Jordan

Always curious | open politics advocate | The Office trivia world champion | product security @GitHub | views are my own

[Igor Kozlov @iekozlov]

More CVEs ≠ proportionally more exploitation. Published vulnerabilities are surging, but KEV and zero-day KEV counts haven’t grown since 2024.

The "vulnpocalypse" has yet to materialize.

https://t.co/OCDKfbkKkJ

[Sean Heelan @seanhn]

https://t.co/gOtQb9QmuU

"At present, it appears that highly-automated, LLM-
based remediation pipelines are more likely to change application behavior, introduce new vulnerabilities, or mask existing ones, than fix known vulnerabilities."

[Jordan @dirtydata_]

Just in time for hacker summer camp

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, compromising hospitality-related networks worldwide to steal credentials, access cloud environments, and deliver malware to travelers. https://t.co/bnizYidwOk

Since early May 2026, the threat actor has conducted widespread but targeted traffic manipulation attacks involving networks served by captive portals. In some cases, users were redirected through actor-controlled phishing infrastructure, while other activity led to the delivery of malware on impacted systems.

Microsoft assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard and details the malware, tradecraft, and cloud-focused techniques used throughout the campaign, including device code phishing and credential theft activity targeting travelers.

Get detections, mitigation, and hunting guidance from this Microsoft Threat Intelligence blog post.

[Dino A. Dai Zovi @dinodaizovi]

Content Management Systems are usually riddled with vulnerabilities. The proactive architectural security approach long ago was moving to static site generators instead of trying to defend highly insecure gobs of PHP. Leverage is always more effective than brute force approaches.

[Wholesome Games @_wholesomegames]

Rolling Hills, the little sushi restaurant life-sim I made with my brother, is out today on PC, Xbox, and Game Pass!

Make new friends, purchase ingredients, decorate your shop, and improve the lives of your neighbors as you perfect your craft 🍣

[Dino A. Dai Zovi @dinodaizovi]

Promising to improve security is like promising to increase profit: easier said than done. The real test is whether you can do it without destroying growth over the medium and long-term.

[Wholesome Games @_wholesomegames]

Serve up sushi as a robot chef in Rolling Hills, a life sim about running your own restaurant in a cozy village! Make new friends, discover peculiar recipes, and decorate your shop.

Coming to Steam, Xbox, and Game Pass on June 4th

[Dino A. Dai Zovi @dinodaizovi]

I can't underline this enough:

"Simple is not a sign of a lack of sophistication - it’s the hallmark of sophistication."

[Quinn Slack @sqs]

I'm looking for a smart COBOL engineer who can help us make @SourcegraphCody better for modernizing COBOL codebases. For (paid) advice and/or full-time employment.

If you can refer somebody that we end up working with, I will pay you $500 in 1959 dollars.

(Not April Fools'.)

[Jordan @dirtydata_]

@malwareunicorn ☹️

[Dino A. Dai Zovi @dinodaizovi]

It’s not always clear how your org charts affect your company’s security posture, but here is an example. If your outcome-oriented teams don’t work through platform teams, you’ll get a proliferation of highly privileged systems and accounts for all of their purposes in your envs.

[Wholesome Games @_wholesomegames]

Introducing our first-ever @Humble Bundle... Uplifting Adventures: A Wholesome Games Bundle! Pay what you want for a variety of wholesome favorites that will benefit Save the Children, an organization delivering lifesaving aid in Gaza.

https://t.co/Fg6Iq3MYu1

[Jordan @dirtydata_]

@dinodaizovi This does not make sense.

[Quinn Slack @sqs]

All of @salesforce is doing incredible stuff with AI. Shipped CodeGen (open-source code LLM) more than a year ago + much more. Incredible foresight and super fast pace internally. Very impressed.

Also @Benioff wins the award for best resume:

[Sourcegraph @Sourcegraph]

To celebrate today’s @SourcegraphCody update, we are giving away a Cody customed WASD V3 87-Key Custom Mechanical Keyboard with Cherry MX Blue keyswitches.

To enter all you need to do is:
👍Like & Retweet this tweet
⬇️ Download the Cody App

[Jordan @dirtydata_]

Automatic Incompetence

[Sourcegraph @Sourcegraph]

(Wrong answers only)

What does AI stand for?

[Pete Cheslock @petecheslock]

Kubernetes has single handed set our industry back a decade.

Companies are going to die because they spend more time “managing Kubernetes” than building a product.

[Ben @b3nm4nn]

AI startups choosing a vector database... 🫠

[Jordan @dirtydata_]

@FrankMcG Partnering with engineering teams, I’ve found great use of https://t.co/R2n7xKyKpq. Super helpful to have the diagram next to the system it represents and I’m seeing diagrams be maintained after the initial partnership exercise. Not the best looking, but a great overall win.