CISA KEV’s Revolving Door Some time ago, perhaps last year or two years ago during VulnCon, I made an offhand comment about Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerability (KEV) catalog and how there were more than one vulnerability that had appeared in it…

VDBs: Pedantic Nuances on Version Tracking I am all about the pedantic nature of running a vulnerability database (VDB). It's the backbone of running one well as "simply aggregating vulnerability information" is anything but simple. I've been outspoken on the issue of perceived simplicity for at…

Nature Finds a Way After moving into the mountains a few years ago I found myself being more aware of nature's diversity. I would imagine a lot of people, especially in Colorado, think they are aware and in tune with nature and I am sure many are. But going from city life to mountain life will…

YouTube’s Thumbnail Generation Fraud In what I can only assume is part of the ever-growing world of AI enshitification, I began noticing an odd thing when watching videos on YouTube. When viewing content there is the primary screen with the video you are watching and on the right is a column with…

F5 Contributes to KEV Confusion F5 is a technology vendor that sells a variety of networking technology including security products. With a considerable security portfolio and long tenure in the industry they are well positioned to observe known exploited vulnerabilities (KEV). Their staff…

We’re Losing the “Cyber” War to Ourselves It's hard to pinpoint where the concept of cyberwar originated. In roundabout ways it likely goes back many decades in fiction. As far as citations go, some believe a seminal work is titled Unrestricted Warfare by Qiao Liang and Wang Xiangsui, two colonels…

And AI Tech Bros Still Want to Gamble… If you follow even the headlines for so-called "AI" developments, you may have caught a few that talked about how some AI insiders say there is a chance that the technology they are developing will "destroy humanity". Of course, that term is subjective and…

Save the Earth One Napkin at a Time Over the years I have certainly thought about the concept "healing by a thousand bandaids", as a counter idiom to "death by a thousand cuts", while not writing as much about it. I have blog notes for various things in the spirit of this and have used it…

The Loquacious Introvert This is my 1,000th post on this blog! Not counting this post, that is 893,353 words written here over 38 years. Of course, this blog hasn't been around that long but I made an effort the last few years to consolidate all of my writing in one place and date it accordingly.…

2026 East Coast Drive (Part 8: Random Notes) The final post in my series on the recent East coast drive through five states has broader observations and thoughts. With over two thousand miles of driving it gives you plenty of time to think and observe. In no particular order… Professional Driver…

Captain Obvious Audits the NVD During my recent trip to the East Coast several people linked an article from Recorded Future to me since it was on a topic I have written extensively about. The article covered a May 26 report from the Office of the Inspector General (OIG) at the Department of…

2026 East Coast Drive (Part 3: VA / DC) June 5 (Friday) From Richland, Virginia it was time to head North toward Washington D.C. The day was primarily stopping at a few towns to check out stores and drive through the areas to get a feel for them. I had driven through this area in 2022 as part of…

2026 East Coast Drive (Part 2: North Carolina / Virginia) June 3 (Wednesday) After the convention I drove back to Wilmington, North Carolina to check out a few shops and grab lunch along the river. The old downtown area is nice to walk and has a lot to see including art and a battleship. Being…

2026 East Coast Drive (Part 1: NaClCON) Pre-game For the first half of June I attended NaClCON and then drove through five states and the District of Columbia. The trip began with a rare flight that required a layover as Wilmington, North Carolina is a small regional airport. That put me through…

My Quest for the White Squirrel! I recently attended NaClCON in Carolina Beach, North Carolina. After the con concluded I took a drive through North Carolina, Virginia, Washington D.C., West Virginia, Kentucky, Tennessee, and back through North Carolina to fly out. Between June 3rd and June 12th I…

Colorado Voting System Irregularities & Continued Rigging Earlier this year I wrote about how the Colorado voting system is effectively "rigged" to enforce a two-party system. In that I said "In Colorado, if you are not registered with political affiliation, you are given two ballots; one Democrat…

I just realized that I'm personally "credited" in April's Microsoft Patch Tuesday with a CVE-less "Defense-in-depth" update. The vulnerability? CAB files downloaded from the internet do not write the MotW for files extracted from them. I reported this to […] [Original post on infosec.exchange]

@f5labs.bsky.social re: www.f5.com/labs/article... Are you using "AI" to do these? e.g. "Threat Details and IOCs" and "CVE-2026-35273, CVE-2026-46695, CVE-2026-46703, CVE-2026-48558, CVE-2026-50545" has nothing to do with the section above, and those CVEs are largely not for the software listed.

