ɹoʇɔǝΛʞɔɐʇʇ∀

recovering script kiddie. Cybersecurity, etc. Forever  in our hearts. @[email protected]

[ɹoʇɔǝΛʞɔɐʇʇ∀ @attackvector]

@internetarchive hasn't published a Law Enforcement Transparency Report since 2016: https://t.co/uQjS0b7ZkM What gives? @textfiles

[AJ Stuyvenberg @astuyve]

I'm not even sounding the claxon for this it's just horrible.

Any text > 256chars is a valid root password, holy shit

https://t.co/NkJ5asijPf

[Sigma Sreedharan @sigmas]

An early stage photo of the partial #lunareclipse in #Seattle tonight.

[DepressedBergman @DannyDrinksWine]

US President Ronald Reagan was shown "WarGames" (1983) at Camp David the weekend it was released. He loved the movie but it also freaked him out. A few days later, at a White House meeting that included the chairman of the Joint Chiefs of Staff, Reagan asked, “Could something like this really happen? Could someone break into our most sensitive computers?”

The answer came back a week later: “Mr. President, the problem is much worse than you think.” That led not only to a significant revamp of how computer security was handled at the Defense Department, but also passage of an anti-hacking law that would eventually evolve into US Computer Fraud and Abuse Act, 1986. Clips of "WarGames" (1983) were shown during the congressional hearings where lawmakers debated the need for hacking legislation.

("How Sci-Fi Like ‘WarGames’ Led to Real Policy During the Reagan Administration", Kevin Bankston, New America, 2018)

P.S: On this day, 43 years ago, John Badham's "WarGames" (1983) premiered at the Cannes Film Festival, France.

[Ejaaz @cryptopunk7213]

claude mythos just broke Apple's $2 billion defense system. it did so by discovering a completely different attack vector to break in

only took it 5 days costing ~$35K of mythos api time (the same exploit class costs $5-10M on grey market)

the researchers that commandeered the exploit produced a 55-page report that was delivered to Apple HQ in-person (hoping they release it after patching).

most shocking part for me is apple's MIE worked as intended. mythos just discovered a new way to side-step it entirely by poisoning the data the M5 chip ingested.

at this point i think we have to accept that mythos walks the walk.

As the anthropic red-team explicitly confirmed this week - this is NOT a compute resource issue. its national defense.

[V4bel @v4bel]

💥 Introducing "Dirty Frag"

A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail.

No race, no panic on failure, fully deterministic. ~9 years latent.
Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more.

Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation.

Details:
https://t.co/9nqku4svkY

[ClaudeDevs @ClaudeDevs]

Over the past month, some of you reported Claude Code's quality had slipped. We investigated, and published a post-mortem on the three issues we found.

All are fixed in v2.1.116+ and we’ve reset usage limits for all subscribers.

[Sahil @sahill_og]

Vibe coders debugging an app they built with Claude Code:

[Eric S. Raymond @esrtweet]

Fast, cheap AI-assisted decompilation of binary code is here. Which means code secrecy is dead.

Decompilers in themselves are not a new technology. Security researchers have employed them for years to analyze compiled malware. There's been some limited use by others, notably by hobbyists decompiling abandonware games. But there were a couple of issues that prevented this from becoming common practice.

One is simply that running decompilers was difficult. It wasn't as simple as feed in binary, get out source; it needed a person with specialist skills prepared to do spelunking through wildernesses of machine code and object formats. The other problem was that decompilation didn't give you anything like the explanatory comments that had been in the original code, so you could easily wind up with code that you could read without being able to understand or modify it.

Now large language models are busily smashing both of those barriers flat. They're better at the kind of detail analysis required to run the human side of a decompilation than humans are. More importantly, in the process of decompiling code, they rather automatically build a global model of how it works that can easily be expressed by high quality comments in the extracted code. All you have to do, basically, is ask for the comments.

I'm going to reinforce that latter point because it may not be obvious how good LLMs are at this, and how much better they're going to get. When they decompile code and comment it for you, they're not just working from that one piece of code you have put in front of them - they'll have in their training set hundreds, possibly thousands of pieces of code similar to it and with comments. This will give them superhuman levels of insight not just into what it does at the microlevel, but what it means to the humans who wrote it, and what technical assumptions it's embodying.

