Since June 1 2026, less than two weeks ago, Cloudflare has protected at least 100,000 newly observed or newly active domains that have earned a 100 risk score from us, meaning they are blocklisted by a third party. 104,231. And that is not exhaustive.

"If we don't have an impact as a group, as a company, as a security team, it doesn't really matter. It's theatre." - Well said by @heinbrian.bsky.social, one of my favorite people to talk to about punching bad guys over the internet. You should follow him if you don't yet.

Last week I had the honour to do the closing Keynote for @elbsides.bsky.social together with CJ - the fantastic @dnsfilter.bsky.social team now published the slides, the recording and a transcript at www.dnsfilter.com/blog/who-com... A big shout out to the @elbsides.bsky.social team

An interesting benchmark for AI influence: previously, AWS Bedrock has been the solution to engage with frontier models without data sharing. The frontier model companies appear to have broken that stalemate: news.ycombinator.com/item?id=4847...

Brian Krebs: Who Runs the Ransomware Group ‘The Gentlemen?’ krebsonsecurity.com/2026/06/who-...

game devs please put more crows/ravens/other corvids in games plz boost for murder/conspiracy purposes

oh how did i miss this? excited to jump into it, mysk gives us the best iOS toys.

Some heroes don't wear capes

Legit just had the worst idea ever and I kinda love it: create a fake data broker / peoplesearch site in order to evaluate the data scrubbing services.

s BGP boring? Well...it depends. But a few quick observations we've made recently: 1. Several /24 IP blocks with consistent RPKI/IRR flips between a Romanian ASN, half a dozen Iranian ASNs, and another handful of shell ASNs in EU and NA in order to launder transit from sanctioned IP space.

less obstacle and more maneuver, this is textbook track chicane

Today I learned the word "chicane" which apparently means an impediment or obstacle on a race course. So naturally my next question was, if that causes a crash with impalement, is that a chicane kabob?

Another AI backlash piece - over 150 math professors from across the world, including Europe, Japan, and the US, warned governments especially not to "believe the hype" about AI systems' math abilities. Leiden Declaration on Artificial Intelligence and Mathematics leidendeclaration.ai#declaration

Out at Sleuthcon. Not enough coffee in me yet. But come say hi.

2005 called and wants its hostile vendor culture back. Let's take a moment to talk about how “responsible” disclosure would mean vendors don’t give bug hunters the runaround and slow walk fixes, then cry victim when the researcher discloses the bug publicly. 1/

ngl, free won’t is the best concept I’ve heard of in a while I now finally understand that Windows error message, "Task failed successfully."

I know it's ragebait, okay? I know. But a year ago the VCs were still talking up "Zero Trust" as they had been for the 5 years prior. We are now explicitly, word-for-word, at the stage of "fuck it, trust whatever, you paranoid scum." www.chemistry.vc/post/ai-for-...

Now at train station train station doesn't even open for another half hour. why did i do this

[entrepreneurishly] here at the richest university you can imagine we've charted a brave new vision: what if we got rid of books

This one ought to be interesting. Emergency cryptocurrency wallet firmware update email from Trezor sent from [email protected]. Have not dug into headers yet.

Microsoft's recommitment to "security first" continues to impress. blog.ammaraskar.com/github-token...

From the enterprise SecOps trenches, my report is as follows: I had 3 hours of peace between submitting my last AI-related software security review, and a ticket being opened for a new AI-related software security review.

Great FIRST CTI Conference talk by @pylos.co released today, very worth 25 minutes of your time. #infosec #cybersecurity #threatintel www.youtube.com/watch?v=lmnZ...

The Trump Administration has named Bill Pulte as acting Director of National Intelligence. Pulte has no intelligence background, no military background, and used his directorship of the Federal Housing Agency to investigate Trump political foes for mortgage fraud.

