uosןıW qoɔɐJ

MBA graduate @umich, Alumni @michigantech #CyberSecurity #ApplicationSecurity #Compliance #AI #Embedded #IoT #Opensource

[uosןıW qoɔɐJ @JacobDjWilson]

Oof

[Cyber Security News @The_Cyber_News]

🐞 Nessus Agent Vulnerability on Windows Enables Arbitrary Code Execution

Source: https://t.co/6gnqn918jC

A newly disclosed security vulnerability in Tenable's Nessus Agent for Windows could allow attackers to execute malicious code with the highest level of system privileges, raising serious concerns for enterprise security teams relying on the widely-deployed vulnerability assessment platform.

The flaw enables a threat actor to create a Windows junction, a type of filesystem symbolic link that can be leveraged to delete arbitrary files with SYSTEM-level privileges.

Once file deletion at that privilege tier is achieved, the condition can cascade into a full arbitrary code execution scenario, effectively granting an attacker complete control over the affected machine.

#cybersecuritynews

[Heather Adkins - Ꜻ - Spes consilium non est @argvee]

An update from NIST. Due to volume they’re only going to enrich CVEs that are meaningful to USG federal systems and critical software (some more nuance in the blog post). This means if you’re relying on the NVD data for your enterprise security program and use other software, your tools may not flag software you use as at risk. https://t.co/pI2o2XootK

[John Gargiulo @JohnnotJon]

If you still have doubts about Claude Mythos, here's what it did already:

> Found a 27-year-old OpenBSD bug in one of the most security-hardened operating systems on earth for <$50

> Broke into a production virtual machine monitor (basically the tech that keeps cloud workloads from seeing each other's data)

> Turned Firefox vulnerabilities into working exploits 181 times

> Found a 16-year-old FFmpeg bug that survived every fuzzer, every code audit, and every human reviewer since 2010

> Wrote a FreeBSD exploit that gives any unauthenticated attacker on the internet full root access. No human was involved after the first prompt.

> Chained 4 separate vulnerabilities together to build a browser exploit that escaped both the renderer and the OS sandbox

> Found critical holes in every major web browser and every major operating system

> Gave Anthropic engineers with zero security training a complete and working exploit by morning

> Cracked cryptography libraries protecting TLS, AES-GCM, and SSH

[uosןıW qoɔɐJ @JacobDjWilson]

An excellent deep dive on AI milestones in comparison with work force planning.

[Anish Moonka @anishmoonka]

Amazon had four Sev-1 outages (their highest severity level) in a single week. Internal memos say AI-assisted code changes were a contributing factor.

The timeline here is wild. In October 2025, Amazon laid off 14,000 corporate employees. In January 2026, another 16,000. That’s about 30,000 people in five months, roughly 10% of the corporate workforce. CEO Andy Jassy said the cuts were about culture, not AI.

During those same months, Amazon set a target: 80% of developers using AI coding tools at least once a week. They tracked adoption closely and blocked rival tools like OpenAI’s Codex. Even so, 30% of developers still hadn’t touched Amazon’s in-house tool Kiro by January.

In December 2025, Kiro caused a 13-hour AWS outage. The AI tool had production-level permissions and decided the best fix for a bug was to delete and recreate an entire live environment. A second incident involved Amazon Q Developer, another AI tool. Amazon blamed both on “user error, not AI.” But quietly added mandatory peer review for all production access afterward.

Then March 5: Amazon’s retail site went down for about six hours. Over 22,000 users reported checkout failures, missing prices, and app crashes. Amazon called it a “software code deployment” error.

Five days later, SVP Dave Treadwell made the normally optional weekly engineering meeting mandatory. His memo acknowledged “GenAI tools supplementing or accelerating production change instructions, leading to unsafe practices.” These problems trace back to Q3 2025. Amazon’s own assessment: their GenAI safeguards “are not yet fully established.”

The new rule: junior and mid-level engineers now need senior sign-off on any AI-assisted production changes. Treadwell also announced “controlled friction” for the most critical parts of the retail experience.

For context, Google’s 2025 DORA report found 90% of developers use AI for coding but only 24% trust it “a lot.” An Uplevel study of 800 developers found Copilot users introduced 41% more bugs with no improvement in output. Amazon is finding out what those numbers look like at the scale of a $500 Billion revenue company, with 30,000 fewer people on staff to catch the mistakes.

[uosןıW qoɔɐJ @JacobDjWilson]

Hey @GeminiApp throttling back flash 2.0 API queries with meaningless "free tier limit" error messages is not cool

[uosןıW qoɔɐJ @JacobDjWilson]

@it4sec @NytroRST “That's the kind of combination an idiot would put on his luggage!”

[uosןıW qoɔɐJ @JacobDjWilson]

@tillerx_ @cameron @tyler ¡Olé!

[uosןıW qoɔɐJ @JacobDjWilson]

@censysio I've noticed that your State of Software Security 2025 report is no longer available in PDF for download. Would you like to share a copy for the Awesome Annual Security Reports GitHub repository? https://t.co/UHeFHo32J6

[uosןıW qoɔɐJ @JacobDjWilson]

@SophosSupport I've noticed that the Sophos Annual Threat Report 2025 is not available in PDF. Would you like to provide a copy for the Awesome Annual Reports GitHub repository? https://t.co/UHeFHo32J6

[uosןıW qoɔɐJ @JacobDjWilson]

@USTelecom @code_armor @Mend_io (cont.)
• @Sophos State of Cloud Security Report
• @Fortinet Global Ransomware Report
• @snyksec AI Generated Code Security Report

[uosןıW qoɔɐJ @JacobDjWilson]

We’ve updated the Awesome Annual Security Reports README to only list the latest and greatest reports for 2024 &amp; 2025.
https://t.co/HkYhgUMZNL

#infosec #cybersecurity #appsec #supplychainsecurity #cloudsecurity #ransomware

[uosןıW qoɔɐJ @JacobDjWilson]

These outdated 2023 reports were removed from the README (but still live in their directories):
• @USTelecom Cybersecurity Culture Report
• @code_armor State of Application Security
• @Mend_io State of Supply Chain Threats

[Heather Adkins - Ꜻ - Spes consilium non est @argvee]

Some excellent work by @CraigGidney that reduces the number of qubits (in a quantum computer) required to break RSA by 20-fold.

[Gemini @Gemini]

One month ago, we launched a global campaign for crypto titled Go Where Dollars Won’t

Watch some BTS of launch day in NYC 🗽🍎

[Gemini @Gemini]

Come celebrate 100k bitcoin! 🟧🚀

[Michigan Football @UMichFootball]

42-27
45-23
30-24
13-10
-- --
130-84

4 years later...

[uosןıW qoɔɐJ @JacobDjWilson]

New report added! 🚨 Check out the Global Email Security Market Report (2024) by Proofpoint, featuring insights on top vendors, growth opportunities, and email threat trends. 📩🔒

Explore it now on Awesome Annual Security Reports!
https://t.co/HkYhgUMZNL

[Awesome @awesome__re]

Awesome Annual Security Reports

Exploring cybersecurity trends, insights, and challenges.

https://t.co/oQ4gYhKbSP

[uosןıW qoɔɐJ @JacobDjWilson]

Big news for Awesome Annual Security Reports! 🚀 The first 2025 report is live: Google’s Cybersecurity Forecast 2025! 🎯 Insightful trends from top Google Cloud leaders.
https://t.co/HkYhgUMZNL