MSRC; Tell The Whole Story Please Every so often, it seems that Microsoft Security Response Center (MSRC) likes to stick their proverbial foot in their mouth on the topic of vulnerability disclosure. The root issue is that collectively, MSRC does not seem to appreciate either their own history or…

Mythos Needs to Shift Left Over the years I have been part of many discussions around a classic debate around red team versus blue team, the value of penetration testing, and the value they each bring. I started my InfoSec career in 1996 doing pentesting (aka red teaming) a couple years before it…

Vulnerability Embargos Are Dead Introduction When a researcher finds a security vulnerability that impacts more than one vendor, and they wish to coordinate disclosure with both, it creates a situation where an embargo must be put in place. In this context that simply means that all three parties…

Calif’s Bold Claims; Missing Receipts Here we go again, more Mythos rumors and claims to unpack. I wrote a lengthy blog on Anthropic, Glasswing, and Mythos just over a month ago but this is about a very specific event and set of claims. A significant reason I am writing this is due to what I…

Noise2Signal Podcast: Which Does the Squirrel Bring? For those not familiar, Mehul Revankar recently started a podcast named Noise2Signal. While there are a lot of podcasts out there and it is easy to lose track, this one stands out as Mehul has connections with a lot of folks that are significant…

Amazon Auto-buy: A Slick New Feature For half a year now, I have been using a third-party site (Keepa) to track movie prices on Amazon (and a few other sites), waiting for them to drop to the price I will pay. New movies are often released on physical media at fairly absurd rates. Almost fifty…

Security vs Security Theatre; A Lesson for Abbott Security theater, as defined by Wikipedia, "is the practice of implementing security measures that are considered to provide the feeling of improved security while doing little or nothing to achieve it." This is a common term used by information…

The NVD Shell Game & Schrödinger’s Enriched Vulnerability I know, yet another blog about the National Vulnerability Database's (NVD) ever-changing numbers?! That's right, and I am not talking about the changes between April 14 and 15th. The numbers changed significantly because of the way NVD…

The Night I Almost Died I write a lot. Most recently it has been about information security, movie reviews, so-called AI, and a few other topics. It's been four years since I blogged about my poor experience with Abbott's Libre2 glucose sensor technology and all the shortcomings. Since then I have…

Starfleet Academy; The Review Starfleet Academy (SA), the latest TV show in the Star Trek line, debuted this year with a lot of fanfare and a fair share of drama. The show almost immediately hit the news with cries of it being "too woke". The Washington Times headline called it a "woke culture war…

Why Data From So Many Breaches Never Sees the Light of Day Months ago I was chatting with a colleague about a recent data leak (a.k.a. Data breach), as we tend to do in this industry. Those terms are defined by Microsoft as "an unauthorized disclosure of sensitive, confidential, or personal…

InfoSec News (ISN) Mail List History As early as 1996, I created a mail list called InfoSec News (ISN) which initially was to share news about the industry. At the time, there were no online news sites covering the topic with any regularity and most were hobbies at best. So the original list had…

An AI agent destroyed … hey wait a minute! Yesterday many people ran across a headline that was shocking, and repetitive. This time it read "‘Gone in 9 seconds’: Claude-powered AI agent deletes startup’s entire database". For myself, the first thing I had to do was check the date of the article…

Don’t Call Me Boss I don't remember when it started but it was easily five to ten years ago. I'd be in a restaurant typically and a server or cashier would call me 'boss'. It bothered me from day one because it usually came from a younger kid who presumably didn't understand all of the…

Security Software: Holding the Vault Door Open for Criminals I have been consistently tracking a fun metric around vulnerabilities since March 19, 2024. Before that I would occasionally mention it during talks or chat, but I don't think I formally blogged about it before this and didn't track the…

Another Wave of Random Thoughts ATM ATMs have way too many options for many users, and definitely for most uses of the machines by volume. Sometimes, when I put my card in, why are you asking what language I want to use? The same one as last time maybe? And for someone who has the same exact…

Attending NaClCON (naclcon.com) in May/June? Even if not attending... do you have any -old- neat hacker/phreaker swag you can donate? During the closing ceremony, I am looking to do quick live-auction bidding for charity for them! This is my donation to the cause!

