Adam Engle

[a16z @a16z]

Cyber is having a moment

Across 21 major software companies, including Apple, AWS, Microsoft, and Google:

- Reported critical vulnerabilities never cleared 100 per month in four years
- Since spring they've jumped to over 600 per month

Charts of the Week: https://t.co/4dgNGwG5Nx

[SwiftOnSecurity @SwiftOnSecurity]

Time for my E5 refill

[Troy Hunt @troyhunt]

Getting spam to a bunch of open source @github repositories that's trying this on:

[John Hammond @_JohnHammond]

cc @github @GitHubSecurity this mass issue creation campaign looks to be actively ongoing as of a few minutes ago. flood of new bot accounts. site leads to copy-paste CAPTCHA scam, looks like a mix of the original lummastealer lure and my poc (so, uh, sorry)

[Rachel Tobac @RachelTobac]

LinkedIn is now using everyone's content to train their AI tool -- they just auto opted everyone in.
I recommend opting out now (AND that orgs put an end to auto opt-in, it's not cool)
Opt out steps: Settings and Privacy > Data Privacy > Data for Generative AI Improvement (OFF)

[Adam Engle @Adam_Engle]

@RachelTobac Not cool. Thanks for raising awareness.

[Adam Engle @Adam_Engle]

@davepl1968 @davepl1968 : Fantastic explanation. Thank you for this.

[RedTeamVillage @RedTeamVillage_]

We're excited to show off our limited edition RTV coin for #DEFCON 31. Want to get your hands on one? Let's have a contest to name this year's mascot. Like, rt, and comment with your submission, we'll pick a winner next week. #RTV @defcon #dystopian #fallout #powerarmor

[Adam Engle @Adam_Engle]

@UK_Daniel_Card I like what you are doing with this and think it is a pretty good initial list.

For what it's worth, I would add WAF and DDoS protection as capabilities.

Probably more important--a centralized inventory of assets. (It's hard to protect what you don't know you have.)

[Alex @_alexandrius]

TIL you can de-obfuscate code with ChatGPT
#chatgpt #ai

[Accidental CISO @AccidentalCISO]

Warning: Risk model not to scale.

[vx-underground @vxunderground]

Leaked documents online show the purchase (and documentation of) an $8,000,000 iOS Remote Code Execution 0day exploit

[Tlacachihuani @Saadev]

@ZephrFish There is always something to learn.

[Jim Manico from Manicode Security @manicode]

The issue with vuln scanners from @LunaSecIO https://t.co/8WBGwD9WF2

[SwiftOnSecurity @SwiftOnSecurity]

I was on a conf call and someone mentioned having to share password for some process. Someone else joked don't let Security (me) hear that. It was lighthearted, but I emphasized sharing passwords is a system design problem, we can't just say don't do it and not fix the root cause

[Mick Douglas 🇺🇦🌻 @bettersafetynet]

VLANs are not network firewalls.

They do help organize traffic, but they (by themselves) are not security boundaries.

[starbuck3000 @starbuck3000]

@manicode 100% agree. The CIS already ranks "inventory" as #1 requirement for years. Knowing which systems are vulnerable/exposed should be at least in the top 3 in my opinion.
I still think that filtering known attacks should come first but I am open to debate :).