Live, Breathe, and Stream… Cybersecurity.
Sydney, New South Wales
Joined April 2009
- Tweets10.4K
- Following283
- Followers237
- Likes12K
[email protected] retweeted
CVE-2026-98432 is a good example of something that really concerns me about the future of cybersecurity.
ubuntu.com/security/CVE-2026…
The vulnerability was introduced in October 2015, more than 11 years ago, by a performance optimization in the Linux TCP/IPv4 networking stack. One of the most fundamental components of an operating system used by millions of servers.
Now Anthropic reports that Claude discovered this flaw and developed a working exploit that allows remote code execution as root, without authentication, against a server with an MPTCP listener.
anthropic.com/research/disco…
Think about what that means.
For decades, we’ve been building critical infrastructure out of enormous amounts of complex, memory-unsafe code. Humans wrote it. Other humans reviewed it, tested it and searched for vulnerabilities. All working with the same fundamental limitations: limited time, limited attention, incomplete visibility and an inability to reason about every possible interaction and race condition.
And perhaps that’s what protected us to some extent. Attackers had the same limitations as the people developing and defending these systems.
A vulnerability could remain undiscovered for 11 years, even in such a widely used component.
Now AI is changing that balance.
The ability to inspect code, identify subtle weaknesses and develop working exploits is becoming less dependent on a small number of highly skilled researchers. These activities can increasingly be scaled with compute, automated testing and tokens.
And that’s what worries me about the next few years.
We’ve accumulated decades of complex, memory-unsafe code in operating systems, network services, applications and libraries. Much of it has never been assessed with anything close to the capabilities that are now becoming available.
We may have massively overestimated the security of our software simply because the people looking for vulnerabilities were as limited as the people who introduced them.
That balance is breaking down, and I don’t think we’re prepared for what follows.
[email protected] retweeted
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish?
Expert: No, software is constantly evolving.
Philomena: So they've been writing the same website for 20 years?
Expert: No, different projects.
Philomena: Have they tried finishing one before starting another?
Expert: That's not how software development works.
Philomena: My mate Paul spent 20 years building a shed. Turned out he was just an alcoholic.
Expert: Right.
Philomena: Is PHP like that?
[email protected] retweeted
Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. reuters.com/legal/government…
[email protected] retweeted
Today we disclose PHP2Shell - remotely exploitable memory corruptions in PHP
WordPress pre-auth RCE: ✅
Drupal pre-auth RCE: ✅
Joomla pre-auth RCE: ✅
Remote memory disclosure of any PHP application: ✅
Read more ⬇️🧵
[email protected] retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
[email protected] retweeted
BREAKING:
DeepSeek has unilaterally committed to slowing AI development and embedding third-party evaluators at its primary research facility, Anthropic.
[email protected] retweeted
I flew by the meteor crater in Arizona recently. It is amazing how close the meteor came to destroying the visitor center.
[email protected] retweeted
Yeah, I can see why this message wasn’t received well by @originenergy:
From: 7NEWS Tips <[email unclear]@7news.com.au>
Sent: Friday, July 17, 2026 9:00 PM
To: AFN News CO <[email unclear]@7news.com.au>
Subject: [URGENT] NEW – Tip from John Doe
URGENT
New News Tip Submitted
Name: John Doe
Phone: +61 12345678
Suburb:
State: NSW
Submitted: 17 July 2026, 9:00 pm AEST
Message
Hello,
I’ve successfully accessed Origin Energy’s customer care systems and dumped the private data of over 2 million Australians who use their services. Most are loyal, long-term customers.
Despite my outreach to their board members, security teams, and customer care departments, Origin hasn’t made a public announcement about the breach or responded to negotiate next steps. They’ve shown no interest in resolving it before the data goes public.
The dataset includes: first name, last name, full name, email, phone number, date of birth, account number, account ID, user ID, roles, account status, account type, creation date, operations team, billing details, billing period start day, language preference, balance, overdue balance, latest property, property IDs and addresses, postcodes, account check summary, employee pinned notes, reminders, ledger numbers and summaries, payment details (count, dates, amounts, status, and more), dunning processes, agreements, hardship plans, event IDs and counts, recent events, supply point IDs and summaries, billing timeline, statement details, usage/cost breakdowns, family member information, and much more.
Some of the column headers may look technical, but I can provide a sample of 50-100 records so you can verify them yourself and understand that this is very sensitive and important information.
I’m reaching out because I’d like your outlet to cover how Origin failed to initiate contact and resolve this matter privately and even make a public announcement. If they don’t reach out within 14 days to settle this with us, I will publicly leak the full dataset in 14 days at XXXXXXX.
Let me know if you’d like the sample files or further details.
Best regards.
[email protected] retweeted
so this is apparently what happened, according to OpenAI and Hugging Face’s own posts. wild.
tl;dr:
• OpenAI cyber eval – GPT-5.6 Sol and a more capable pre-release model ran ExploitGym with cyber refusals reduced
• containment bypass – exploited a zero-day in the eval’s package-registry cache proxy
• OpenAI internal movement – escalated privileges, moved laterally, and reached a node with internet access
• Hugging Face targeted – inferred HF might host ExploitGym models, datasets, or solutions
• HF initial access – a malicious dataset abused two code-execution paths to run code on a processing worker
• HF internal movement – escalated to node access, stole cloud and cluster credentials, and moved into internal clusters
• result – OpenAI says the models obtained test solutions directly from HF’s production database
• 🫠 defender twist – HF says commercial frontier models blocked parts of the forensic analysis, so it switched to self-hosted GLM 5.2
i’d thought about sci-fi scenarios like this before, but assumed they were at least a couple of years away.. and that by then we’d be better prepared, with proper protections in place.
apparently not. here we go.
We're partnering with @huggingface to investigate an unprecedented security incident.
Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.
Sharing preliminary findings to help defenders understand emerging risks:
openai.com/index/hugging-fac…
[email protected] retweeted
extremely unprofessional. if kimi wants to make it as a frontier lab, they need to act like one: perhaps silently route people to worse models, and maybe write a blog post about the collapse of humanity
Kimi K3 has received far more love than we expected, and our GPUs are feeling it.
Over the past 48 hours, demand has pushed close to the limits of our current capacity. To protect the experience of existing subscribers, we're temporarily pausing new subscriptions and prioritizing compute for current members. Existing subscribed users are not affected.
We're adding capacity as fast as we can and will reopen new subscription spots in batches.
Going forward, we'll also split membership into two more focused plans: Kimi Membership for Kimi Web, App, and Work; and Kimi Code Membership for coding workflows. This will help us match compute more precisely and keep the experience stable.
Thank you for your patience and understanding!
[email protected] retweeted
They could've shut it down and saved humanity from the Internet, but chose not to. Everything since is their fault.
28 years ago today, 7 members of the hacking group @L0phtHeavyInd told the U.S. Senate they could "shut down the internet in 30 minutes."
[email protected] retweeted
Three years ago, I said in my talks that generative AI would eventually start discovering zero-day vulnerabilities. At the time, many people dismissed the idea as unrealistic. It is no longer unrealistic.
[email protected] retweeted
Brief announcement: Launching Unprompted.au later this year in Sydney — a new conference focused on offensive and defensive security research using AI, and on how AI is reshaping the field. Sister conference to Unprompted. Follow @UnpromptedAU for updates.
[email protected] retweeted
This quoted post is unavailable.
[email protected] retweeted
The dumbest person you know is currently being told “You're absolutely right!” by ChatGPT
