Vulnerability Research Isn’t Cooked; It’s Burned Beyond Recognition - jericho.blog/2026/04/06/v...

We Are Legion (We Are Bobservations); Answering a “Simple” Question In late February, a friend linked an article about a science-fiction book and asked if I had read it. I told her that I hadn't but after reading an abstract it sounded good. She asked if I would be her designated reader due to her…

Wait… We Needed That CNA Rule?! A Complaint =) It's one of those rules you'd never think we needed until something happens… On March 27, a VulnDB (not to be confused with VulDB) analyst noticed that a CVE description had a line appended that basically advertised the service of the assigning CNA.…

Miggo, KEV, and FUD; They Still Don’t Get It On November 18, 2025, Miggo published a report titled "Missing 88% of Exploits: Rethinking KEV in the AI Era". Their conclusion is that CISA's KEV is "missing" a significant number of vulnerabilities. However, that conclusion is based on a horrible…

NaClCON Talks I Am Excited For Earlier this month, I published "My Unofficial NaClCON FAQ" talking about a new security conference that I am excited for. It's still a bit surprising to myself that I am interested in one at all. I fully thought I was done with them, but here we are! After…

YouTube: I Don’t Think You Understand Your Userbase It's pretty rare that I use YouTube on a television, typically only if in the mood for specific music. Even then it tends to be a handful of videos as my 'go to'. Earlier this month I was in the mood for such a concert and loaded it. I am…

The Jericho Blog Graveyard (2016 – 2020) This is a continuing short run series of blogs summarizing old drafts and either declaring them dead, while listing them here, or keeping them as they are still relevant. Part 1 - The Jericho Blog Graveyard (2010 – 2013)Part 2 - The Jericho Blog Graveyard…

The Jericho Blog Graveyard (2014 – 2015) After my last blog on the draft graveyard, which was the first, I am down to 117 that go back to 2014. Twelve years is a bit too long to sit on a blog typically. So like before, here are ideas I had to write about but never did. 2014 - "Android Annoyances"…

Reason #42 Why InfoSec Has Failed Building on a prior post, with an admittedly arbitrary number that seems to be about right as far as the number of reasons, and more in this series coming in the future... This is a quick story to give readers an idea of just how bad our industry really is. This…

My Lego Build: The Revolt It started with an amusing meme of a Lego squirrel about to cut a park ranger. That 10x10 tiny build was the inspiration for a much bigger version of it, that kept expanding. Trying to recreate even the small version provided a challenge, going through BrickLinks to find…

My Pledge re: so-called AI and this Blog With the prevalence of so-called artificial intelligence (AI), the amount of people turning to it to the technology to help them write, or fully write, content is growing quickly. While it may be getting more difficult to detect assisted writing and…

Charity auction alert! NolaCon 2025 Badge & Stickers www.ebay.com/itm/26760512... #InfoSec #Hacker #BadgeLife #NolaCon

Charity auction up! 2019 ShmooCon Staff Badge w/ Lanyard www.ebay.com/itm/26760511... #ShmooCon #Hacker #InfoSec #Charity

Zero Day Clock – All The Pieces Matter Last week, a colleague shared a link to the "Zero Day Clock", a web site that has a substantial number of signatories, including some big names. I want to talk extensively about the clock because it makes at least one significant mistake and points out what…

Charity Auction! DEF CON 33 Human Badge w/ Lanyard www.ebay.com/itm/26760163...

Charity auction! Derbycon 5 (2015) Attendee Badge w/ Lanyard www.ebay.com/itm/26760161...

Charity auctions are back! Over the coming month or more, there will be a steady stream of InfoSec swag items, primarily con badges, with 100% of proceeds going to the charity of choice of the person who donated the item. First item coming up... #Charity #InfoSec

My Unofficial NaClCON FAQ As someone who has basically become disillusioned with most information security conferences, I didn't find myself to be excited about another, let alone a new one. Then along came NaClCON and it changed my mind. It was a matter of days before I volunteered to help with…

It’s 2026 and Netscout Doesn’t Understand CVE Every year I hold out hope that the security industry will better understand the Common Vulnerabilities and Exposures (CVE) system. A surprising number in this industry barely know about it, let alone any meaningful details. It's one thing for a random…

Domain Transfer Confirmation Email? No, It’s Not From ICANN. TL;DR: If you get an email from [email protected] saying you must click a link and input a code to finalize a domain transfer, ignore it. It claims to be an ICANN accredited registrar, but per ICANN themselves, the mail is…

NSA, Theft, and the Original Quantum Lazlo Back in November, 2009, Attrition.org staff (including me) finally got around to finalizing the name for our new mascot (archive.org), the angry squirrel firmly associated with Attrition and myself. In a cheeky letter from the mascot, it was signed…

Support Charity or Shatter Dreams A few days ago, a friend linked me to a contest that her daughter's art was entered in, where voting is done online. I'm sure we've seen this for a wide variety of things in our lives these days, so it is easy to miss some of the little details that render the…

Abert’s Squirrels and Wonderful Variations After moving from Denver to the nearby mountains, I was quite happy to learn that I had four different kinds of squirrels in the area. The Golden Mantle Ground Squirrel, Least Chipmunk, Douglas Pine Squirrel, and the Abert's Squirrel. The last is also…

Random Movie/TV Thoughts and Reviews (February 2026) Reviews One Battle After Another (2025) is the kind of movie, to me, that seems to have everything right; good acting, interesting plot, good character development. And yet somehow it just doesn't click for me. I understand why it would win an…

