Yoav Alon

CTO @orcasec | I tweet about fuzzing, bugs, and all that security jazz

[Yoav Alon @yoavalon]

@antirez What harness did you use? Was there a planning + implementation steps? Based on personal experience bigger models are better at handling with ambiguity

[Samuel Colvin @samuelcolvin]

Loving github today.

[Brendan Dolan-Gavitt @moyix]

Exim 4.99.3 is out, patching CVE-2026-45185, a critical RCE found by XBOW! Check out our post linked in the reply; I'll summarize some details in this thread.

[Yoav Alon @yoavalon]

@antirez @ggerganov How well does it handle multiple agents in parallel? Did you try to run 3-4 agents and see what is the throughput and latency?

[Susan Zhang @suchenzang]

so that explains the delay...

deepseek could not fix training instabilities, after doubling from ~15T tokens in v3 to ~33T tokens in v4

the 10+ mentions of "stability" tricks seem to be wildly lacking if these two were the main bandages (mismatched routing + clamping)

but kudos for transparency, as always!

[𝙿𝚊𝚟𝚎𝚕 𝙶𝚞𝚛𝚟𝚒𝚌𝚑 @PashaGur]

Being an Israeli CEO since 2019 is basically very much like:

while True:
slack_team(f"Don't come to the office today due to: {random.choice(['pandemic', 'war', 'sirens', 'protests', 'shenanigans'])}")

[Yaron Dinkin @ydinkin]

Joining the agentic vuln research hype, @EyalKraft and I did something. Unfortunately, it worked better than we hoped.

We spent a few weeks building an agentic loop that reverse-engineers and exploits kernel drivers. We already found 100+ exploitable drivers.

(link below)

[Dmitry Vyukov @dvyukov]

syzkaller/syzbot now has AI agentic framework for kernel bug fix generation, bug assessment, security triage, POC generation, etc:
https://t.co/MO6sET6UkG
Includes set of tools to build kernels, navigate/edit source, test reproducers, etc.
Contributions/research are welcome.

[Yoav Alon @yoavalon]

Very cool! And with the advent of coding agents I believe annotations will come sooner rather than later

[Marco Elver @maelver]

Clang's -Wthread-safety, named "Context Analysis" for the Linux kernel finally merged after a year's worth of work: https://t.co/E68Hq3sZAJ

https://t.co/Mpj3bztHve

Currently opt-in; go and set 'CONTEXT_ANALYSIS := y' for any kernel code you're developing. Needs Clang 22+.

[Yoav Alon @yoavalon]

@roeeshenberg Elaborate please?

[Armin Ronacher ⇌ @mitsuhiko]

Recorded some updated thoughts on agentic coding tools if someone is curious.

[Rob Zolkos @robzolkos]

@badlogicgames "includeCoAuthoredBy": false

In ~/.claude/settings.json

[Bryan Cantrill @bcantrill]

Our $100M Series B
https://t.co/cBvONvJxsA

[Yoav Alon @yoavalon]

🔍 Calling all **#CloudSecurity** Researchers!

🛡️ Lead Cloud Runtime Sec Eng @orcasec
🇵🇱 Hybrid (Poland/Warsaw)
🎯 Build & Research runtime engine (Go/C++/eBPF/AI)

👉 https://t.co/zXUWV8TrXP
#InfosecJobs #Hiring

[Yoav Alon @yoavalon]

@mitsuhiko Has a very similar experience

[Yoav Alon @yoavalon]

@jarredsumner @charliermarsh please do the same for uv 🙏🏻

[Felix Geisendörfer @felixge]

🔭🐶 Exciting news: @datadoghq has announced our intend on donating our new Go auto-instrumentation framework to @opentelemetry.

[Ivan Fratric 💙💛 @ifsecure]

Domato Lives! Today, we merged a WebGPU fuzzer written by @btiszka who used it to find several serious bugs in Chrome. Check it out at https://t.co/NzSn14fBXZ. Potentially also interesting for other browser vendors working on their own WebGPU implementation ;)

[Yoav Alon @yoavalon]

🇵🇱 Polish Security Experts! 🛡️
We're hiring a Security Researcher for our R&D team. Work with cutting-edge tech (eBPF, Linux, K8s, Malware analysis) to fight cybercrime!
https://t.co/FKKmVf31ZQ

RTs appreciated for reach! 🙏

#CloudSecurity #CybersecJobs #PolishTech

[Snyk @snyksec]

Snyk 🤝 @orcasec

Together, we're revolutionizing DevSecOps. 💪 Learn how our strategic partnership provides unparalleled visibility into risks throughout the entire app lifecycle - from dev to runtime. #AppSec #CloudSec https://t.co/3sTFi1z0jX