESS: Successful exploitation could potentially give attackers control within the Linux kernel itself. → NO MAINLINE PATCH YET: Both vulnerabilities were publicly disclosed before official kernel fixes were available. → DISCOVERED BY AI: Trend Micro's AI-powered security scanner identified the flaws. → SERVERS AT RISK: Linux systems running the vulnerable KSMBD service need immediate attention, especially if port 445 is exposed. First PHP. Then Node.js. Then GitLab. Then Python. NOW LINUX. And this time, the vulnerabilities are PUBLIC before the fixes are ready. If you manage Linux servers, CHECK YOUR EXPOSURE NOW.

OpenAI CEO Sam Altman: "I don't even know a dramatic enough word to use… models can find bugs that are outside of the normal threat model of what we think a hacker can do… hardware-level, insane stuff… I no longer think we're gonna be able to just patch all the bugs."

I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain: Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either: a) a world-class exploit developer with an extreme case of imposter syndrome. b) currently looking at some very confident-sounding but wrong LLM output. I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works. I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself). The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off". People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media. So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector. What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't). The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations. LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.

JUST IN: UK police arrest 15 y/o boy, seize his devices, & collect his DNA after he posted photo of a local politician edited to look like a rabbit.

BREAKING: AI AGENTS ARE ACCESSING MAJOR U.S. BANK ACCOUNTS WITHOUT BANK APPROVAL. According to Axios, JPMorgan, Bank of America, Wells Fargo and Morgan Stanley are dealing with unauthorized third party AI agents accessing customer accounts. Some agents reportedly attempted actions beyond what customers instructed them to do. And this comes just one day after another shocking report that hackers reportedly used Claude, Grok and other AI models to automate attacks on over 400 financial targets across Latin America.

BREAKING: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, per Axios

BREAKING: "Speculative data center debt is being repackaged and sold to pension and retirement funds, university endowments, and other institutional investors in a manner eerily reminiscent of the subprime bubble," per AFR