Jered Bare

^ Not my profile pic InfoSec, Fitness, and Python. Expect delays.

[Jered Bare @jeredbare]

per
⊂_ヽ
　 ＼＼ my
　　 ＼( ͡° ͜ʖ ͡°)
　　　 >　⌒ヽ
　　　/ 　 へ＼
　　 /　　/　＼＼last
　　 ﾚ　ノ　　 ヽ_つ
　　/　/
　 /　/|
　(　(ヽ
　|　|、＼email
　| 丿 ＼ ⌒)
　| |　　) /
ノ )　　Lﾉ
(_／

[Jered Bare @jeredbare]

AI wrote this

[Amazon Web Services @awscloud]

More AI-generated code doesn't make your team faster. It might actually slow you down.

[Zack Korman @ZackKorman]

Gotta hand it to Anthropic, this is pretty interesting. Both because it shows how the models improve at writing PoCs, and because there are still PoCs Mythos couldn't write.

[Dave Kennedy @HackingDave]

The marketing hype machine doesn’t rest. Pause as in give us time because we are completely out of compute space so allow us to build so we can compete with our competitors in a way we didn’t foresee.

F these guys. Seriously.

[Jered Bare @jeredbare]

@jimcramer Jim "Bear Stearns is Fine" Cramer

[GreyNoise @GreyNoiseIO]

Before Cisco published CVE-2026-20127 (CVSS 10.0, zero-day), GreyNoise sensors observed eight activity surges compressing from 39 days to 2 days. That countdown pattern repeated across 33 CVEs — with a median lead time of 11 days before public disclosure.

Join us on Wednesday for the  live "Ten Days Before Zero" findings. https://t.co/hmmpwOsR8L

[Jered Bare @jeredbare]

@kuzushi

[Jered Bare @jeredbare]

@kuzushi All I'm saying if you put black olives on your tacos as a kid, they may be right. /s

[Jered Bare @jeredbare]

Wow...what a tragedy.

[strandjs - [email protected] @strandjs]

This is horrible news.

Eric was like family for me for over ten years.

My heart goes out to his family.

[Jered Bare @jeredbare]

lmao, wtf

[Polymarket @Polymarket]

NEW: House Speaker Johnson says lawmakers need stock trading for financial support since their $174,000 salaries haven’t kept up with inflation.

[JFrog Security @JFrogSecurity]

Heads up if your CI pipelines are failing right now! 🚨 OSV seems to be experiencing a major wave of false positives over the last few hours, incorrectly flagging massive, highly-trusted packages as malicious.

A few of the biggest casualties so far:
• npm @tanstack/start-storage-context (1.167.4)
• PyPI fastapi (0.136.3)
• PyPI strawberry-graphql (0.315.6)
• npm @nx/key (5.0.7)

If your deployment is bricked, verify manually before panicking. Automation is a tool, not a judge.

[Jered Bare @jeredbare]

@mchooyah Do you think our lost brothers and sisters would want that?

[tuckner @tuckner]

Change https://t.co/zvseo6TLVx to https://t.co/IeVkcBQ9mq and view the hash + enrichment super quickly!

[Jered Bare @jeredbare]

@ZackKorman I stopped going in 2018, went back last year, and going again this year. However, it’s basically the family reunion for me.

[Sprocket Security @SprocketSec]

Tenant enumeration is dead.

Microsoft has now patched both techniques that allowed full tenant domain discovery from a single unauthenticated request.

That changes recon against M365 environments significantly.

The signals still exist, tenant IDs, MOERA prefixes, brand metadata, but no single query gives you the full picture anymore. Effective enumeration now means chaining techniques together, validating against large datasets, and in some cases requiring authentication.

Juan Pablo Gomes Postigo breaks down:
• what the original technique was
• what still works today
• how we updated https://t.co/odd5t8dr5G going forward

https://t.co/NjDIibtx4V

#CyberSecurity #Pentesting #IdentitySecurity #SecurityResearch

[Zack Korman @ZackKorman]

Holding cybersecurity vendors accountable for their claims is a critical part of improving security.

I'm not a troll. I'm not lying. And I'm not harassing you. But since that's your response: Here we go again.

[Jered Bare @jeredbare]

@cyb3rops The basics have never changed. Doing the basics and the basics well is one of the best defenses.

[NSA Cyber @NSACyber]

NSA is releasing security design considerations for AI-driven automation leveraging MCP which, while simplifying the integration of diverse capabilities into powerful agent workflows, requires caution. Learn more: https://t.co/zn2DyUz5be

[Jeff Cross @jeffbcross]

GitHub’s report today confirms that the compromised Nx Console extension was used as the initial access vector in this attack.

This is a difficult thing to read as the CEO of Nx, and I want to be direct about it: we take responsibility for the role our software played in this incident.

I’m grateful to the GitHub, Microsoft, and independent security teams that moved quickly to investigate, contain, and share information publicly.

This incident highlights that there need to be deeper, more fundamental changes to how we and other maintainers need to think about securing developer tooling and open source distribution. We are already making major changes to our publishing, automation, and extension security posture, and we’ll continue sharing those changes publicly as we implement them.

We’re also beginning conversations with other high-profile open source maintainers about how we can work together on some of the deeper structural problems around software supply chain security. A lot of the assumptions the ecosystem has operated under for years no longer hold.

Our focus right now is supporting affected users, hardening Nx, and helping push the broader ecosystem toward stronger supply chain security practices.

Updates and guidance:
https://t.co/szBoQ3doaX

[tuckner @tuckner]

Anyone know a Koltin Smith that works at GitHub?

https://t.co/LEgZNHijF1

[Justin Elze @HackingLZ]

For those of you just now paying attention to cybersecurity, large companies got hacked before AI.

Colonial Pipeline, SolarWinds, OPM, Kaseya, Aramco, Change Healthcare, Equifax, Target, Home Depot, TJX, etc