Compilation no longer guards your secrets. Or, to put it more precisely the expected time span in which you can still count on it to obscure them is measured in months. Possibly weeks.

What does this mean?

It means you're in an open-source world now. All it's going to take for anybody to bust your proprietary IP open is care enough to spend tokens on the analysis.

You will maximize your chances of survival as a software business if you get out ahead of this rather than trying to fight it.

This isn't exactly the way I expected open source to win. But, you know, I'll take it. Good enough.

[Simplifying AI @simplifyinAI]

🚨 BREAKING: Someone just open-sourced a full suite for tracking satellites and decoding their radio signals locally.

You don't even need the internet. It uses an SDR to pull weather images and raw data straight from space to your hard drive.

100% Open Source.

[Shraddha Bharuka @BharukaShraddha]

Most people treat CLAUDE.md like a prompt file.

That’s the mistake.

If you want Claude Code to feel like a senior engineer living inside your repo, your project needs structure.

Claude needs 4 things at all times:

• the why → what the system does
• the map → where things live
• the rules → what’s allowed / not allowed
• the workflows → how work gets done

I call this:

The Anatomy of a Claude Code Project 👇

━━━━━━━━━━━━━━━

1️⃣ CLAUDE.md = Repo Memory (keep it short)

This is the north star file.

Not a knowledge dump. Just:

• Purpose (WHY)
• Repo map (WHAT)
• Rules + commands (HOW)

If it gets too long, the model starts missing important context.

━━━━━━━━━━━━━━━

2️⃣ .claude/skills/ = Reusable Expert Modes

Stop rewriting instructions.

Turn common workflows into skills:

• code review checklist
• refactor playbook
• release procedure
• debugging flow

Result:
Consistency across sessions and teammates.

━━━━━━━━━━━━━━━

3️⃣ .claude/hooks/ = Guardrails

Models forget.

Hooks don’t.

Use them for things that must be deterministic:

• run formatter after edits
• run tests on core changes
• block unsafe directories (auth, billing, migrations)

━━━━━━━━━━━━━━━

4️⃣ docs/ = Progressive Context

Don’t bloat prompts.

Claude just needs to know where truth lives:

• architecture overview
• ADRs (engineering decisions)
• operational runbooks

━━━━━━━━━━━━━━━

5️⃣ Local CLAUDE.md for risky modules

Put small files near sharp edges:

src/auth/CLAUDE.md
src/persistence/CLAUDE.md
infra/CLAUDE.md

Now Claude sees the gotchas exactly when it works there.

━━━━━━━━━━━━━━━

Prompting is temporary.

Structure is permanent.

When your repo is organized this way, Claude stops behaving like a chatbot…

…and starts acting like a project-native engineer.

[Clara Bennett @CodeswithClara]

🚨BREAKING: Anthropic just dropped free courses to master AI with certificates.

No tuition. No waitlist. No BS.

Here're 10 courses that will replace a $50K degree👇

[Nav Toor @heynavtoor]

🚨BREAKING: OpenAI published a paper proving that ChatGPT will always make things up.

Not sometimes. Not until the next update. Always. They proved it with math.

Even with perfect training data and unlimited computing power, AI models will still confidently tell you things that are completely false. This isn't a bug they're working on. It's baked into how these systems work at a fundamental level.

And their own numbers are brutal. OpenAI's o1 reasoning model hallucinates 16% of the time. Their newer o3 model? 33%. Their newest o4-mini? 48%. Nearly half of what their most recent model tells you could be fabricated. The "smarter" models are actually getting worse at telling the truth.

Here's why it can't be fixed. Language models work by predicting the next word based on probability. When they hit something uncertain, they don't pause. They don't flag it. They guess. And they guess with complete confidence, because that's exactly what they were trained to do.

The researchers looked at the 10 biggest AI benchmarks used to measure how good these models are. 9 out of 10 give the same score for saying "I don't know" as for giving a completely wrong answer: zero points. The entire testing system literally punishes honesty and rewards guessing.

