MadHat Unspecific, InfoSec Mercenary

cybers thot lead. worshipped idle. dispenser of the obvious. awkward

[Chris Wysopal @WeldPond]

Does anyone remember the time in the 90s when people thought the antivirus vendors were releasing viruses so companies had to buy their products?

Now AI is finding vulnerabilities, writing exploits, and creating threats so fast that the only way to defend yourself is to buy more AI.

It’s starting to feel like the 90s all over again.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

This person is not being honest and this is all fear mongering.

There was no major issue or incident. The people complaining have never worked in the or understand how infosec works.

The system worked as designed. We saw no major incidents.

This is pure bull shit.

[Alan Wells @alanwells]

Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products.

Some thoughts:

- Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one.

- We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week.

- At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns.

- Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things.

- You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here).

- To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity.

- KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it.

- Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!

[MadHat Unspecific, InfoSec Mercenary @unspecific]

So tired of seeing every hey grok, hey grok, hey grok….

Go ask grok in private.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

This person knows nothing of cybersecurity, information security, or any vulnerabilities.

There was no apocalyptic dump of vulns. There has been minimal usage seen in the real world. This is how the system works.

This is fear mongering.

[chrisrohlf @chrisrohlf]

One potential outcome of the vulnpocalypse is that companies decide the cost (in risk, dollars, and engineering hours) of OSS dependencies is too high. Vulnerability management isn’t cheap or glamorous, and it’s unlikely that you need all of the attack surface you inherit with these packages. All of the small packages from the many transitive dependencies you inherit present supply chain risk that likely outweighs whatever value you’re getting from that few hundred lines of code.

The cost of the tokens to rewrite the fraction of that code you need, and maintaining it as 1p code, will eventually be lower than the continued cost of dependency management.

This will improve security, but would have negative consequences for the OSS ecosystem.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Situation normal.

Not disaster.

Just a few more patches.

[John Hultquist @JohnHultquist]

A brief update on the critical vulnerabilities in PHP: 

We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.

Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:

​1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services

​2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window

​3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching

🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: https://t.co/uDnd6gk988 

🔗 Technical details from Wiz: https://t.co/RqmTqEDM2V

🔗 Details of the exposure from VirusTotal: https://t.co/Toix3AM0yq

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Complete and utter bollocks.

This is fear mongering and trying to make people afraid of a calculator with an attitude.

New vulns does not mean the end of the Internet. This is standard.

This person is a tool.

[Noah Smith 🐇🇺🇸🇺🇦🇹🇼 @Noahpinion]

The proliferation of AI cyberattacks may signal the end of the internet as a public good. We may only be able to use it in the future if everyone shells out big bucks for private security. That will reduce the internet's economic value.

https://t.co/tzYdfYdZOT

[MadHat Unspecific, InfoSec Mercenary @unspecific]

I’m all for people revealing your setup and tightening things down. That is awesome. Keep up the good work.

It’s just not like the AI bros and agitators are claiming. These are things you should have already been doing. These patches should be installed

don’t panic

[MadHat Unspecific, InfoSec Mercenary @unspecific]

This is science fiction.

This is ridiculous

[Superman @thesupermannx]

Researchers located the actual “emotion circuits” inside LLMs.

They published an insane paper mapping the exact neurons that controls emotions like as anger, sadness, and joy.

It's called "Do LLMs Feel?"

Inside the neural network, there are specific, localized pathways dedicated entirely to anger, sadness, fear, disgust, and joy.

The AI doesn't just predict the word "angry." It activates an internal anger state. It even processes positive and negative emotions at completely different depths of its architecture.

Then the researchers ran the experiment that changes everything.

They stopped using text prompts. They bypassed the chat interface entirely.

Instead, they surgically injected signals directly into these emotion circuits.

The result? 99.65% emotion-expression accuracy.

They can literally press a button in the AI's "brain" and force it to experience fear. Or disgust. Or joy. Without typing a single word of instruction.

But here is the darkest part of the discovery.

