Kyle Vanderzanden

Father and Husband into Tech, History, Cloud, IOT, AI/ML, DevSecOps, InfoSec, Privacy, 🏈 🐬, UCI, Humor & selling Cycode AI native AppSec platform

[🦎Frostwing🏳️‍⚧️ @FrostwingGaming]

it’s genuinely terrifying how fast he was proven 100% right

[Anthropic @AnthropicAI]

New on our Frontier Red Team blog: using Claude to formally verify software at large scale.

Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).

With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.

Read our research in full here: https://t.co/zUyx8CjBEk

[TechCrunch @TechCrunch]

Warhound, the brain child of Ben Lamm and Palmer Luckey, emerges from stealth to genetically engineer dogs for military and law enforcement.
https://t.co/Por7hr92K2

[Matthew Prince 🌥 @eastdakota]

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

[Choblin @choblin29]

HOLY SHIT: This is huge. Amazon found a PHP2Shell exploit attempt on OCT 17, FOUR DAYS before the AI-discovered vulnerabilities were publicly disclosed.

It hit an AWS honeypot from an anonymized IP. Amazon says it doesn't know how the actor learned about the still-embargoed flaws.

Then Cloudflare watched the explosion:

>10 hours BEFORE disclosure: thousands of attempts
>45 minutes AFTER: tens of thousands
>2 hours AFTER: hundreds of thousands
>Later: MILLIONS

Researchers had spent two months coordinating fixes. Governments took websites offline.

And Censys found ~1.5 MILLION of 2.6 million identified PHP hosts running versions with NO PATCH available for those versions.

[Brandon Veiseh @BVeiseh]

Chief information security officer @ anthropic btw

[Md Ismail Šojal 🕷️ @0x0SojalSec]

WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.

Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.

Firmware was locked down, so zero-days it was.
Got a root shell.

then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.

This isn’t a bug, It’s the product bro.

[IT Guy @T3chFalcon]

getty images spent years watermarking every photo on the internet.

sued stability AI for training on their library. demanded the AI companies pay up. called it theft.

filed for chapter 11 bankruptcy this week.

the AI companies didn't pay. they just... kept going and designers stopped buying stock photos. and the $500 licensing fees stopped making sense when midjourney exists. and the debt piled up.

a company whose entire business model was "we own the visual record of human history, pay us" just got outrun by a model that learned from that record and started giving it away for free.

The irony is that the watermark is still on every image in the archive.

even the ones nobody's licensing anymore.

[The Hacker News @TheHackersNews]

🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.

CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.

Read - https://t.co/frrfCwYlgp

[CyberScoop @CyberScoopNews]

A cybersecurity incident at BAE Systems has halted the production and delivery of bankruptcy notices for every federal bankruptcy court in the United States, disrupting a core administrative function of the judiciary with no announced date for restoration.

The Bankruptcy Noticing Center, known as the BNC, produces and transmits notices in bankruptcy cases nationwide. BAE Systems, a defense contractor, operates the center’s systems and websites on behalf of the federal judiciary. In a statement published Thursday, the Administrative Office of the U.S. Courts said the incident affected BAE’s information technology and the websites supporting the center’s operations. https://t.co/r10dnX0U2S

[Jon Oberheide @jonoberheide]

You've gotta patch your dependencies super fast because they're full of vulns (PHP, Node, eMudhra, etc), but not _too_ fast because they're full of backdoors (LiteLLM). Good luck!

[@jason @Jason]

Let’s be candid: none of this is surprising, and much of what these agents are doing is unchecked/a black box — that needs to change.

Time for the industry to fortify security and privacy as their top priority

[Tren Griffin @trengriffin]

Just like you, Anthropic disclosed an $80.7 billion net loss for the first half of 2026.

Your risk factors are different though.https://t.co/IrXDAUdl4A

[Andrew Case @attrc]

Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:

https://t.co/hpdTOdvSsQ

[Kyle Vanderzanden @SCtoOC]

Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos https://t.co/ImC6gWnvZb

[Kyle Vanderzanden @SCtoOC]

Character .ai's Bankruptcy Documents Show the Economics of AI Don't Work

https://t.co/zlnZ2pshfp

[CrowdStrike @CrowdStrike]

A major step forward in disrupting North Korea’s illicit IT worker operations.

CrowdStrike is proud to have partnered with the FBI in identifying and disrupting U.S.-based laptop farms used by FAMOUS CHOLLIMA to infiltrate organizations, conceal operatives’ identities, and generate revenue for the regime.

Through threat intelligence and technical analysis, our Counter Adversary Operations team helped expose the infrastructure enabling these schemes.

This is the power of public-private collaboration in action. Together, we're raising the cost of adversary operations and turning intelligence into disruption.

Learn more about CrowdStrike's role: https://t.co/3aMrOd234w

[Jason Silva @JasonSilva]

BRILLIANT

[Toxic Cowboy 🤠 @toxiccowboy02]

One of the best I've seen so far 😜

[unusual_whales @unusual_whales]

11% of U.S. adults now take a GLP-1 for weight loss, roughly 28 million people, up from just 3% in 2024, per Gallup.