Anyone who has used AI agents to build a large application or scan a big codebase has probably run into this.

This is wild! www.bleepingcomputer.com/news/securit...

I vibe-coded a Discord-like app and will be using it with my friends. Nothing fancy, just something that works and fits how we communicate. I love building things for fun, Might open source it later.

I have been reading through the code that led to this finding. This is ART. issues.chromium.org/issues/45309...

Watch your notepad, it might be watching you too.

Did anyone thought of linking Mastadon to bluesky? Since people left twitter, they have been scattered around.

Red teaming becoming more difficult is largely the result of its own success. Repeated real-world operations have helped organizations understand attack patterns and improve their defensive capabilities.

I’ve been involved in a lot of discussions lately about MCP from a security perspective. This blog shows how data pollution can happen through tool calling: lnkd.in/dKB9psVU This is where the debate about the protocol starts. MCP is not secure by default.

I’ll be speaking at @blackhatevents.bsky.social MEA with Ziad Hamad. We’re sharing a project we’ve been building around using agentic AI in red team operations, deploying agents to watch the infra, detect when someone is trying to take it down, and alert the operator with actionable recommendations.

Had a great time at @defcon.bsky.social bahrain, me and Ziad delivered our lab at the @cloudvillage-dc.bsky.social. It's tough to get all these folks in one photo, but here we are: the founder of DEF CON and the Kerberoast guy and the founder of ics village in the same frame.

@defcon.bsky.social Bahrain was:

🧵I’ve been testing a lot of AI agents lately, and with every new release I see a new implementation. Tool calling isn't mature. Inputs passed to tools can be injected, and you can smuggle arguments depending on how the tool code is written.

Speaking at @defcon.bsky.social has been a goal for years. I was set for Vegas this year, last minute it didn’t happen. Kept going.

I have created this tool using Giskard for testing chatbots accessible by APIs, as it’s not natively supported, the tool works with HTTP and SSE stream. github.com/m19o/Giskard...

Weeding the Tradecraft Garden aff-wg.org/2025/10/13/w... Dynamic Function Resolution for PIC(?!?), rewriting x86 PIC to fix pointers, and a shared library concept for PICOs/PIC

There’s a common misconception about what it means to hack LLMs versus hacking AI systems. People often confuse the two. I’ve even heard arguments claiming that prompt injection isn’t a vulnerability, because "you’re not attacking the model itself"

If you stopped doing something just because someone told you “it’s hard”… That doesn’t mean it’s hard, it just means you don’t really know yourself yet. If you’re always waiting for someone to believe in you first, then you’re basically waiting for permission to believe in yourself.

Just landed in Vegas for @blackhatevents.bsky.social and @defcon.bsky.social! If you love coffee, we are friends

Who will be at DEFCON

Just wrapped up the 3rd edition of @bsidesabq.bsky.social one of my favorite times of the year, Cyber fam, great talks, laughs, coffee, and community. Proud to be a founding member.

If AI is going to kill all the entry level jobs that means it will kill the whole tech industry, enough of +5 experience for a junior! You feel the gap and i feel the gap and everyone else.

I wanted to know how people in the industry manage their sleep schedules specially who research and work on side projects

Living in Egypt right now

For anybody struggling out there, you are not alone.

Huh ..

There is always an opportunity but different approaches, for example: I see companies layoff but if you have a startup they will fund you/buy your services and maybe do a partnership. Guess what you will do the same thing as you were doing in your full time.

Some cool insights by @nullbind.bsky.social, thanks for sharing.

I saw someone today talking about the need for layoffs. Anyone who speaks like that shows a complete lack of empathy and is only thinking about themselves.

Never regretted standing up to defend my principles and swimming against the tide when something wasn’t right. I choose to live as a free man always ready to face the consequences of my decisions, rather than hide in the shadows.

As part of knowledge sharing journey, I'm excited to announce my joining to OWASP Cairo Chapter as a board member!

Today Ghibli is the victim, tomorrow will be someone else, after tomorrow it will be you.

🧵Opinions about AI are always biased. AI has made things easier. It’s now simple to start building a framework with a single prompt, saving a lot of time.

I think i need a long week away from the computer, My head can’t stop thinking about topics i want to dive in, i can’t see a blog without opening it and read. My brain cells are on fire now.

Last year, 90% of the domains I compromised were vulnerable to ADCS exploits. Still counting …. www.crowdstrike.com/en-us/blog/t...

If you're thinking about giving your first talk, just go for it! At @bsidesabq.bsky.social, we’re all about the community and delivering real value. Everyone starts somewhere, and that first step is always the hardest.

That’s a blog i wrote while ago for attacking AWS cloudtrail m19o.github.io/posts/Attack...

Grab your ticket!

The Blind Eagle APT group has compromised over 1,600 victims inside Colombian institutions and government agencies. The campaign took place in November & December of last year and used an exploit similar to a zero-day exploited by Russian hackers in Ukraine. research.checkpoint.com/2025/blind-e...

Disaster supply chain attack! Backdoor in tj-actions/changed-files repo. When CI/CD triggers it, your secrets are his too. Actions: 1. Use /uses: tj-actions\/changed-files@v/ to find it in your org 2. Rotate & revoke creds 3. Monitor CI/CD

I’m calling on all InfoSec Rockstars to join us in giving back to the community. Got a killer workshop idea? Reach out to me directly or swing by our website to submit your proposal. Let’s make waves together! The countdown to BSidesABQ is on.

[kubernetes] CVE-2025-1767: GitRepo Volume Inadvertent Local Repository Access

Hey there! I've been heavily involved with GraphQL and struggled with tracking functions when introspection is disabled. I developed a simple extension to extract all functions from Burp Suite's HTTP history. I'd appreciate your feedback and suggestions.

BLOG] MSRC CTF throwback, Phishing and LLMS how that works🤷‍♂️ The Challenge was tricking the email summarizer to send an email from the victim to email i control. Enjoy the read! m19o.github.io/posts/Phishi...

MlSecOps and DevSecOps have become just buzzwords that add more responsibilities without really focusing on achieving the best outcome in every phase of the pipeline—threat modeling, risk management, SCR, pentesting, etc.

Every hacker is sysadmin, developer, troubleshooter

I'm incredibly grateful to be part of organizing BSidesABQ for the third year!

🚨 Call for Papers: Security BSides Albuquerque 2025! 🚨 Are you ready to share your knowledge and insights with the cybersecurity community? We are excited to announce that the Call for Papers (CFP) for Security BSides Albuquerque 2025 is now OPEN! URL to Submit talk: sessionize.com/security-bsi...