Awful to see Jorgenson crash like that. Gutted for him, I hope it's not as bad as it looked. #AGR26

This paper represents a small but deeply impressive and genuinely important achievement by the much maligned British state in what is probably the most important global issue of our era. Hear me out ( 🧵) 1/ www.aisi.gov.uk/blog/our-eva...

I'm live with the @huntress.com folks for Tradecraft Tuesday on axios and DPRK if you want to hang out: events.zoom.us/ejl/AnrTlSR3...

WOUT!!

Ok on a serious note, it cannot be exaggerated how bad formalized Iranian control of the Strait is for the world. The entire global economy rests on an American guarantee of free commercial shipping. That guarantee is gone. We don’t know exactly what will happen but none of it will be good.

🚨 500+ malicious PRs. One campaign. Wiz Research traced 6 waves of prt-scan starting 3 weeks earlier. AI-powered, automated attacks exploiting pull_request_target. Low success rate—but real npm + cloud creds hit. Full story: www.wiz.io/blog/six-acc...

NEW: @wired.com has ID’d a number of the masked paramilitary agents in the exceedingly violent unit surrounding Greg Bovino that formed the leading edge of the invading force the federal government sent to Chicago last fall; @awinston.bsky.social and @regret.bsky.social have the story.

North Korea is good at supply-chain attacks: www.cnn.com/2026/03/31/p...

Do you like these pictures I took

🐺🐺🐺

Let’s go Huskies.

U.S. foreign policy has been captured by dorks obsessed with the movie 300 and the only way to fix it is to put in power dorks obsessed with the movie Master and Commander.

Our write-up of the LiteLLM supply chain compromise earlier today. Tactics remain the same (with a new exfil domain), but they keep coming.

Another One: KICS GitHub Action compromised by TeamPCP A few new TTPs here, will have more updates later today: www.wiz.io/blog/teampcp...

I keep seeing this framing like Bremmer's. It is wrong. Instead: 1. Iran was developing an ICBM when Khamenei imposed a 2,000-km range limit. 3. The programs shifted to space launch. 4. Khamenei lifted the restriction in October 2025 after the June attacks. 5. Now he's dead, and here we are.

💣Supply Chain attack affecting the Trivy scanner. 💣 Last night a malicious version (0.69.4) was published. This version steals credentials, cryptocurrency and keys from affected machines and installs a small python script for persistence. www.wiz.io/blog/trivy-c...

I’ve been critical of Iran’s pre-war deterrence practices, but this seems like a reasonable intra-war deterrence success.

Get your tickets (and CFPs) now! This conference is always a great time and you learn a lot.

Me in slack:

Pretty funny to work for an entity that can be abbreviated as BOFA and badly fall for a blatantly obvious trick

Kaspersky recently produced a podcast on Operation Triangulation, basically a story of the investigation Things that I haven't seen mentioned elsewhere: — Triangulation malware existed for >10 years — Some technical details similar to the Equation Group www.youtube.com/watch?v=j4pC...

A 1999 assessment by DoD OGC briefly mentions a draft treaty on information warfare that circulated on the Internet in 1995. Does anyone have any idea what it was or where on the Internet it could have been circulated? (Source: nsarchive.gwu.edu/document/214...)

reading "Bombing to Win" on the subway and shaking my head to show everyone I'm against bombing to win

I also have two affiliations with US universities in a similar situation, but it is somehow with the US Department of Defense.

While some cyber attacks from Iran might increase, keep in mind that many Iranian hackers face Internet shutdowns, instability caused by U.S./Israeli strikes, etc. So they won't be very active Note this from a recent F6 report on Persian ransomware www.f6.ru/blog/c77l-ra...

It's interesting how we keep seeing major publications getting reporting on successful high-stakes CIA operations and intelligence soon after they happen.

My take on Learning Resources v. Trump: the elephant in the room in Chadha and the legislative veto. fivepoints.mattglassman.net/p/the-court-...

You know who else posted a misleading video to "Enter Sandman"... www.justice.gov/archives/opa...

/remembers a LetsRun post that was similar /finds LetsRun post (www.letsrun.com/forum/flat_r...) /letsrun post was 21 years ago /crumbles into dust

I've been name checking Bombing to Win when we cover CNA in my Cyber Operations class for years, but now thanks to @sodrock.bsky.social , I can do it with a meme I don't fully understand.

SOS returns to Brussels on October 22, 2026! As the geopolitical landscape rifts, hybrid threats continue to adapt & evolve. We provide a forum for observers of state-aligned sabotage, espionage, and more to share research with an action-oriented community. Stay tuned for more announcements!

23 different Cinnamon Toast Crunch products in the thread now.

The US focused class of my and @hultquist.bsky.social "Global Cyber Operations" is on April 9, will we have a new cyber strategy to discuss by then? The race is on.

“We need not lose faith in the administrative state itself; we would do better to view it as having functioned with its hands tied tighter and tighter. But we are now starting, particularly in the climate and energy space, to hit real limits.” At @scientistsorg.bsky.social fas.org/publication/...

We have access to the data (could cross-check authenticity with a different leak we were able to obtain) and ran analysis on views counts to find out when the campaign seems to be effective (according to their own metrics) www.zdfheute.de/politik/russ...

New, by @lorenzofb.bsky.social: Google sent personal and financial data about a student and journalist, who attended a pro-Palestine protest in 2024, to ICE agents in response to an "administrative subpoena," which had not been approved by a judge.

A site tracking recent purges in the PLA vs purges at the Trump-Hegseth Pentagon purge-comparison.vercel.app

To the pen testers, red teamers, and IR folks out there: How often are you encountering vibe coding in your engagements? I'm curious whether and how often you're seeing vibe coded software leaving the door open to your clients' networks. @ me or DM me if you have thoughts.

100% endorse

I don't know why they need to make short AI films about the American Revolution when the perfect one was created 18 years ago www.youtube.com/watch?v=sbRo...

Hackers behind cyberattack against Poland electric grid in Dec disabled communication devices for at least 30 sites across a number of energy facilities in country. They rendered the devices - known as remote terminal units or RTUs - not only inoperable but also unrecoverable

New Publication Alert: It is my pleasure to share that my recent report – coauthored with Alexander Leslie and Taylor Grossman through the Center for Security, Innovation, and New Technology (CSINT) at American University – is now live. 1/8 www.au-csint.com/publications...

"stop pretending Jesus was crucified because he preached good vibes and personal growth"

#BREAKING #ESETresearch identified the wiper #DynoWiper used in an attempted disruptive cyberattack against the Polish energy sector on Dec 29, 2025. At this point, no successful disruption is known, but the malware’s design clearly indicates destructive intent. 1/5

Great work by Kim and ESET to get this story out there. The cyber threat has been off the front pages with everything else going on, but is still very real.

The Farmington

I wrote this right after the inauguration. "The Christian nationalism of today is entirely inconsistent with the religion of the Founders. Our founding fathers kneeled to no pope, and they kneeled to no king. That is because they were mostly Episcopalians." tompepinsky.com/2025/01/22/w...

“I have asked the clergy of the diocese to make sure their affairs are in order and they have written their wills.,not the time for statements. It is time to put our bodies between the powers of this world and the most vulnerable”. Rob Hirschfeld, Bishop of the Episcopal Diocese of New Hampshire