Bob’s “CVE Quality-by-Design Manifesto” – The Hit and Misses Almost every time Bob Lord blogs, I feel the need to write a rebuttal to what is arguably abject stupidity and shortsightedness. One he published a couple days ago, titled "CVE Quality-by-Design Manifesto", is missing several core…

Shadow, Ghost, and Phantasmawhatever Vulnerabilities – The Reality Back in September of 2024, I took some notes on a blog I wanted to write about "Shadow" vulnerabilities, based on a corporate blog with a poor concept and misunderstanding of CVE. The title was to be "Shadow Vulnerabilities -…

Vulnerability Disclosure Forensics: /cgi-bin/upload.cgi Yesterday, Chris Sullo of Nikto fame, asked me a simple question; in so many words, what was the "first web vuln". To be clear, he is asking about the first vulnerability in a web server / service / program. Seems relatively straight-forward…

Rest In Peace IBM X-Force Vulnerability Database Within the vulnerability ecosystem, the CVE project / vulnerability database is certainly the most well-known. Over the past 30 years many others have come and gone, and others are still around. Some of you will recognize SecurityFocus BID, Open…

Squirrel Goes Down the Rabbit Hole (Security Podcast) On November 17, I joined the three hosts of the Down the Security Rabbithole (DtSR) podcast to talk about CVSS, CVE, and how they play into risk and defending networks. My time followed Robert "RSnake" Hansen's podcast where he had a pretty…

Stickers from @attrition.org Time to start a new layer of stickers on my laptop. 😎

Charity listing up! DEF CON 33 Human Badge w/ Lanyard [NEW] www.ebay.com/itm/26741144... #DEFCON #DEFCON33

Leave AI Slop out of CVE; Humans Make Mistakes Just Fine I was recently asked, again, if so-called AI could help CVE. My reply was quick and direct; no. At least, not right now, and to me not for the immediate foreseeable future. Anyone that knows me is probably aware of my disdain for so-called…

Charity Auction Up! DEF CON 33 AI Jack Badge by TechNick ebay.com/itm/26738131... #DEFCON #DEFCON33 #BADGELIFE

2025 BSidesLV CVE Panel – My Comments This year at BSides Las Vegas, a panel discussing the CVE program and crisis occurred. I watched the panel discussion after the fact, since I did not attend. For full transparency, something MITRE isn't fond of, I almost attended as a keynote speaker on the…

Charity Auction! Three (3) BlackHat Briefings USA Badges (2015/2016/2018) www.ebay.com/itm/26734175... #BlackHat #BlackHatBriefings #BlackHatUSA #Hacker #InfoSec

Charity Auction! BSides Las Vegas 2019 Participant Badge www.ebay.com/itm/26734174... #Hacker #InfoSec #BSides #BsidesLV

Charity Auction! BSides Las Vegas 2017 Participant Badge www.ebay.com/itm/26734174... #Hacker #InfoSec #BSides #BsidesLV

Charity Auction! BSides Las Vegas 2014 Rock Badge (Supporter) www.ebay.com/itm/26734174... #Hacker #InfoSec #BSides #BsidesLV

Charity Auction! BSides Las Vegas 2014 Participant Badge www.ebay.com/itm/26734174... #Hacker #InfoSec #BSides #BSidesLV

So far, thanks to DaKahuna and his badge donations, we have raised $705.28 for the American Heart Association! There are already more badges listed, with more BSdidesLV and BlackHat badges coming this week. After summer camp, there will be more from other cons.

Charity Auction! BSides Las Vegas 2018 Participant Badge www.ebay.com/itm/26733926... #Hacker #BsidesLV #Bsides #InfoSec #LasVegas

Charity Auction! BSides Las Vegas 2014 Speaker Badge w/ Pangaea Social Engineering Contest Badge www.ebay.com/itm/26733925... #Hacker #BSidesLV #BSides #SocialEngineering #LasVegas

Charity Auction! BSides Las Vegas 2022 Participant Badge w/ 303 Bling Badge www.ebay.com/itm/26733924... #BSidesLV #Bsides #Hacker #InfoSec #303

Charity Auction! BSides Las Vegas 2010 Badge www.ebay.com/itm/26733921... #BSidesLV #BSides #Hacker #InfoSec

Charity Auction! DEFCON Skytalks Enforcer Badge w/ Hacker www.ebay.com/itm/26733920... #HACKER #INFOSEC #DEFCON #SKYTALKS

Charity Auction! DEFCON Skytalks Enforcer Badge w/ Android Thingy ebay.com/itm/26733920... #DEFCON #SKYTALKS #HACKER #INFOSEC

Miggo Security’s AI Slop & Potential Trademark Infringement jericho.blog/2025/07/21/m...

There are -16- badges from or related to DEFCON up for charity auction! 100% of proceeds go to the American Heart Association =) Some of the auctions are ending today. www.ebay.com/sch/i.html?i... #DEFCON #INFOSEC #SECURITY #SKYTALKS #MONERO

Charity Auction! 2019 DEFCON 27 Monero Badge www.ebay.com/itm/26732978... #DEFCON #MONERO #CRYPTOCURRENCY

Charity Auction! 2019 DEFCON 27 Skytalks Enforcer Badge www.ebay.com/itm/26732977... #DEFCON #SKYTALKS #HACKER #INFOSEC