On my way to resign from a company that doesn’t accept my beard and wants me to shave it. HR literally told me that having a long beard is “bad hygiene”. This kind of mindset still exists in 2026. The irony? Next slide is always about inclusion and diversity.

Every now and then, an incident happens that reminds you the sharpest weapon a human has is the mind. Looking at this series of supply chain compromises, whether it is TeamPCP or the North Koreans, you cannot miss the frightening beauty of human intelligence.

Grok dropped the database?

Not the first supply chain attack but another lesson many still didn’t learn. And just to be clear, this is not about LiteLLM. Using a 3rd party doesn’t remove the responsibility from you. You are still accountable for what you build and how you secure it.

A backdoor in LiteLLM. futuresearch.ai/blog/litellm...

General-purpose agents are killing every offensive agents startup.

Excited to share my first contribution to @aivillage.bsky.social! While experimenting with @perplexitycomet.bsky.social and pursuing my curiosity in AI browsers, I uncovered some eye-opening findings. But the team didn't quite see it that way... 🤔 Enjoy the read! aivillage.org/generative-r...

I know many people will hate this opinion, but everything eventually becomes replaceable with technology. And those decisions are rarely made by technical people, they're made by business people.

It's "we over-hired now" now, not because of "intelligence tools"

This isn't just announcing layoffs. It's normalizing layoffs under the banner of AI efficiency. When a profitable company reduces headcount and connects it to intelligence tools and smaller teams, the implication goes beyond cost cutting.

I know it’s already the 7th of Ramadan, but in my opinion it’s never too late to say Ramadan Mubarak. Every year when Ramadan comes, I like to introduce people to what it actually is. Ramadan is the month where Muslims fast from sunrise to sunset.

Do we still consider running commercial LLMs on clients’ data a privacy violation, or did people just stop caring?

Another day.. Another AI shenanigans.

Anyone who has used AI agents to build a large application or scan a big codebase has probably run into this.

This is wild! www.bleepingcomputer.com/news/securit...

I vibe-coded a Discord-like app and will be using it with my friends. Nothing fancy, just something that works and fits how we communicate. I love building things for fun, Might open source it later.

I have been reading through the code that led to this finding. This is ART. issues.chromium.org/issues/45309...

Watch your notepad, it might be watching you too.

Did anyone thought of linking Mastadon to bluesky? Since people left twitter, they have been scattered around.

Red teaming becoming more difficult is largely the result of its own success. Repeated real-world operations have helped organizations understand attack patterns and improve their defensive capabilities.

I’ve been involved in a lot of discussions lately about MCP from a security perspective. This blog shows how data pollution can happen through tool calling: lnkd.in/dKB9psVU This is where the debate about the protocol starts. MCP is not secure by default.

I’ll be speaking at @blackhatevents.bsky.social MEA with Ziad Hamad. We’re sharing a project we’ve been building around using agentic AI in red team operations, deploying agents to watch the infra, detect when someone is trying to take it down, and alert the operator with actionable recommendations.

Had a great time at @defcon.bsky.social bahrain, me and Ziad delivered our lab at the @cloudvillage-dc.bsky.social. It's tough to get all these folks in one photo, but here we are: the founder of DEF CON and the Kerberoast guy and the founder of ics village in the same frame.

@defcon.bsky.social Bahrain was:

🧵I’ve been testing a lot of AI agents lately, and with every new release I see a new implementation. Tool calling isn't mature. Inputs passed to tools can be injected, and you can smuggle arguments depending on how the tool code is written.

Speaking at @defcon.bsky.social has been a goal for years. I was set for Vegas this year, last minute it didn’t happen. Kept going.

I have created this tool using Giskard for testing chatbots accessible by APIs, as it’s not natively supported, the tool works with HTTP and SSE stream. github.com/m19o/Giskard...

Weeding the Tradecraft Garden aff-wg.org/2025/10/13/w... Dynamic Function Resolution for PIC(?!?), rewriting x86 PIC to fix pointers, and a shared library concept for PICOs/PIC

There’s a common misconception about what it means to hack LLMs versus hacking AI systems. People often confuse the two. I’ve even heard arguments claiming that prompt injection isn’t a vulnerability, because "you’re not attacking the model itself"

If you stopped doing something just because someone told you “it’s hard”… That doesn’t mean it’s hard, it just means you don’t really know yourself yet. If you’re always waiting for someone to believe in you first, then you’re basically waiting for permission to believe in yourself.

Just landed in Vegas for @blackhatevents.bsky.social and @defcon.bsky.social! If you love coffee, we are friends

Who will be at DEFCON

Just wrapped up the 3rd edition of @bsidesabq.bsky.social one of my favorite times of the year, Cyber fam, great talks, laughs, coffee, and community. Proud to be a founding member.

If AI is going to kill all the entry level jobs that means it will kill the whole tech industry, enough of +5 experience for a junior! You feel the gap and i feel the gap and everyone else.

I wanted to know how people in the industry manage their sleep schedules specially who research and work on side projects

Living in Egypt right now

For anybody struggling out there, you are not alone.

Huh ..

There is always an opportunity but different approaches, for example: I see companies layoff but if you have a startup they will fund you/buy your services and maybe do a partnership. Guess what you will do the same thing as you were doing in your full time.

Some cool insights by @nullbind.bsky.social, thanks for sharing.

I saw someone today talking about the need for layoffs. Anyone who speaks like that shows a complete lack of empathy and is only thinking about themselves.

Never regretted standing up to defend my principles and swimming against the tide when something wasn’t right. I choose to live as a free man always ready to face the consequences of my decisions, rather than hide in the shadows.

As part of knowledge sharing journey, I'm excited to announce my joining to OWASP Cairo Chapter as a board member!

Today Ghibli is the victim, tomorrow will be someone else, after tomorrow it will be you.

🧵Opinions about AI are always biased. AI has made things easier. It’s now simple to start building a framework with a single prompt, saving a lot of time.

I think i need a long week away from the computer, My head can’t stop thinking about topics i want to dive in, i can’t see a blog without opening it and read. My brain cells are on fire now.

Last year, 90% of the domains I compromised were vulnerable to ADCS exploits. Still counting …. www.crowdstrike.com/en-us/blog/t...