TKMatima.com

Hacker | @Microsoft Top 100 Security Researcher of 2018 (Dmitri Kaslov) | | niche internet micro-celebrity

[TKMatima.com @TKMatima]

Months ago I was asked to contribute a chapter in this book

my daughter was just a few days old and i was also learning Swift/SwiftUI and developing a mobile app

But still managed to pull this off.

Glad it’s finally published

🎉

[TKMatima.com @TKMatima]

Nice

[Xavier Rivera @XavierRiveraX]

Google Chrome is rolling out device-bound session credentials to all users. Session cookies get cryptographically tied to your device, so stolen cookies can't be replayed from a different machine. Attackers who exfiltrate your cookie database get nothing usable.

[TKMatima.com @TKMatima]

Anywhoo, with what is happening these days, i can't even imagine what fresh hell 2030's will bring and how security will change - for better or for worse

[TKMatima.com @TKMatima]

I started seriously thinking of "leaving" pentesting around 2015-ish during my @sensepost days when Dane Goodwin released AutoDane https://t.co/kudi3I4LW5

i used on an assessment 🤯

AI wasn't what it is now, but AutoDane made me think - alot.

Amazing to see where we are now

[Doyensec @Doyensec]

Just released🚨#doyensec's latest whitepaper is a head-to-head comparison of the @AikidoSecurity & @XBOW #AI-powered penetration testing platforms.

https://t.co/p3XVIxHKWq

Read how each automates #security testing, their detection capabilities, workflows & usability.

[TKMatima.com @TKMatima]

I thought pentesting was a solved thing - or atleast AutoDane made think it was, and only a matter of time.

plus pwning wasn't fun anymore.

so 2016-ish that's when i pivoted to vuln research to pop 0days & make $$$

2016 CyberGrandChallenge was another "ohmygod" moment (for me)

[TKMatima.com @TKMatima]

Or atleast didn’t end with the OAuth notification or the google docs from 2025 tweets i’ve seen from @yubrew and @nicksdjohnson

same thing, different variant

[TKMatima.com @TKMatima]

Looks like @Google’s trust-boundary phishing facilitation is still live and well since 2025

https://t.co/mzM6xjyRmC
@AdaptiveSec

Got my first one using the Recovery Contact Request tactic and I dug into it

Now I’m monitoring the attackers silly email inbox 📥 😆

[TKMatima.com @TKMatima]

Another 0day lives to fight another day
🙏

[Qrious Secure @qriousec]

Despite 271 bugs massacred by Anthropic, our renderer rce and sbx escape alive and well ready unless there is sudden patch before p2o ( mean we dont have enough time for prepare new one ) - wish us luck!

https://t.co/3oTRESGt5r

[TKMatima.com @TKMatima]

ooopsie

[Bloomberg @business]

Anthropic's Mythos has been accessed by a small group of unauthorized users, raising questions about control of the AI model https://t.co/lXNLHlE1b3

[TKMatima.com @TKMatima]

wrote a small blog post to expound my thoughts, rightly or wrongly, about this tweet:

The Mythos Shift: What Actually Changes for Defenders

https://t.co/u2KbLMSf2U

[TKMatima.com @TKMatima]

The “mythos” shift:

-your “insider threat” is now also an AI agent
-all your threat models should assume 0day/access (truthfully for the past 5 years that should have been the case anyway)
-focus on detection and containment
-everything else stays the same i.e. do basics

[TKMatima.com @TKMatima]

The “mythos” shift:

-your “insider threat” is now also an AI agent
-all your threat models should assume 0day/access (truthfully for the past 5 years that should have been the case anyway)
-focus on detection and containment
-everything else stays the same i.e. do basics

[TKMatima.com @TKMatima]

been off them security X streets for about 2 years
(i still work in security tho)

dave aitel is now at OpenAI (??!)
Mr dan is pushing an autonomous security research framework
supply chains are doing teh things

god knows what else gwan.

need to catch up

[TKMatima.com @TKMatima]

Anthropic saying they know (but won't disclose) that malware authors were using their code for dev.....

makes more of a case for using self-hosted open source models - and those are punching above their closed-source counterparts anyway and you get criminal mind opsec

[TKMatima.com @TKMatima]

After nearly 2 years, I've started writing again :

https://t.co/IqwKi21Lk6

[TKMatima.com @TKMatima]

Humanity now stands a chance of being a multi-planetary species thanks to @elonmusk (despite the hate he always gets)

Moon and Mars 🚀🚀🚀

[TKMatima.com @TKMatima]

Those “We care about your privacy “ cookie pop ups should be renamed to:

“We don’t care about user experience “

[Wiz @wiz_io]

🚨 Breaking: Wiz Research discovered CVE-2024-0132 in @nvidia Container Toolkit and NVIDIA GPU Operator exposing #AI workloads to container escape attacks that give attackers control over the host system.🚨
https://t.co/sH1DVaa03u

[TKMatima.com @TKMatima]

@dcuthbert Oh, so it's not just my family that's been ravished by a nursery virus courtesy of my 1 year old over the past week??

i feel better knowing i'm not alone

[TKMatima.com @TKMatima]

Well, thats if the U.S doesn’t lead us to World War 3 with Russia before then 🤷🏾🙏🏾

[TKMatima.com @TKMatima]

Are you worried yet?

If not, you aren’t thinking enough about this impact, not just on our tech jobs, but the world in general.

And most governments aren’t even ready/able to help with the upcoming mass loss and/or transition of jobs

Humanoid robots are also 3 years out tops

[TKMatima.com @TKMatima]

Post the transition period, it will be joyful and prosperous, etc, etc due to AI.

Im more concerned between now and that transition period 😫😩😩