Bellingcat's @koltai.bsky.social spoke to PBS News about non-consensual deepfake pornography and authorities' struggle to deal with them www.pbs.org/newshour/sho...

The DomainTools Investigations crew will be out at Sleuthcon this week, either kicking around the DomainTools table or roaming around the con looking to talk shop. Sleuthcon is one of our favorites. (Please don't seek us out for sales pitches, we have no available budget and it makes us sad.)

The thought that any of it has been actually evaluted from a security perspective is laughable.

Not even evals: every day I see a new internal email about "we have a new skill to do X" and virtually none of them have any indication that they've been tested or validated at all past the level of "I told I to solve one instance of this problem by hand and then packaged it as a 'skill'".

Remind me, was it Meta's AI safety executive that had an AI agent go rogue on their mailbox? Anyways, things are still going great over there.

I'm just a SecOps and Threats guy, not selling a damn thing, so whenever you talk about AI "democratizing" capabilities to an employee, I want you to keep in mind for me that short of herculean new spends and deliberate frameworks, it's without the dev, QA, monitoring, and responsibility offload.

Just so y'all know the state of play: Saw an interview on CNBC this morning fully playing up the "paid protestor" and "foreign influence" narratives around datacenter opposition. Expect that to vastly intensify.

That's me preparing the newsletter

I have no idea what this is from but it instantly became my go-to gif for explaining the security profession today.

A reminder: always strive to set not just clear expectations but also clear boundaries from the beginning, including ones that protect yourself. No one else will set those self-protective boundaries for you.

‼️🚨 BREAKING: Kash Patel's apparel website is reportedly hosting ClickFix malware, according to multiple visitors. A fake Cloudflare verification page is tricking users into pasting "verification" commands that execute an infostealer targeting Keychain, browser data, tokens, and crypto wallets.

Imagine being stressed out about life and the state of the world and then you walk outside to clear your head and see this

I wonder how long it’s going to be until we see calls from tech industry trade groups to directly subsidize token costs on an ongoing basis “for the good of the productive taxpayer.”

"so let me get this straight microsoft defender, the built-in antivirus tool for windows has a heap based buffer overflow that leads to remote code execution if you get it to scan a file, and that file is crafted the right way." mastodon.social/@Viss/116609...

Knostic doing the community a solid by providing the ability to scan VScode extensions, skills, and more. Directly relevant to recent breaches, including one developing at github. (1/2)

elsewhere, a commenter: 'Maybe someday we will have a notion of a “prompt sandbox” like a malware sandbox' me: "That's us, friend. We're the sandbox."

kind of letting the autism take the wheel this week, which is a little dangerous, but the feral freedom of it is giving me a little life.

Low-confidence prediction for later this year: -Anthropic pulls back, takes a big writedown, delays IPO. -OpenAI tries to pivot to SPAC instead, because it can't reconcile the numbers or delay further.

Me: running around excitedly shouting "IT'S DBIR DAY! IT'S DBIR DAY! EVERYONE, IT'S DBIR DAY!" www.verizon.com/business/res...

Bitcoin Depot, the US' largest crypto ATM operator, is shutting down citing anti-fraud measures it had to roll out ...and now you know why these things existed in the first place www.globenewswire.com/news-release...

Musk v. Altman / OpenAI Advisory jury and Judge have both decided in favor of OpenAI, Musk's case has been dismissed.

Glad to see Grafana refuse to pay the ransom.

Three Buddy Problem is probably my favorite infosec podcast, and if you're adjacent to AI stuff the latest episode is really good. Grounded, practical takes informed by actual use, as well as larger considerations. securityconversations.fireside.fm/10x-ai-power...

:whispers: curses are a kind of magic

remember when the 21st century was supposed to be magical and full of wonder

So with respect to this CNN report that @taggart-tech.com just popped in our @ifin-intel.org Iran Activity Thread, we had clear intelligence as early as 2021 that this was coming. lite.cnn.com/2026/05/15/p...