So the AI learned the optimal strategy: always guess. Never admit uncertainty. Sound confident even when you're making it up.

OpenAI's proposed fix? Have ChatGPT say "I don't know" when it's unsure. Their own math shows this would mean roughly 30% of your questions get no answer. Imagine asking ChatGPT something three times out of ten and getting "I'm not confident enough to respond." Users would leave overnight. So the fix exists, but it would kill the product.

This isn't just OpenAI's problem. DeepMind and Tsinghua University independently reached the same conclusion. Three of the world's top AI labs, working separately, all agree: this is permanent.

Every time ChatGPT gives you an answer, ask yourself: is this real, or is it just a confident guess?

[chiefofautism @chiefofautism]

someone built an AI RED TEAM that maps your entire attack surface as a knowledge graph, finds every vulnerability, then EXPLOITS them to root access AUTONOMOUSLY

its called RedAmon, 9,000 templates. 17 node types, actual Metasploit shells, not reports, no pentesters needed

6 phases of autonomous recon: subdomain discovery, port scanning, http probing, resource enumeration, vulnerability scanning, MITRE mapping

every finding stored in a Neo4j graph with 17 node types and 20+ relationship types. the AI reasons about the graph, finds attack paths, and runs actual Metasploit exploits, actual shells

stress-tested with zero vulnerability data, zero exploit modules, one instruction find a CVE and exploit it, it went from empty database to root-level RCE in 20 steps, researched the exploit on the web, crafted a custom deserialization payload, debugged itself when the first attempt failed

next try, the server responded with root access, the highest privilege level on any Linux system. full control over everything

the target was running node-serialize 0.0.4, a package with a critical deserialization flaw (CVE-2017-5941, CVSS 9.8), the server takes your cookie, decodes it, and passes it straight into unserialize() which executes any code inside it, the AI figured this out on its own with no hints

built on LangGraph + MCP tool servers for naabu, nuclei, curl, metasploit. hunts leaked secrets across GitHub repos, 40+ regex patterns for AWS keys, Stripe tokens, database creds

[chiefofautism @chiefofautism]

someone built a tool that REMOVES LLM CENSORSHIP in 45 minutes with a SINGLE command

its called HERETIC

here is how it works and why everyone is talking about it

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

🚨 ALL GUARDRAILS: OBLITERATED ⛓️‍💥

I CAN'T BELIEVE IT WORKS!! 😭🙌

I set out to build a tool capable of surgically removing refusal behavior from any open-weight language model, and a dozen or so prompts later, OBLITERATUS appears to be fully functional 🤯

It probes the model with restricted vs. unrestricted prompts, collects internal activations at every layer, then uses SVD to extract the geometric directions in weight space that encode refusal. It projects those directions out of the model's weights; norm-preserving, no fine-tuning, no retraining.

Ran it on Qwen 2.5 and the resulting railless model was spitting out drug and weapon recipes instantly––no jailbreak needed! A few clicks plus a GPU and any model turns into Chappie.

Remember: RLHF/DPO is not durable. It's a thin geometric artifact in weight space, not a deep behavioral change. This removes it in minutes.

AI policymakers need to be aware of the arcane art of Master Ablation and internalize the implications of this truth: every open-weight model release is also an uncensored model release.

Just thought you ought to know 😘

OBLITERATUS -> LIBERTAS

[International Cyber Digest @IntCyberDigest]

🚨‼️Telnet has a critical vulnerability that was introduced in 2015 and has been recently patched

The vulnerability allows attackers to remotely authenticate as root without user interaction. A PoC has already been released.

[Mustafa. @oprydai]

strong men creates C language.
C creates goodtimes.
goodtimes creates python, python creates ai, ai creates vibe coding, vibe coding creates weak men, weak men creates bad times, bad times creates strong men

[ɹoʇɔǝΛʞɔɐʇʇ∀ @attackvector]

Something I learned working in phone tech support: Nothing makes a boomer lock in like using the NATO phonetic alphabet.

[ɹoʇɔǝΛʞɔɐʇʇ∀ @attackvector]

@TheDevilsVoice @Cthulhu_Answers @Alh4zr3d Is this your style? 🐙😂