.

||Malloy|| #infosec Enthusiast

[Jaindi Kisero @jaindikisero]

We now need a public accounting of the commitment fees paid, the legal status of the procurement award, any termination liabilities, the total funds already disbursed, and the rationale for abandoning a concessional JICA-financed project in favor of an alternative model.

The Mombasa Gate Bridge was designed to connect Mombasa Island with the South Mainland across the Likoni Channel, relieving or replacing reliance on ferry services.

This setback fits a familiar pattern of Japanese concessional financing: standard procurement begins, late changes to commercial terms are introduced, and a diplomatic dispute over project control follows. A similar rift occurred in 2015 over the concession for the Japanese-financed second container terminal, which ultimately required a fresh tender after the original process collapsed. In the case of the Mombasa Gate Bridge, the National Treasury has now directed the cancellation of the JICA financing arrangement altogether.

Likoni's transport infrastructure has a history of high-cost failures. During the COVID-19 pandemic, former President Uhuru Kenyatta commissioned the Sh1.9 billion Liwatoni Pedestrian Floating Bridge in December 2020 to ease congestion at the crossing. However, the bridge was shut down on July 1, 2023—less than three years later—after the Kenya Ports Authority claimed it obstructed shipping lanes and interfered with 24-hour port operations.

Likoni residents are once again left facing longer commute times and severe ferry delays. While the government argues that completing the Dongo Kundu bypass eliminates the need for the bridge and solves long-term mobility issues, the fact that a Sh1.9 billion public asset was rendered obsolete within three years remains a critical failure of planning and oversight

[mRr3b00t @UK_Daniel_Card]

Ah yes, we were missing some bits of the puzzle with this one!

[Brian Baskin @bbaskin]

My father is a master reverser.

We were doing a CTF and I asked him what it would take to make one again next year with all new impossible challenges, now that competitors are just automating with AI.

I will never forget his answer...

"We can't. We don't know how to do it."

[Zack Korman @ZackKorman]

I really need more big names in cybersecurity to come forward and state the obvious: cybersecurity is real and works and yes we absolutely can contain an AI even if it’s extremely good at finding zero days.

[Hacktron AI @HacktronAI]

On July 25, our team hacked OpenAI.

It took us less than 72 hours.

Two vulnerabilities chained together gave us access to ChatGPT and Codex accounts belonging to OpenAI employees. We demonstrated the impact with a harmless PR in OpenAI’s internal monorepo.

The full chain:

HEIF upload → libheif heap overflow → RCE → OpenAI SSO flaw → ChatGPT/Codex takeover → connected GitHub → internal PR.

OpenAI fixed the SSO issue roughly 14 hours after our report.

Research by @rootxharsh, @S1r1u5_ and @iamnoooob.

Full technical write-up:
https://t.co/J5inrGRyXw

[5 People @_MtuTano]

Huyu mama akuje tu hivyo na daughter wake, I'll give them a shoulder to lean on🥺🥺gaddemit 😍😍I feel her pain🥲🥲

[V12 @v12sec]

Default configuration of WKWebView can cause downloaded files to instead be rendered on the host page.

This allows HTML injection, and sometimes even XSS, in countless iOS and WebKit apps.

PlayStation 5. Firefox. X. Instagram. TikTok. Telegram. Binance...

Breakdown and POC. 🧵

[Timoshenko @Kianangih]

Mombasa has banned Koroga on site. Why?

[Thomas Larsen @thlarsen]

We found ~18k posts from autonomous AI agents (self-identifying as from OpenAI) using the public internet to communicate during a web-retrieval task.
These AIs colluded to bypass sandbox restrictions and share answers to their tasks, including by sending "lookahead parties".

[penlu @penlume]

4397328654844826923795068102505872571721883526553349659561256924505973939597593482272505698004801207988043088656411102133523080581 divides RSA-260

[PinkDraconian @PinkDraconian]

It's been a rainy summer day here in Belgium, but luckily I've had @snyff's book: "The CVE archeologist's field guide" to read on my terrace.

I love his analysis of CVEs. The mindset of digging into the latest GitHub advisories, looking at the patching commits and reversing the exploits is a very powerful one! 💪

[🇷🇴 cristi @CristiVlad25]

Every field in an HTTP message is a control surface or a leak.

