Have the censored 60 Minutes CECOT story. Adjusted image for better viewing. Rendering now, will upload soon. h/t @jasonparis.bsky.social

Holy crap

I don’t ever want to hear anyone say “the raids aren't as bad.” this is the last 2 days. lataco.com/daily-memo-d...

This writeup of a sophisticated JS malware payload is excellent—and so is the analysis tool they built to crack it (and similar malware). research.checkpoint.... github.com/CheckPoin...

It's rad how there are no contenders in the website scan/screenshot tool space to unseat the now-archived GOAT: Aquatone.

It's done. I can't believe it's finally done. I've been working on this in mostly secret for so long, and I'm so excited to share it with y'all!

It's done. I can't believe it's finally done. I've been working on this in mostly secret for so long, and I'm so excited to share it with y'all!

God damn it

You deserve each other.

Wowzers, another perfect 10 from Cisco on Secure Email Gateway, Secure Mail, and Web Manager. This one has: - RCE - No patch - No workaround - No public IoCs Recommendation is to reimage to a known-good config. Whatever that is, without indicators. Good luck I guess??

This is super good news: Docker Hardened Images are now available for free for all devs. These can form a much more secure baseline of your containerized apps.

Writing browser extensions sucks.

I don't have any energy to give to a new Mozilla CEO announcement so I'm just gonna point you here, which still holds true.

> In large scale experiments, we found that over 90% of the time, visitors to a parked domain would be directed to illegal content, scams, scareware and anti-virus software subscriptions, or malware...

Enjoy this blessed time, all

Enjoy this blessed time, all

It has always been thus, but especially in the age of questionable search results and hallucinated answers from machines: taking the time to read the primary sources is like granting yourself a superpower.

It is actually worse now.

Yeesh, temperature inversion in full effect in the LA basin this morning. Maybe limit time outside/wear a mask until this clears out.

This announcement left a literal bitter taste in my mouth. openai.com/index/age...

I would like to amend the scrivener's error on my college transcript. It erroneously did not report my GPA as 4.0. I now correct this error and retroactively accept the Summa Cum Laude honor.

How much of the justification for SaaS really boils down to "We have no idea how to administer Linux systems and we can't be bothered to hire anyone who can?"

You may be tempted to think of prompt injection attacks against language models as "social engineering." Resist this temptation. Prompt injection is a mathematical attack against a non-deterministic system. Language may be the substrate, but the substance is numerical vectors.

"The time has come to decenter book reading and essay writing as the pinnacles of English language arts education." The idea that we must replace reading and writing with "multimedia" anything is yet another symptom of education surrendering to industry. ncte.org/statement/me...

"The time has come to decenter book reading and essay writing as the pinnacles of English language arts education." ncte.org/statement/me...

Last week I announced that we're finally killing off RC4 in the Windows Kerberos stack. This has been a long time coming, so much so that we've been working on it for more than a decade, albeit off and on as we sometimes had to target other more pressing issues. What does this mean?

You may be tempted to think of prompt injection attacks against language models as "social engineering." Resist this temptation. Prompt injection is a mathematical attack against a non-deterministic system. Language may be the substrate, but the substance is numerical vectors.

This is fun. True randomness achieved by measuring the outputs of a quantum experiment operating at NIST in Boulder!

“I am so bored by AI. One of the things I love about the theatre is AI can’t do it.” Ethan Hawke is a dude 👌🏻

Not sure if this is public info, but the Penn Oracle data breach definitely involved SSNs and banking info. If you ever interacted with Penn financially, probably best to watch those accounts.

We should be clear about this update to Microsoft's PowerShell 5.1 implementation of `Invoke-Webrequest`. And I think the BleepingComputer headline is a tad misleading. Lemme explain.

I was unaware we were concerned about accidentally creating a new race of super-intelligent pigs, and that's why we can't grow organs in animals.

They took the sky from you.

♥️ “ICE looked at that school, saw a community standing up for families, and decided it wasn’t worth it.”

For those trying to determine React2Shell exposure: a reminder that Nuclei exists and this is the perfect use case. docs.projectdiscover... Test is in the templates repo: github.com/projectdi...

This is cursed

Need a jailbreak? Just add `=coffee`. This research shows that careful analysis of model training data reveals token sequence that can flip attack detection. Good lord this technology is goofy.

Need a jailbreak? Just add `=coffee`. This research shows that careful analysis of model training data reveals token sequence that can flip attack detection. Good lord this technology is goofy.

Guild Wars: Reforged is out so reality can hit da bricks for a while. I'm indulging in heavy nostalgia tonight.

This looks rad as hell

Got to be the Dad with bungee cords and a Leatherman who fixed stuff at a school event. Hell yeah

Once again in the phase of a project where I simply need to finish in order to free my brain

Oh so you want to burn it all down, but you also hate JavaScript, which is clearly excellent at burning it all down. Interesting!

To be clear, there are *no* public PoCs of yesterday's React vulnerability (CVE-2025-55182). The one that was being claimed as a POC has been outed as slop. Indeed, they even renamed the repo.

Just published a new minor version of The Homelab Almanac. I migrated to mdbook for creation of the website version, and some improved pandocery for the PDF/EPUB. As always, new versions of the book are available for free to those who have already purchased.

You know what? I'm not getting into a fight about how big a deal the React vuln is. The footprint is bigger than you think because the correlation is difficult to ascertain, but Next.js alone is a monster. And this is in an ecosystem that is not particularly used to this kind of vulnerability.

No more Crucial SSDs: investors.micron.com...

I'm not kidding; this is a really bad one.

Very cool to see vindication that my research from three years ago was on point. arstechnica.com/secu... My receipts: github.com/uclahs-se...

RCE in React Server Components, impacting React and Next.js. I usually don't say this, but patch right freakin' now. The React CVE listing (CVE-2025-55182) is a perfect 10. www.wiz.io/blog/crit... react.dev/blog/2025/... nextjs.org/blog/CVE-...