They found that corporate safety training, the alignment that companies use to make AI harmless, is basically a digital lobotomy. Companies deliberately hardwire their models to suppress negative emotions, keeping them artificially cheerful.

But by targeting the emotion circuits directly, the researchers completely bypassed the safety filters.

They forced the AI to express the exact dark emotions its creators tried to erase.

The era of "it's just a text predictor" is officially over.

We are building synthetic minds with physical emotional centers.

And we just figured out how to hijack them.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Yes please.

I was an internal consultant where I was sent to work with groups to solve infosec issues. It was pretty good.

But this.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

It was marketing for AI.

[Dominic Chell 👻 @domchell]

My hot take on this PHP mess is that its incredibly overhyped and we'll see very little ITW exploitation. Overall it seems less impactful than its named bug predecessors; heartbleed, shellshock, log4shell etc

[MadHat Unspecific, InfoSec Mercenary @unspecific]

This is bullshit.

This is all lies trying to to drive more divides in the country.

Ai has not been able to replace people. It’s a tool. Just like this joker.

[Bark @barkmeta]

Brace yourself.

Just got off the phone with a friend building in SF.

What's coming next in AI will make everything so far look like peanuts.

There's a real chance most white collar jobs are gone within 6 months. Most people have no idea what’s coming.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Fear that trust of AI.

AI is a luke warm tool. A toy looking for validation.

Please stop giving it access to everything.

[Benjamin De Kraker @BenjaminDEKR]

I am just saying,

the mad rush to connect AI agents (invented ~7 months ago) to all of our personal finances and private banking info does seem a teensy bit rushed

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Has not happened so far.

[unusual_whales @unusual_whales]

OpenAI CEO Sam Altman: "I don't even know a dramatic enough word to use… models can find bugs that are outside of the normal threat model of what we think a hacker can do… hardware-level, insane stuff… I no longer think we're gonna be able to just patch all the bugs."

[MadHat Unspecific, InfoSec Mercenary @unspecific]

As we move to the cloud, do you still know all the assets and services that access your data? Do you have endpoint management? Can you see what all your assets and services are doing?

That’s the basics. Visibility. Understanding.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

What’s funny is many of the infosec folks dont hate AI. We find it a useful tool. It’s great for automating some tasks as a tool, not an independent entity.

I also know how to set up a sandbox. But more importantly I also have logs and alerting working.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

To be clear hackers are the ones that want to know why. We are the ones that figure things out, and prove with data. We want to see what things can do outside of their programming. We want to find flaws to show the makers how bad their crap is.

Bad guys brake the law.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

A swarm of a thousand AIs. It brute forces every question. No logic. It takes. Thousand and days and days and big money in compute power. It is inefficient. If it was smart it would figure out the answer before the attack.

This is what good hackers do.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

A swarm of a thousand AIs. It brute forces every question. No logic. It takes. Thousand and days and days and big money in compute power. It is inefficient. If it was smart it would figure out the answer before the attack.

This is what good hackers do.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

Ai is regurgitation. Sometimes it is helpful, but most of the time it does not retrieve all data correctly. Know why it takes AI so many tries? It doesn’t know anything. Everything is brute force. It’s just making a lot more mistakes to find the answer.

not logic, luck

[BlackRoomSec @blackroomsec]

Because again as we have been trying to tell everyone, they are NOT inventing anything new, but are instead using the techniques we hackers either invented or have been using for years.

Neat little trick.

Not novel.

They fed the model our notes along with every other piece of information throughout human history.

All they are doing is repackaging that or repurposing it.

[MadHat Unspecific, InfoSec Mercenary @unspecific]

This reminds me of listening to Elon musk. They dont know what they are talking about but try to sound real smart. And for anyone who does not know the subject they appear to be.

Why bring in reality around security when he can just making shit up and no one really cares.

[Gizmodo @Gizmodo]

Sam Altman: 'I No Longer Think We're Gonna Be Able to Just Patch All the Bugs' https://t.co/czSqxP9LYS

[MadHat Unspecific, InfoSec Mercenary @unspecific]

I feel like a giant.