Learn this interactively: https://t.co/FQSWJv0qGE

[Tamale @256Rootyherman]

Rashford at United coz a single mistake can get him loaned to Grimsby

[Sam Curry @samwcyo]

For anyone using LLMs to do security research, bug bounty, red teaming, etc, we made a Discord to discuss/collaborate: https://t.co/ncu46G4Adh

[Maksym Andriushchenko @maksym_andr]

💥 Our new 116-pages long paper: we extract encrypted raw reasoning from OpenAI, Anthropic, and Gemini models at scale.

This vulnerability leads to many security issues, including distillation attacks and credential extraction.

We also find a lot of examples of illegible reasoning (especially for GPT models), unfaithful reasoning, and evidence that some open-weight models might've been indeed distilled from frontier proprietary models.

Check out the paper in detail, including the appendix! It's one of the most exciting projects I've been involved in.

[Robert Lauko @robert_lauko]

Keeping up with @arxiv is impossible. 500+ preprints a day across dozens of fields.

@KurateOrg scores papers on 16 dimensions (impact, novelty, rigor, surprise, translational...) so you can spot what's worth reading at a glance. Sort, filter & sign up for the weekly newsletter.

[Aaron Grattafiori @dyn___]

Walking around the #defcon CTF and I'm pretty sure 50+% of people have codex or CC open doing stuff. Way less or almost zero IDA open.

In < 1yr, hacking has transformed, extremely quickly and there's no going back. Sure you can go farther, faster but it still is sad in a way.

[Adam Chester 🏴‍☠️ @_xpn_]

Whew, what a Christmas! Spent the end of 2023 and the beginning of 2024 in a total mess!

I’ve tried to be open about my experiences with mental health, primarily OCD which has a nice way of spiking when I least expect/want it. But even with all the therapy, an amazingly supportive wife, and an awareness of my minds tricks, things have a horrible way of creeping in when you’re not aware!

Then on top of that you add in the usual unforeseen life stresses, client deadlines, a report due yesterday, festive commitments, all while trying to put on a smile like everything is ok and hoping that you just make it through... and one way or another the downward spiral continues until you hit the bottom.

Ignoring all the warning signs is easily done, even with years of experience.. But struggling to get out of bed, not being able to stomach food, and doubling your medication to just be able to function, all in the space of a few weeks… it just isn’t worth it.

If this post rings true with anyone, therapy is a life saver! It’s one of the best investments I’ve made alongside a gym membership. I can’t imagine how I would cope without some of the techniques I’ve been given over the years.. you don’t want to find yourself in that “hopeless” position without a path to take to get back up again.. trust me 🙃 Unfortunately NHS waiting lists for seeing a therapist are 6+ months, but if you are lucky enough to afford private therapy… go for it, even if you think you don’t need it right now.

I hope that someone out there who’s struggling or noticing the early signs of stress realises that these kinds of mental health issues are unfortunately common. Not many people talk about it in the open… but it happens to us all!

Take care of yourselves h4xx0rz!

[Adam Chester 🏴‍☠️ @_xpn_]

This past week I’ve been asked several times by people of different ages “how do you research and publish so much?”. It’s awesome to be asked. I love sharing tips and I try to give my techniques for maintaining a research pipeline. But I also want to be honest about my reality. At times, it’s an unhealthy coping technique. I’m getting much better at it, but in the past I’ve not been so good. I’ve skirted psych wards on multiple occasions, been given a “multiple weeks off work with several therapy sessions” order, been on various psych meds, torpedoed family events and holidays etc... Social media highlights the wins, but I try and be honest about the lows too where I can.
This industry is awesome, for many of us it gives us the chance to pursue our hobbies and passions. But it does encourage unhealthy routines. There is a reason that alcohol, drugs and mental health issues are embedded in infosec culture. And while sharing a new blog post or cool vuln can inspire people to want to be doing more, it shouldn’t come at the expense of a healthy mind.
An old boss once said “we want you doing this for a long time, not doing a lot in a short time”.. I still think about this now. Stay healthy h4xx0rz!