theabysslabs

A light in the abyss of reverse engineering. 0day and N-day exploitation focusing exclusively on desktop/server platforms.

[theabysslabs @theabysslabs]

This is the SHA256 hash of file describing the root cause of a Windows Kernel 0day vulnerability found by me. Waiting for Patch Tuesday....
1fd1fbf5b0c6f4fe07083c4e3cd25291ee8ad29c9b00b3d82be696f708b5ff84

[Deedy @deedydas]

Claude Fable 5 is by far the most ridiculous model that makes me genuinely afraid for the future of software engineering.

I compiled the top 10 most unbelievable things I've seen Claude Fable 5 do today:

— Migrate a 50M line codebase from Stripe in a day (humans take 2mos)
— Draw amazing 3D graphics a) Boeing 747 b) space simulations with >5000 objects c) Minecraft roller coasters d) full photorealistic forest scenes e) NYC skyline f) stormy clouds)
— One-shot Pokemon FireRed the game
— Optimize a real world proprietary interaction net evaluator 10x more than the next best model, gpt5.5

AND it's about the same price as GPT 5.5 ($10/M input, $45/M output) vs Fable 5 ($10/M input, $50/M output) and 6x cheaper than GPT 5.5 Pro.

[Halvar Flake @halvarflake]

@C2IRIS At some point you realize that the effort to payout ratio in vulndev is actually not better than elsewhere ;).

[Ethan Mollick @emollick]

So Mythos was, indeed, not marketing hype.

Remember this is a general purpose model that just happens to be good at finding exploits because good models are good at lots of things. Expect similar from OpenAI & Google. And from open models in 8 months. https://t.co/KbhalQYX8R

[Alex Matrosov @matrosov]

Lately I've been thinking about how AI is changing vulnerability research and reverse engineering. VR and RE are some of the hardest workflows to parallelize. Even with great knowledge transfer and team practices, you usually default to one person per vuln or RE task. The work is just too context-heavy to split.

AI breaks that ceiling. It's no longer "one researcher, one task", it's you working one angle while Claude annotates disassembly code, explores another path, or helps you piece together what the last result means.

Watching this land in domains we assumed were fundamentally serial is wild.

[zh1x1an1221 @zh1x1an1221]

Guys, have you decided which other field you want to switch to?

[b33f | 🇺🇦✊ @FuzzySec]

The reactions from the security community on Mythos are interesting. Some denial, some cope, some people trying to sell you their 20b parameter model business. Is there hype, sure but there is also firecracker OOB write and AISI evals. I think it’s important in our community 1/n

[dinosaurlover38 @_dinolover38]

OSS-Fuzz found this 18 yr old remote integer underflow in nginx. I found it too, but 2 weeks slower.

Google's CodeMender AI submitted the exact same fix as me.

Just look how similar our reports are.

Security research might just be cooked.

https://t.co/Uu9mZp3nmj

[thaidn @XorNinja]

MAD Bugs: Feeding Claude Phrack Articles for Fun and Profit

A teammate gave Claude a Phrack article. It built a working rsync RCE on x86-64. He shared the generated exploit with me but forgot one file, and I needed it on ARM64 anyway. I gave Claude one prompt: reproduce this. Ninety minutes later it dropped a working exploit. I told it the exploit was slow (5 minutes); it made it 20x faster. We also asked it to audit the patched rsync, and it came back with new bugs.

https://t.co/DYZBF1vC79

[thaddeus e. grugq @thegrugq]

People are freaking out about an impending flood of 0days. This was the norm 20 years ago. I’m not that worried. Firstly, simply having an exploit doesn’t mean all that much in terms of operational capability. Secondly, I’m giving up computers and moving to a farm in the hills.

[Sophia ❣️ @KeruboSk]

People with ADHD have what’s called an “interest-based nervous system.” They literally can’t force themselves to care about things that bore them.
It’s not a choice. It’s not willpower. Their brains physically won’t produce the neurochemicals needed to engage unless something triggers interest, urgency, novelty, or challenge.

[Dustin @r0ck3t23]

Marc Andreessen just collapsed a fifty-year assumption in one sentence.

Andreessen: “I’m not sure there will even be a salient concept of a programming language in the way that we understand it today.”

Not declining.

Not evolving.

Gone.

For fifty years, humans learned machine syntax to command computers.

We bent our cognition to fit their grammar.

