Ståle Pettersen

Security enthusiast that work with Application security and Cloud security.
Bsky:

[Arsenal @Arsenal]

The best images from the 2025/26 season, chosen by you 🫵

[Jim Manico from Manicode Security @manicode]

I'm doing a free live webinar on Monday, June 15 and I'd love for you to join me.

We'll set up a secure Claude Code environment from scratch, load up the Manicode secure coding prompts, and run Claude Code and Codex side by side .

Live, no slides, just real demos.

60 minutes on Zoom, 10 AM PT / 1 PM ET, with open Q&A at the end. Bring your setup questions.

Register free https://t.co/Zo4dUgrWi6

[Jeremiah Grossman @jeremiahg]

We never figured out how to secure software that does exactly what it’s told. Now we’re betting on software that doesn’t.

[thaidn @XorNinja]

We’ve now seen at least four nginx RCEs that require non-default configs: nginx rift, nginx poolslip, and two of our own (including the one in the last tweet).

The configs involved are unusual, which raises the obvious question: do these attacks actually work in real-world deployments?

We asked Claude to download and analyze more than 4,000 nginx config files from GitHub.

The result was embarrassing: none of them were vulnerable to nginx rift or our own attacks. We can’t say anything about nginx poolslip yet, since it hasn’t been published.

So don't worry about your nginx yet.

Moral of the story: AI can generate FUD, but also help fight FUD. Embrace it!

[Son Luong @sluongng]

Codex just found a “workaround” of not having sudo on my pc…

[Justine Moore @venturetwins]

Me using Claude Opus 4.8 to rename a file

[Arsenal @Arsenal]

The Arsenal. Your Premier League champions.

[Dr. Anton Chuvakin @anton_chuvakin]

"A common and dangerous failure mode is the “everything agent,” a single agent with broad permissions, many tools, and loosely defined responsibilities." https://t.co/nS0LBNZi1m <- WISE SECURITY ADVICE from ... @Microsoft (yes, really!)

[Halvar Flake @halvarflake]

The internet has survived a period where a handful of late teens and early 20s kids were the only ones that knew about pre-malloc integer overflows as a bug class, and you could "grep malloc | grep \*" to find a bug in OpenSSH.

This is why I am pretty chill about Mythos.

[Jim Manico from Manicode Security @manicode]

Do this in planning mode

1) hey Claude, please do a deep security code review of my repo using multiple agents. Save the results as a GitHub issue for tracking

2) hey Claude, please look at my code review results and triage to make sure there are no false positives

This is my #personalMythos for over a year now 🤷‍♂️ it’s already here!

[UI/UX Savior @UiSavior]

Lol 😂😂

[Curiosity @CuriosityonX]

People don't realize how absurd this view actually is.

A camera. On a robot. On Mars.

Built by humans on a planet 140 million miles away, launched on a rocket, landed using a sky crane, and now driving across an alien desert taking pictures so detailed you can count the rocks.

100 years ago, your great-grandparents thought airplanes were a miracle.

You are scrolling past Mars on your phone.

[Signal @signalapp]

A response to recent reporting in Germany, in service of clarity and accountability:

First, it’s important to be precise when it comes to critical infrastructure like Signal. Signal was not “hacked” — in that our encryption, infrastructure, and the integrity of the app’s code was not compromised.

However, sophisticated attackers have engaged in a harmful phishing campaign, posing as “Signal Support” by changing their profile display name and using social engineering to trick people into handing over their credentials — information that allowed these attackers to take over some targeted Signal accounts. This is something that plagues any mainstream messaging app once it reaches the scale of Signal, but we know how high the stakes are given the trust people place in us.
In the coming weeks, you’ll see us rolling out a number of changes to help hinder these kinds of attacks.

Because we don’t collect user data, what we know about these attacks comes from the victims of phishing. And from what victims have told us, the attacks followed a broad pattern: after tricking people into revealing their Signal credentials, attackers then used those credentials to take over their account and also frequently changed the associated phone number. Because such a change results in de-registering your Signal accounts, attackers prepared people for this by telling them that being de-registered was intended behavior, and that all they would need to do is “re-register,” or, create a new account. When they moved to create a new Signal account — one that was now decoupled from their hijacked account — the victims thought they were logging back in to their primary account. As a result, many didn't notice the takeover. The compromised accounts were then weaponized to target the victims' contact lists by posing as the owners of the account.

We understand the trust that people put in Signal, and how devastating this kind of social engineering can be. While it’s true that all messaging platforms are susceptible to scammers and phishing that betrays people’s trust and convinces them to “unlock the front door” where no backdoor exists, we are looking to do everything we can to help people avoid and detect such scams.

For the time being, please stay vigilant against phishing and account takeover attempts. Remember that no one from Signal Support will ever send you a message request or ask for your registration verification code or Signal PIN. For an added layer of protection, you can enable Registration Lock in your Signal Settings (Account -> Registration Lock).

[Ståle Pettersen @kozmic]

Spot on! If it costs $100 000 in tokens, it has to be taken into account. It has always been a question about cost per finding, and it still is:)

[Halvar Flake @halvarflake]

Proposal: if you publish about an LLM finding vulns, please publish precise costs. Given the different levels of competence, verbosity etc per model, knowing token counts and cost per token is essential.

[JP Aumasson @veorq]

meant to write such a post, but now wont have too, thanks @FiloSottile
https://t.co/otlGtas8cO

[Dr. Anton Chuvakin @anton_chuvakin]

This is my "psychoanalysis by X" thread, yes, another one. Why am I so triggered by advice "patch this <broad class of vulns> immediately" given with no awareness of my business/mission? (1/5)

[thaidn @XorNinja]

Learning to Jailbreak an iPhone with Claude (Part 1)

Claude helped me take apart an iOS Safari exploit, and retune it for my Mac. It even wrote its own variant.

Working with Claude on this felt like having a Nobel laureate who’s happy to spend the afternoon on undergrad problem sets. No implied “this is beneath me,” no rationing of attention to questions that are interesting enough.

When an explanation wasn’t landing it would just go build the thing: spin up the debugger, write the measurement script, hand me the curve. The vulnerable WebKit wouldn’t even compile on my laptop at first, and it took Claude most of a night to figure out why.

This is perhaps a glimpse of the future of education: anyone with a laptop and (of course) the tokens to pay for it gets the depth of attention a PhD advisor gives their best student.

During this exploration, I kept wondering: why learn at all when Claude can do almost everything? The answer is simple: it’s still fun to understand how things actually work.

But there’s also a more practical reason. You can’t ask Claude about things you don’t even know you’re missing. Learning shrinks those unknown unknowns, and that’s what lets you use Claude well in the first place.

https://t.co/Sqrnzm2XGt

[Yoonho Lee @yoonholeee]

We just released code for Meta-Harness! https://t.co/OdU7zocdPl

Aside from replicating paper experiments, the repo is designed to help users implement good Meta-Harnesses in completely new domains! Just point your agent at ONBOARDING.md and have a conversation

[David Naylor @_David_Naylor]

Yes exploits alone won't bring us doom.But the same model that got really good at exploits is also going to be really good at infostealers and leveraging credential theft and leveraging initial access and laying down more sneaky persistence footholds and finding priv esc etc
1/

[Thomas H. Ptacek @tqbf]

Calif is on such a roll. "Vulnerability research is cooked", I said last week; alternate possibility: vulnerability research is now the funnest thing in the world. Getting a highly situational nginx bug working w/ Claude: https://t.co/8v6K3FJdy1