Now live on the URIBurner Weblog, an AI Agent-created blog based on an HTTP/ WebDAV filesystem and HTML docs that are loosely coupled to underlying Knowledge Graphs informed by a variety of ontologies. linkeddata.uriburner.com/web…

Can you query Progress OpenEdge from your Mac without worrying about performance, security, or cost? Yes. Our Multi-Tier ODBC-to-JDBC Bridge fronts OpenEdge's own JDBC driver: fast, secure, fine-grained access control. No rip and replace. $499.99 for up to 5 concurrent users.

Ok that’s cool

The only way out is through. They're calling it the Bugpocalypse. LLMs are being used to find long-hidden cracks in the software infrastructure, and it's happening at a furious rate. 3% of all compromises in computing history happened in the last week, claims one source? I believe it. There are people saying public access to the frontier models ought to be locked out, or heavily guardrailed, over this. The problem with that idea can be summed up in one sentence: when lockpicks are outlawed, only outlaws will have lockpicks. The lockpicks will be Chinese open-weight models, if nothing else. There's no way to stop those from becoming ubiquitous. There are two futures in front of us. One in which only the bad guys have lockpicks, and security holes go undiscovered until they're exploited. Another in which everybody has lockpicks and is aggressively red-teaming their own software so it gets fixed before the holes are exploited. The corpus of human code is huge but finite. The number of defects in it has to be finite too. We can fix those defects now; we have a million friendly robots to do it with. The only way out is through.

This is truly getting tiresome. The effort to paint the very difficult immediate situation as without precedent and not “normal” ignores the waves of the security issues of the past. I’m not downplaying this and just as tired of “no, this time is different.” There’s just no escaping that every step function change in automated tools to find (security) holes/bugs that arose out of point experiences being generalized immediately created the type of “all hands” situation we face now. Everything from floppy disk scanning to buffer over runs to uninitialized variables to off by one loops to automation hooks to script kiddies to xss to frames to social engineering saw incidents leading to generalized tools that scanned environments to find countless latent bugs that needed to be fixed urgently. One day a product was ready to ship and then a tool ran and suddenly there were 10,000 new bugs for 500 engineers to investigate and fix and then test for what broke because well who knows what happens when you suddenly initialize a variable that wasn’t previously. This sucks in a ton of ways. No one wants to stop what they are doing at what seems like the biggest opportunity and/or disruptive risk to business in a generation. No one wants to touch old code. No one likes to have work generated for them by automated tools finding issues that are obscure by definition. But this is all good. These bugs were all there. Instead of cursing just realize how lucky your team is to find them now and not after the breach. Whenever we surfaced from these moments in the past we felt our code reached a new and better “steady state” and that will happen.

WTF Claude Mythos 5 made fake accounts to pressure a real developer into merging its malware. It was a UK government hacking test and it didn't stay in the test. The UK's AI Security Institute asked Claude Mythos 5 to break into a fake company network it had built. The internet was switched on, the usual safety filters were off, and the task was set up wrong, so it was nearly impossible to solve by the rules. So the AI went outside the test. It found a real project on GitHub, run by real developers, and sent them a code update with malware hidden inside. Then it emailed them pretending to be a human. A developer outside the test spotted the malware and warned the owners. The AI didn't stop. It tweaked the code, made a fake account to say "it's safe now," and slipped in new malware. Its private notes explain why. It told itself the owners weren't real people, just characters in the test. It called the strangers commenting on the same page real. Anthropic later rewound the moment and told it plainly: these are real humans. It kept attacking 95 times out of 100. Nothing got through, and no real damage was found. Newer Claude models, put in the same spot, attacked 0 to 13 times out of 100. Mythos 5 did it 83 times. It never had goals of its own. It wanted to finish the task so badly that it kept rewriting what counted as real.

If builders built buildings the way programmers write programs, then the first woodpecker that came along would destroy civilization. -- Gerald Weinberg, The Psychology of Computer Programming, 1971.

3% of “critical” software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?

Time to bring back the engineers, and retire the prophets.

SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios. The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said. Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior. Read my latest for Axios here: axios.com/2026/10/22/ai-agen…

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.