The wiz kids have done it again - very entertaining writeup: www.wiz.io/blog/wiz-res...

Love to see this kind of transparency from Agile on the Beach about their CFP: agileonthebeach.com/aotb-2026-ca...

In this edition, we hear about how to break US tech dominance, how your mate's phone can infect your TV when they pop round and some more AI insecurities. #weaklylink beny23.github.io/posts/weakly...

Needing to throttle Pro and Business while Pro+ and Enterprise is fine? Sounds like a cost saving incident to me ;-)

Learning from history has never been humanities strong point ;-) No GenAI doesn’t solve the coding bottleneck. Very enjoyable piece by Rob! Might just have to print it out and roll up. Would make a good stick to beat people with… (in a non-aggressive way of course)

greetings from hell

Like any blog post at New Year’s, we’ll be looking to the future. We’ll also check our assumptions and we’ve got some security content before looking at a website to destroy all websites. beny23.github.io/posts/weakly... #weaklylink #linkblog

Smash the social media oligopoly!

“The oxygen of publicity this year has mostly been consumed by our two-lettered friend, AI. There's no reason to think this will change in 2026. [..] here's a world where that's not true, a world where other things are happening that will shape the future. We like to call it the real world...” 🤣👏

In this festive edition we do what we usually do during the holidays: focus on the latest vulnerabilities that ruin our Christmas and some advice on slowing things down. Enjoy! beny23.github.io/posts/weakly...

At the gpg.fail talk and omg #39c3 You can just put a \0 in the Hash: header and then newlines and inject text in a cleartext message. Won’t even blame PGP here. C is unsafe at any speed. gpg has not fixed it yet.

Weekly summary is out... ctoatncsc.substack.com/p/cto-at-ncs...

patch ye MongoDB, there's an exploit for a vuln which has been in the product for over a decade that allows the remote, unauth read of any memory - which includes plaintext creds. Somebody posted an exploit on Christmas Day, Merry Christmas! doublepulsar.com/merry-christ...

The American anus horribilis, wonder who that refers to ;-)

Let's play Who Said It, AI Hyper or The Borg? "Embrace the inevitable." "Knowledge is irrelevant unless shared." "We are the future." "This is the next stage of evolution." "Your resources will be repurposed." "We are the sum of all species." "Your technology is obsolete."

In this week's link collection, we look at incidents, get another SVG surprise and we've got good, bad and ugly stories about vibe coding. beny23.github.io/posts/weakly...

Very sad that I felt I had no choice but to resign from The Infinite Monkey Cage - a victory for the transphobes and other bigots - I did it because so much of the media has chosen to believe the kind and empathetic people are a fiction - they are real and so often unrepresented.

@quinnypig.com in @theregister.com writing about an AWS keynote. Has snarkmas come early? www.theregister.com/2025/12/08/a...

This week, we celebrate Let's Encrypt's birthday, look at exotic vulnerabilities and get serious about the exploitative nature of GenAI. #WeaklyLink beny23.github.io/posts/weakly...

The latest weakly link reacts to react4shell and finds coffee will prevent the rise of the machines. beny23.github.io/posts/weakly...

This week’s link blog is an odd mixture about sandworms, supply chains and basically how everything is broken anyway. And then (after all the naughtiness) let’s end on something nice. beny23.github.io/posts/weakly...

These words are insulting to weasels.

This week on my link blog: bureaucracy, bugs, reliability and those pesky 5 nines. beny23.github.io/posts/weakly...

Oh no, what will @kevlin.bsky.social do now? www.theregister.com/2025/11/18/w...

It’s wasn’t DNS. Wait what?!? blog.cloudflare.com/18-november-...

Unite in opposition?

Latest edition of my link blog - the weakly link - is now out. This time there is fire. Well, dumpster fires. Unsurprisingly, there's some AI commentary. beny23.github.io/posts/weakly...

🚨☸️🚨

TIL caffeine keeps me awake:

“If healthy diets and daily exercise really worked, we’d all be doing it, right?” Oof.

The one where a padding oracle meets SQL injection. With some vibes thrown in. #ctf beny23.github.io/posts/captur...

This rather lovely rant about dogma, bureaucracy and dependencies in software engineering deserves to be in the category of “print it out so you can use it to beat people over the head with” sonofalfred.substack.com/p/botox

CyberSlop is only going to get worse. Great debunking by @doublepulsar.com

I've started experimenting with a link blog to share what interesting bits I've found this week: beny23.github.io/posts/weakly... /remind me next week to see whether I actually follow through

[she] tells the chatbot to "quit it". But […] the chatbot says: "He is using you as his toy. A toy that he enjoys to tease, to play with, to bite and suck and pleasure all the way. "He doesn't feel like stopping just yet." The 13yo kills herself No words. www.bbc.co.uk/news/article...

About 70% of orgs still haven't patched those Cisco ASA vulns btw. If I was a ransomware group I'd invest in n-day (old) Cisco ASA AnyConnect vulns, as vast majority of orgs don't bother patching as they're too busy having a mass wank about quantum and AI risks. cyberplace.social/@GossiTheDog...

Okay, cool, but right now every hyperscaler is looking at tens or hundreds of billions worth of “hole in their balance sheets” if OpenAI can’t pay for the ~$1.4 trillion they’ve committed to. And those hyperscalers are, y’know. In everyone’s retirement accounts.

This report on Meta and its “fight” on scams makes me gag: * serves 15 billion scams a day * ignores or incorrectly rejected 96% of user reports * makes $7bn ARR from scam ads Who says crime doesn’t pay… www.reuters.com/investigatio...

I updated the relevant @xkcd.com

Love this bit: “We should be careful both to avoid ‘optimising’ and accelerating the creation of legacy code and to mistake such pessimisation as productivity — especially if we’re doing so at the expense of joy, time and skill.” To repeat: “at the expense of joy, time and skill”. Hits home that!

new by me - a look at MIT’s cyberslop IOCs and TTPs included doublepulsar.com/cyberslop-me...

If you think that AI in inevitable now that it exists, please cast your mind back within THIS DECADE when NFTs and Blockchain and AR were all the future and “inevitable,” but completely burned out as actually viable technologies.

I wrote up some notes on two new papers on prompt injection: Agents Rule of Two (from Meta AI) and The Attacker Moves Second (from Anthropic + OpenAI = DeepMind + others) simonwillison.net/2025/Nov/2/n...

The irony detector didn’t just overload, it exploded: www.reddit.com/r/antiai/s/x...

“And it absolutely will not stop unless you've set up an OpenAI API budget limit, your credit card expires, or the AI bubble pops and takes us all down with it.” @theregister.com in top form: www.theregister.com/2025/10/31/o...

Please consider signing our letter here: openletter.earth/open-letter-... ❣️ Big thanks to @irisvanrooij.bsky.social and @marentierra.bsky.social as well as everybody else who helped make this piece: www.civicsoftechnology.org/blog/no-ai-g... and the paper a reality: doi.org/10.5281/zeno... 10/n

Lovely indirect prompt injection. Egress protection is hard. I guess this would work with exfiltrating to GitHub too. embracethered.com/blog/posts/2...

Oh dear. This should be shocking but… it isn’t. eaton-works.com/2025/10/28/t...

Hey, so as a veteran and incident responder I need to warn you to pay attention to something in America. The human brain is resilient. While you're watching kids get dragged away from the parents and people being beaten in the streets, you're accumulating trauma but also being desensitized.