We built entire careers on how fluently we could speak a language machines wrote the rules for.

That was always backwards.

The correction is arriving faster than the industry will say out loud.

Andreessen didn’t stop there.

Andreessen: “You may not need user interfaces.”

Then came the only question left.

Who uses software in the future?

Other bots.

Follow that to its end.

The screen. The dashboard. The browser. The app. The dropdown menu.

Every interface ever built assumed a human on the other end who needed the world made legible.

If the user is a machine, none of that is necessary.

The entire visual layer of computing was built for biological eyes.

When the primary users are no longer biological, that layer doesn’t get updated.

It gets stripped.

Andreessen drew the comparison himself.

Not long ago, 99% of humanity was behind a plow.

The world spent generations asking what people would do when farming disappeared.

The answer was everything worth doing.

We are at that exact moment again.

Except this time, the plow is a keyboard.

Andreessen: ��I’m going to tell the thing what I need, and it’s going to do it in whatever way is most optimal.”

That sentence deletes the entire skills economy built around execution.

Not judgment.

Not taste.

Not the ability to want the right things.

Just execution.

That part is over.

Which means the only thing left that matters is the quality of what you want.

Most people have spent their entire careers getting better at building.

Almost no one has spent that time getting better at knowing what to build.

That gap is about to become the only gap that matters.

The friction of execution is gone.

What you can imagine is what you can build.

The question is whether you’ve ever trained that muscle.

Most people haven’t.

[Xiaoyin Qu @quxiaoyin]

I have kids. I work in AI every day. And honestly? I have no idea what their careers will look like in 15 years. But I know what will carry them through.

First, and this might sound unromantic: make money and save it for them. We can debate educational philosophy all day, but the world is changing so fast that financial security might be the most practical gift we can give. Buy some gold bars. Seriously.

Second, nurture their imagination. AI rewards people with initiative and wild ideas. The kid who daydreams, who asks weird questions, who wants to try ten things at once? That kid will thrive. AI can execute. AI can be disciplined. What AI can't do is dream up something nobody's thought of before.

Third, build resilience. There are no more iron rice bowls (guaranteed lifetime jobs). Any stable, predictable job is exactly the kind of job AI will learn to replace. Our kids will likely switch directions many times in their lives. Learn something new, get replaced, pivot, repeat. It's more like being a hunter than a farmer. Schools don't teach this. Schools teach you to follow a linear path: high school, college, grad school, stable job. That linear path is becoming the most dangerous one.

Last, invest in their ability to connect with other humans. Not networking. Not schmoozing. Real emotional connection. Building trust, offering support, making people feel seen. As AI handles more of the rational, analytical work, the human ability to genuinely relate to other humans becomes more rare and more valuable.

I don't have all the answers. But I know that imagination, resilience, and genuine human warmth aren't going out of style anytime soon.

#AI #Parenting #Education #FutureOfWork

[GCU Tense Correction @tensecorrection]

https://t.co/7cSB0XjQdT

[dunadan @udunadan]

Be careful to know when you're tired and when you're stuck. You may interpret a mental block as a sign of fatigue, but the task may require deeper thought & longer digestion or it may be a signal you have to reflect on how to grow your skills in that particular stage of work.

[dunadan @udunadan]

From a competition pov, a change which LLMs bring into VR hugely depends on why and how a researcher does a job. There is a difference for those who participate in bug bounties and, on the other side of the spectrum, keep bugs private. 1/n

[LukeGix @LukeGix]

I published a post describing the exploitation process for CVE-2024-38193, a use-after-free vulnerability in the afd.sys Windows driver. Hope you enjoy it! :)

https://t.co/tzazvZxOqp

[dunadan @udunadan]

An interesting case of impact of exploit development has on mental health, I think, shared by many, just like the career doubts mentioned. It has never been easy, but it will be harder every year, mitigation, disappearance of mid-hanging fruits and so on. As the classic goes,

[MindBranches @MindBranches]

Book Summary: “The Mountain Is You: Transforming Self-Sabotage Into Self-Mastery”

[ₕₐₘₚₜₒₙ @hamptonism]

Machine Learning Algorithms you Must Know:

[Historic Vids @historyinmemes]

In Japan, "Johatsu" refers to people who disappear due to pressures like failed marriages, debt, and job loss. They abandon their lives and live anonymously off the grid. Specialized companies, called "night movers," assist them in vanishing completely.