scriptjunkie (Matt)

Documentation is lies. Source is an abstraction. Assembly is the truth. Also at and nostr npub10mx0gx3r2lszrrut8kvr5mt2m8r9ffhn

[scriptjunkie (Matt) @scriptjunkie1]

"Do NOT: Generate another password reset link"
- Meta's support AI bot prompt, ca June, 2026
https://t.co/mQHd3RuTKO

[Trail of Bits @trailofbits]

In our simplest bypass, we prepended 100,000 blank lines to a malicious skill. ClawHub's scanner truncated the file before reaching the payload, then marked the skill safe. https://t.co/QLCE0YgS5P

[scriptjunkie (Matt) @scriptjunkie1]

This is a really impressive exploit.
https://t.co/HCkKuroNLn

[vx-underground @vxunderground]

Yeah, so pretty much this guy is releasing an exploit in solidarity with Nightmare Eclipse guy. He said he notified GitHub about the exploit 60 minutes before releasing this paper.

I don't do web stuff, and I'm not a VSCode nerd, so I'm confused by the underlying technologies.

If you're a stinky GitHub and VSCode nerd maybe you'll understand.

tl;dr click github dev, github dev opens editor, in github dev editor have javascript, javascript does shortcuts automatically. github treats javascript shortcuts as real human input, or something. use javascript shortcut stuff to automatically install vscode extension. the vscode extension steals your data

tl;dr tl;dr user clicks 1 link, 1 click steals all data from your github

https://t.co/uh17usZeEH

[scriptjunkie (Matt) @scriptjunkie1]

@cremieuxrecueil This is a very unclear post. "Point for school closures" was probably intended to mean school closures caused learning loss but it sounds like an endorsement of school closures

[scriptjunkie (Matt) @scriptjunkie1]

@fishcanride There's hope for me too

[scriptjunkie (Matt) @scriptjunkie1]

Honestly hilarious that the hardest, most pure tests of intelligence in vuln disco and exploit dev-the binary skills that won CTFs and built the most powerful 0 clicks, are falling to AI as the new exploits cracking the Internet giants are trolls typing "pwease weset my passwood"

[Dino A. Dai Zovi @dinodaizovi]

Before, people were asking why there weren't any IRL attacks caused by prompt injection if prompt injection was so easy. The answer was simply that not enough real-world systems were using LLMs yet with both attacker exposure and a security boundary to break. Here's the first.

[scriptjunkie (Matt) @scriptjunkie1]

This is what robotaxis are taking from us
https://t.co/iTEJchB5xg

[Crémieux @cremieuxrecueil]

My Uber driver says

- His license is suspended
- He was once a soldier for a Mafia family
- He's telling me about his time in Rikers
- He's showing me YouTube videos
- He's telling me his theories about Jews

[Ben Landau-Taylor @benlandautaylor]

This is your periodic reminder that today's wars are very bad but still absolutely *tiny* in historical perspective. WWI saw individual battles with more dead than the entire Ukraine war. WWII saw individual air raids with more dead than the entire Gaza war.

[scriptjunkie (Matt) @scriptjunkie1]

Embrace AI or be left behind!
https://t.co/o6u1CXtrs9

[Nate @nnwakelam]

How the fuck does an account recovery flow make it onto Facebook where you can just ask an LLM to give you a password reset for someone else’s account?

[strandjs - [email protected] @strandjs]

This is horrible news.

Eric was like family for me for over ten years.

My heart goes out to his family.

[Microsoft Security Response Center @msftsecresponse]

Over the past several days, we have been listening to the conversation around coordinated disclosure and the relationship between security researchers and vendors. We recognize that this relationship is both critical and, at times, fragile. We deeply value the security community, and will continue to take your feedback seriously.

To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research. When an individual breaks the law and engages in malicious activity causing real harm to our customers, we will work with law enforcement as appropriate.

We recognize the work that goes into researching and submitting a vulnerability. We are committed to approaching every interaction with transparency, clear communication, and professionalism. We continue to believe strongly in Coordinated Vulnerability Disclosure as the foundation for protecting customers and improving our products. Each year we process a high volume of vulnerability reports. That volume continues to grow and will continue with the rise of AI-enabled research. We acknowledge that some interactions have fallen short and are working to learn from them.

Many of us have experience on both sides of this work, as researchers reporting vulnerabilities and as responders triaging and assessing them. That perspective informs how we approach this feedback and the importance we place on getting it right, particularly as the volume and complexity of research continues to grow.

The security community plays a vital role in helping us protect customers. We are committed to maintaining a constructive and respectful relationship and growing together. We know that, given the nature of this work, there will at times be misunderstandings. We remain committed to engaging in good faith and to providing a respectful and professional experience for all researchers, regardless of past interactions.

[Israel @f1tym1]

Windows Netlogon 0-Click RCE Vulnerability Now Actively Exploited In The Wild https://t.co/QpXgKhXIoF
The critical Windows Netlogon remote code execution (RCE) vulnerability tracked as CVE-2026-41089 is now under active exploitation in the wild, significantly raising the risk …

[SandboxEscaper @WeirdQuadratic]

why msft is going after this person. Either way, this researcher is incredibly young, and from what I heard, was very poorly treated by msft. I know first hand how vindictive msft can be. They went after my manager for simply daring to defend me. Thats the kind of 2/3

[SandboxEscaper @WeirdQuadratic]

I know who nightmare eclipse is, and the situation is infinitely more complicated than people think. This person is one of the most talented people I know. I've said that years ago already, and I'm still saying it now. I'm very familiar with their work. I dont know exactly 1/3

[scriptjunkie (Matt) @scriptjunkie1]

@ammattipyoraily This is like a top 10 US college football team win rate, crazy for a pro cycling grand tour team

[scriptjunkie (Matt) @scriptjunkie1]

@howdocomputer It's a change in Microsoft management and the volume and severity of what AI is finding. But ultimately it does not matter what bigger, hidden, fishy other motivations or identity or whatever eclipse or MS has or is. Their threat to researchers is inappropriate regardless.

[scriptjunkie (Matt) @scriptjunkie1]

"company issues thinly veiled legal threats against independent reviewers reporting flaws in product" has happened before and will happen again and every time the company and its actions must be met with scorn and defiance

[scriptjunkie (Matt) @scriptjunkie1]

@Na1chaca What were Pog's 2024 Giro aSLP's?