Halvar Flake✓

Rob Joyce @RGB_Lights

If you watch one talk this month, make it this one. Profoundly insightful on the complexity threat to security by @halvarflake given at NATOs CYCON. Video: And slides:

John Althouse @4A4133

Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.

Daniel Lemire @lemire

Jenny Qu @GuanniQu

Said someone should resurrect CTF. Turns out that someone was me. I'm running the [un]prompted AI CTF, Oct 27-29, The Hibernia SF + online. Some have no solution. We don't tell you which.

Guillermo Flor @guilleflorvs

Dario Amodei: some tokens Claude produces are worth a few cents, others could be worth tens of millions of dollars. His examples: 1. Telling someone to restart their Mac: the model has said it 10 million times, worth a dollar or less 2. Telling a pharma company to move an aromatic ring to the other end of a molecule: potentially tens of millions 3. Expect pay-for-results pricing, or labor-like pricing by the hour 4. It's a new industry, so many models will be tried Today pricing is simpler: per the S-1, usage-based pricing was 80% of H1 2026 revenue and subscriptions 20%. Full breakdown here:

Natalie Silvanovich @natashenka

LLMs are great at finding bugs, but so are fuzzers. @5aelo compared the vulnerabilities found in V8 by BigSleep, an agentic system, with those found by the Fuzzilli fuzzer.

Camilo Acosta @CamiloBAcosta

I was a founder and CEO for 12 years before my company was acquired by Meta. Overnight, I went from running my own company to being one of tens of thousands of employees. I remember getting my employee badge, walking around campus with my backpack, and feeling like a college kid on his first day of school. People kept telling me I landed a dream job. And for a lot of people, product at Meta really is the dream! But it was never mine. I didn't even know how to introduce myself anymore. Was I a founder? Former founder? Product manager at Meta aka just another one of Zuck's lackeys? I've seen plenty of exited founders go through something similar. They can make incredible amounts of money but once the excitement wears off they feel completely lost. Their core identity has been blown up. If you're thinking about selling your company, talk to a few founders who've already done it. They can prepare you for the transition in a way your investors and lawyers can't.

Daniel Cuthbert @dcuthbert

great to see the print version available for all. 40 years of @phrack and here's to so many more

Alisa Esage Шевченко @alisaesage

Raising public awareness on cybersecurity misogyny

Cohere @cohere

While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected. Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions. Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent. But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models? We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem. Read the full report:

Dino A. Dai Zovi @dinodaizovi

Fire doesn't know nor care what it burns. LLMs neither know nor care what they hack. The sooner that we think about containing them like fire, the better. We aren't shocked when a campfire performs a "misaligned action" by igniting the mess of flammable material all around it.

Coin Bureau @coinbureau

🚨Sam Altman says the internet can no longer be SECURED by patching bugs. "I no longer think we're going to be able to just patch all the bugs," the OpenAI CEO said, warning smarter models can find "hardware level insane stuff." He says OpenAI can't responsibly open source its best model "anytime soon," but the open source world isn't far behind: "Not super."

Dino A. Dai Zovi @dinodaizovi

LLMs are like a live, shorting electrical wire, they will emit random tokens that cause them to say random things and do random things when you hook tools up to them. LLMs words are an illusion, they are just numbers to the model. Electricity is powerful but we know how to contain it and generally avoid accidents by now. We should look at LLMs generating tokens the same way as we look at fire, electricity, nuclear chain reactions, etc.

Inference @inference_net

deepseek-v4.1-flash-1017-cyber is now available on @inference_net. This is the first of several highly capable cyber models we'll release over the coming weeks. We believe it is our duty as technologists to help people protect themselves and their digital properties from the current onslaught of cybercrime ravaging much of the world. As such, we’re serving our cyber models “at cost”, in US data centers only, with ZDR enabled by default. KYC required. Apply here

Carles Reina @Carles_Reina

88% of VC-backed founders who exited their companies got $0. Eduardo Azevedo and Kent Smetters analysed 157,669 startups and 248,454 founders from 1987 to 2025. Let that sink in...