NVD Gives Up Since 2024, representatives from NIST's National Vulnerability Database (NVD) have given a presentation at VulnCon with updates to the program. This has been where news broke about significant changes, admissions, and omissions. The talks, typically 30 minutes, are certainly not…

WHO DID THIS!?!? 🤪😅🤣 #VulnCon2026 #VulnCon26

Anthropic, Mythos, and the Dark Reality No One Is Talking About If I had a nickel for every time Anthropic's new Project Glasswing / Mythos initiative came up in conversation or I was asked directly about it in the last few days, I would have a shit ton of nickels! Let's dive into it… first with…

Vulnerability Research Isn’t Cooked; It’s Burned Beyond Recognition - jericho.blog/2026/04/06/v...

We Are Legion (We Are Bobservations); Answering a “Simple” Question In late February, a friend linked an article about a science-fiction book and asked if I had read it. I told her that I hadn't but after reading an abstract it sounded good. She asked if I would be her designated reader due to her…

Wait… We Needed That CNA Rule?! A Complaint =) It's one of those rules you'd never think we needed until something happens… On March 27, a VulnDB (not to be confused with VulDB) analyst noticed that a CVE description had a line appended that basically advertised the service of the assigning CNA.…

Miggo, KEV, and FUD; They Still Don’t Get It On November 18, 2025, Miggo published a report titled "Missing 88% of Exploits: Rethinking KEV in the AI Era". Their conclusion is that CISA's KEV is "missing" a significant number of vulnerabilities. However, that conclusion is based on a horrible…

NaClCON Talks I Am Excited For Earlier this month, I published "My Unofficial NaClCON FAQ" talking about a new security conference that I am excited for. It's still a bit surprising to myself that I am interested in one at all. I fully thought I was done with them, but here we are! After…

YouTube: I Don’t Think You Understand Your Userbase It's pretty rare that I use YouTube on a television, typically only if in the mood for specific music. Even then it tends to be a handful of videos as my 'go to'. Earlier this month I was in the mood for such a concert and loaded it. I am…

The Jericho Blog Graveyard (2016 – 2020) This is a continuing short run series of blogs summarizing old drafts and either declaring them dead, while listing them here, or keeping them as they are still relevant. Part 1 - The Jericho Blog Graveyard (2010 – 2013)Part 2 - The Jericho Blog Graveyard…

The Jericho Blog Graveyard (2014 – 2015) After my last blog on the draft graveyard, which was the first, I am down to 117 that go back to 2014. Twelve years is a bit too long to sit on a blog typically. So like before, here are ideas I had to write about but never did. 2014 - "Android Annoyances"…

Reason #42 Why InfoSec Has Failed Building on a prior post, with an admittedly arbitrary number that seems to be about right as far as the number of reasons, and more in this series coming in the future... This is a quick story to give readers an idea of just how bad our industry really is. This…

My Lego Build: The Revolt It started with an amusing meme of a Lego squirrel about to cut a park ranger. That 10x10 tiny build was the inspiration for a much bigger version of it, that kept expanding. Trying to recreate even the small version provided a challenge, going through BrickLinks to find…

My Pledge re: so-called AI and this Blog With the prevalence of so-called artificial intelligence (AI), the amount of people turning to it to the technology to help them write, or fully write, content is growing quickly. While it may be getting more difficult to detect assisted writing and…

Charity auction alert! NolaCon 2025 Badge & Stickers www.ebay.com/itm/26760512... #InfoSec #Hacker #BadgeLife #NolaCon