Chief Analyst, Google Threat Intelligence Group. @CYBERWARCON and @SLEUTHCON founder. Johns Hopkins professor. Army vet.
Joined May 2011
- Tweets23.6K
- Following1.3K
- Followers31.1K
- Likes30.7K
Pinned Tweet
What an amazing day. Thank you everyone who made #CYBERWARCON happen. I can’t express how great it was to see you after such a rough couple of years. We made it!
If you're a threat Intel pro that's been laid off and you want to come to @CYBERWARCON I have a ticket for you. Hit me up.
UNC1151 carrying out destructive attack.
#ESETresearch released the latest #ESETAPTActivityReport (Apr–Sep 2026): 🇧🇾 Belarus-aligned APT groups are converging with Russia'’s war priorities; for the first time, we documented a destructive cyberattack by a Belarus-aligned group in 🇺🇦 Ukraine web-assets.esetstatic.com/wl… 1/3
John Hultquist retweeted
SCOOP: Both Moonshot and DeepSeek distilled #OpenAI's Astra when developing their latest models (Kimi K3.1 & V4.1-Flash 1017), after Anthropic intensified the crackdown on distillation recently. w/ @JuroOsawa @QianerLiu via @theinformation theinformation.com/articles/…
John Hultquist retweeted
People kept asking me for “ARTEX signatures” and “Cairn indicators”, so I wrote this
We found useful fingerprints and wrote rules. But identifying the framework isn’t the same as covering the attacks it orchestrates.
I wanted to explain that distinction, why attribution gets harder, and how noisy attacks can still succeed by moving fast.
I expect these frameworks to have a much bigger impact in the coming months. It’s worth understanding the technology behind the current attack waves, because I suspect they’ll build into a flood.
#ARTEX #Cairn
nextron-systems.com/2026/10/…
🤖 Made with AI
Cloud growing at 103%!
Q3 is in the books! We’re now on a half-trillion annual revenue run rate, with Alphabet revenues growing at 25%.
- Our AI investments are driving overall Search query growth, including commercial queries - our YoY query growth rate is the highest it’s been in the last five years.
- Google Cloud revenue grew 103%, powered by extraordinary demand for our AI infrastructure and AI solutions. Our 1P model APIs now process nearly 32B tokens/min (up 40% QoQ).
- Strong momentum in model progress with Argon and Carbon leading the frontier, and Genie 4 our most advanced new world model yet.
Thanks to our partners and employees around the world. More to share on the call soon!
John Hultquist retweeted
I did say we'd be releasing our models periodically...introducing Gemini 4 Carbon, our next frontier model.
Following Argon's release just two weeks ago, Carbon shows the pace at which we’re pushing the frontier, it ranks #1 on the recently updated v5.0 of @ArtificialAnlys Intelligence Index at 59. It also leads across key cybersecurity evaluations scoring 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching.
We’re seeing significant improvements in long-horizon tasks even compared to Argon, and we’ve strengthened frontier safeguards.
As we did with Argon, we’re going to roll it out gradually + responsibly. Some trusted cyber defenders will get access starting this week. We'll be expanding it to more partners through our Fairwind Program, ahead of wider availability soon, so hang tight!
John Hultquist retweeted
LLMs are great at finding bugs, but so are fuzzers. @5aelo compared the vulnerabilities found in V8 by BigSleep, an agentic system, with those found by the Fuzzilli fuzzer.
projectzero.google/2026/10/f…
John Hultquist retweeted
So happy to see my workshop being shared,
Thanks for putting together this helpful breakdown :)
Google just dropped a free 2-hour workshop on multi-agent systems, Loops and Graphs
From your first agent to a whole team that sees, hears and runs on its own:
0% → 00:09 - What you're building: an AI agent that sees, hears and talks back
30% → 36:55 - Build your first multi-agent system from scratch
45% → 56:11 - Give every agent its own MCP tools
75% → 1:09:28 - Sequential, parallel and loop agents, wired into one graph
100% → 2:05:07 - The whole system running live, reacting in real time
Agents → Tools → Loops → Graphs → Autonomous Systems
Most people are still tweaking the prompt of their very first agent
Worth more than any $2,000 agentic engineering course
Bookmark and watch it today
Then read how to run a system like this in the harness engineering guide below ↓
John Hultquist retweeted
important reminder: "The FEC does not play a role in administering US elections and the outage should have no effect on voters' ability to cast ballots."
BREAKING: A hacker is attempting to breach the US Federal Election Commission's systems and that agency has had to 'temporarily shut down' its web-facing services as a result, according to an email seen by Reuters reut.rs/4imQyUu
John Hultquist retweeted
Behold: The US Defense Intelligence Agency has released a report on challenges to security in space, including an NEI image of China’s spaceplane from Maxar, taken in 2024.
John Hultquist retweeted
Someone is setting up Chinese open models to voluntarily go around fixing and patching the PHP-based Internet's vulnerabilities, for free, and you're dooming?
Don’t worry kids we still have plenty of raisins from our covid stockpile! Nature’s candy!
Halloween candy sales are off to a slow start this year as U.S. consumers grapple with high living costs and eye-popping chocolate prices. trib.al/oGCJXEd
John Hultquist retweeted
Tehran has drawn up detailed plans to target undersea communications cables in the Gulf if the United States and Israel attack Iran again, two senior Iranian security officials told Reuters. reuters.com/world/middle-eas…
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
John Hultquist retweeted
An actor is attempting to exploit PHP2SHELL vulnerabilities in order to install patches. Interesting.
John Hultquist retweeted
#ESETresearch uncovered #MythicRatatoskr, an undocumented Go backdoor hiding its C&C server inside the #Yggdrasil mesh network. It was used against a Ukrainian 🇺🇦 grain logistics firm in an intrusion that ended in a destructive #Sandworm attack.
welivesecurity.com/en/eset-r… 1/6