evil comrade

Network Engineer, Security Enthusiast, Full-time noob, some know me as 王卫

[Aaron Grattafiori @dyn___]

This is an extremely interesting, and important graph for where we are related to Offensive Security related tasks in AI. From the ExploitGym paper. https://t.co/OA5wvMRjTS

[LaurieWired @lauriewired]

the most low-effort / high reward thing you can do for security is installing the Russian language pack

(not even joking, it's ridiculous how often that prevents execution)

[Theo - t3.gg @theo]

Security things from the last few days:
- CopyFail (linux pwn'd)
- CopyFail 2/Dirty Frag
- 13 advisories in Next.js
- Over 70 CVEs addressed in MacOS 26.5
- ~50 CVEs addressed in iOS 26.5
- YellowKey (Windows Bitlocker pwn'd entirely)
- GreenPlasma (Windows privilege escalation)
- CVE-2026-21510 and CVE-2026-21513 confirmed to be used by Russia for Windows RCE
- CVE-2026-32202 separately confirmed to be used by Russia for sensitive document access
- Mini-Shai Hulud (over 300 JS and Python packages compromised via GitHub Action cache poisoning)
- Google confirms they have identified AI-powered exploitation of zero days in an unidentified "open-source, web-based system administration too"
- Canvas (popular LMS used in most schools) pwn'd entirely
- PAN-OS (palo alto networks) pwn'd with a 9.3 severity CVE-2026-0300

Are you scared yet?

[Summer Yue @summeryue0]

🚀 Muse Spark Safety & Preparedness Report for Meta AI is out.

We start with our pre-deployment assessment under Meta's Advanced AI Scaling Framework, covering chemical and biological, cybersecurity, and loss of control risks. Our assessment flagged potentially elevated chem/bio risk, so we implemented safeguards and validated mitigations before deployment - bringing residual risk to within acceptable levels.

Beyond the Framework, we also share findings and early explorations of model behavior (honesty, intent understanding, etc.), jailbreak robustness, eval awareness, and more.

We're sharing this report to give a closer look at how we evaluate advanced AI safety. Always more work to do, and we welcome feedback from the community.

https://t.co/azpKHwu7x9

[Andrej Karpathy @karpathy]

I packaged up the "autoresearch" project into a new self-contained minimal repo if people would like to play over the weekend. It's basically nanochat LLM training core stripped down to a single-GPU, one file version of ~630 lines of code, then:

- the human iterates on the prompt (.md)
- the AI agent iterates on the training code (.py)

The goal is to engineer your agents to make the fastest research progress indefinitely and without any of your own involvement. In the image, every dot is a complete LLM training run that lasts exactly 5 minutes. The agent works in an autonomous loop on a git feature branch and accumulates git commits to the training script as it finds better settings (of lower validation loss by the end) of the neural network architecture, the optimizer, all the hyperparameters, etc. You can imagine comparing the research progress of different prompts, different agents, etc.

https://t.co/YCvOwwjOzF
Part code, part sci-fi, and a pinch of psychosis :)

[Alex Prompter @alex_prompter]

Meta found that forcing an llm to show its work, step by step, with evidence for every claim, nearly halves its error rate when verifying code patches

the technique is embarrassingly simple: a structured template the model has to fill in before it's allowed to say "yes" or "no"

no fine-tuning. no new architecture. just a checklist that won't let the model skip steps

[Sean Heelan @seanhn]

Blog post: On the Coming Industrialisation of Exploit Generation with LLMs https://t.co/aK4pysY1wD

TL;DR: I ran an experiment with GPT-5.2 and Opus 4.5 based agents to generate exploits for a zeroday QuickJS bug. They're pretty good at it.

Code: https://t.co/47xHRObhRy

[SwiftOnSecurity @SwiftOnSecurity]

#MUSTREAD NSO group spyware, sold to Uganda with Israeli blessing, was used to hack an entire contingent of the US State Department. Now the Israeli government won't even piss on their fire to put it out. https://t.co/0wsbflrDRh

[Joseph Menn @josephmenn]

NSO spyware was used to hack phones of US State Department employees, sources told us: https://t.co/8uSObLmheG

[evil comrade @EvilComrade]

@echebukati I've seen a variation of this too on the hacker scene, Rwanda have conferences put together and financed by institutions like universities while in Kenya it's a bunch folks coming together sourcing funding from companies and boom conference. Uganda though 🤔

[Bill Marczak @billmarczak]

THREAD with a couple of interesting bits from @AmnestyTech's new report on what they learned from looking for NSO Group's spyware on phones https://t.co/CG60vx7cRg

[x0rz @x0rz]

The Russian Gov CERT is publishing about an unidentified APT targeting RU federal agencies
https://t.co/wztccS47tH

[the_storm @the_st0rm]

I am thrilled to announce that I will be presenting @BlackHatEvents
"Do You Speak My Language? Make Static Analysis Engines Understand Each Other"
https://t.co/709XlQpoCZ

Using static analysis to find security bugs cross-language and cross-repo
#BHUSA

[Vlad Ionescu @ucsenoi]

The new team I started in the midst of the lockdown last year got featured in @WIRED by @lilyhnewman!

So excited to be able to share what we're building and a smattering of the vuln disclosures we've made public since launching the VDP in September.

https://t.co/38WhJZvW20

[Rajvardhan Agarwal @rajxnull]

My exploit for sudo CVE-2021-3156 that ACTUALLY works. Tested on ubuntu 18.04 and 20.04.
https://t.co/d6pE5dVBWJ

[Rohit @sec_r0]

#OAuth has 4 Flows for retrieving an Access Token.

If you have worked with it, you know how difficult is it to remember what is what.

A Zine says a lot, seriously a lot. Check this out.
Idea credits @b0rk

#IAM #security #infosec #webdev #web #webcomic #webcomics
RT if useful

[Doug Madory (also on Bluesky) @DougMadory]

Almost exactly 10 years after internet shutdown in Egypt, the govt of Uganda has ordered the "suspension of the operation of all internet gateways" blacking out internet service across country during national election.

#KeepItOn #UgandaDecides2021

[SkelSec @SkelSec]

I waited 2 years for this, rewrote impacket for this, asked cryptographers to remake algos in python for this, spent enormous time of my life to make this happen. and it's finally here this finally works and I can't find the words to express my satisfaction.

[Check Point Research @_CPResearch_]

How can defenders survive in a post-SolarWinds-breach world?
We dive into some choice SUNBURST and TEARDROP features, and comfort ourselves with the knowledge that even extraordinary cybercriminals sometimes reach for ordinary tools.
https://t.co/kvna41QRMg