Romesh

Cyber security Analyst | Apple Hall of Fame| Fight misinformation | White hat hacker | blogger

[Romesh @romeshchandar]

Finally this arrived. I wrote here how I did this if your interested https://t.co/jV0RlM5DlO
#hacking

[Romesh @romeshchandar]

@cyberChad101 Umm. Cybersecurity has a whole is defence.

[Romesh @romeshchandar]

The speed of the attack also stood out. only seven minutes elapsed between detection of the unauthorized access and the onset of damage. Previously, when an alert was raised, a specialist team would run diagnostics and decide on countermeasures in meetings—but that is no longer fast enough.

[Peter Steinberger @steipete]

"When the company ran diagnostics on about 700 systems, it found 10,500 vulnerabilities and held an emergency press conference on June 16, applying fixes over three months.
However, when it re-ran diagnostics using "GPT-6 Astra," the latest model released by US-based OpenAI, it confirmed 35,000 new vulnerabilities. "Honestly, we're completely exhausted" https://t.co/0T069oG6Zh

[Romesh @romeshchandar]

@kunalb11 WhatsApp really end to end encrypted? Honestly?

[Romesh @romeshchandar]

@IndianTechGuide Nita Ambani be like .

[Romesh @romeshchandar]

@jieselong Why couldn't he just buy out and make it official?

[Romesh @romeshchandar]

@realLuke007 Nvidia CEO Jensen Huang says his affaired girl friend is just AI powered by nvidia GPU ;)

[ch0uch w. @ChouchWard]

Over the past few days I've been digging into #ARTEX Infrastructure :

// PART I: I started from an IP shared by @MichalKoczwara to correlated 45 addresses

// PART II: I dug into:
- 290 historical HTTP observations,
- Sub2API deployment patterns,
- Shared TLS cert clusters
- Historical DNS relationships

More infrastructure, more hunting leads!

Part I:
https://t.co/Dd3s2xH9vx

Part II:
https://t.co/REBoALCxtX

#CTI #hunting #AgenticAI

[Romesh @romeshchandar]

Wishing everyone a very Happy Diwali

[Romesh @romeshchandar]

a defense-in-depth framework for agentic AI spanning provisioning validation, runtime enforcement, and continuous assurance.
It combines agent registry, personas, explicit intents, constraints, tool validation, context-aware guardrails, and continuous red teaming.
Runtime prompt provenance and evidence chaining correlate actions to user requests, defending against injection and goal hijacking.
Security must be designed into agent architecture from the outset, not retrofitted later.
Restricting agents to explicit intents and constraints most effectively governs behavior as autonomy grows.

[Uber Engineering @UberEng]

https://t.co/XFWteI3jUO

[Romesh @romeshchandar]

@cyberChad101 CVSS 10.0, bounty $50, and a LinkedIn post worth $5 million.

[Romesh @romeshchandar]

@IndianTechGuide Capitalistic thoughts are not good for nation like India.

[Romesh @romeshchandar]

So there's going to be too many abc2shell like vulnerabilities in near future?

[Romesh @romeshchandar]

@GlobeEyeNews CIA : can inspect anything

[Romesh @romeshchandar]

@FBI PHP: pretty horrible protection

[Romesh @romeshchandar]

@calif_io @lcfr_hax If steve was alive .

[Romesh @romeshchandar]

@ETNOWlive So one don't need quantum power to break. Calculator is just enough.

[Romesh @romeshchandar]

The GitHub Security Lab used an open-source agent to find 24 Android vulnerabilities, including a location leak in a navigation app with 10M downloads.
https://t.co/Z7JKNc1pTq

[Romesh @romeshchandar]

Nist

[kokumօtօ @__kokumoto]

米国NIST、NSA、CISAがAIエージェントの学習・評価環境におけるインシデント対応指針を公開。準備、検知、対応、復旧、報告の5段階で10項目。モデル、ハーネス、ホスト、NWの各層での監視、外部通信制限、独立評価、証拠保全、エージェントの自動停止、第三者への通知を推奨。 https://t.co/J2ug6OBNXO

[Romesh @romeshchandar]

Had the most worst experience in #chennai @Cex . I bought the game and it threw the error. Despite asking to check the cd the store keeper refused. I had to visit the store again only to see employee rude behaviour.

[Romesh @romeshchandar]

“Vulnerability research is changing and evolving, and it’s intuition that will separate good from best.”

[HackerOne @Hacker0x01]

In the latest episode of HackerOne's Exposed video series, Nahman Khayet, Co-founder and CEO of Alt Security, explains what separates a “good” researcher from the “best” researcher.

Vulnerability research requires pattern matching and intuition. The operational work of pattern matching can be easily automated by AI. What can’t be automated is the intuition: I look at a target; there are 200 endpoints, but I know the right direction to take, the right pattern to look for. That’s what the best researchers can do. The best researchers can use AI models to double down on that intuition.

“Vulnerability research is changing and evolving, and it’s intuition that will separate good from best.”

Watch the full episode on YouTube: https://t.co/TJWBZndZNm