Does anyone know if Google is going to restart the Root Cause Analyses of 0day exploits that are used in the wild? googleprojectzero.github.io/0days-in-the... I see that the spreadsheet is still being kept up to date: docs.google.com/spreadsheets...

Alexandra Djokic (Serbian, b.1970) "Underwater," 2023 Acrylic on paper 150 x 100 cm #art #painting #artist #BlueSkyArt

In my latest post, I ponder whether Project Glasswing is just a private freemium tier, designed to hook the world’s largest software makers into fueling an endless token bonfire. open.substack.com/pub/defender...

More of my thoughts on the public vulnerability disclosure fight Microsoft picked with the researcher Nightmare Eclipse in this piece by @mattkapko.com for @cyberscoop.bsky.social . @andrewmorr.is of @greynoise.io Intelligence shares perspective too. cyberscoop.com/microsoft-co...

Trying to keep up with the developments in the AI- vulnerability space? 240 references, several announcements, academic papers, one executive order, two European Parliament hearings and more. tzafaar.codeberg.page

I wrote about the big new House AI regulation bill's cybersecurity provisions, including a reauthorization of a marquee information-sharing law: www.cybersecuritydive.com/news/house-a...

Life changing #booksky

Watch full interview youtu.be/u6UTfehEM_I?...

Perri Adams, creator of the AI Cyber Challenge, on the value of security-focused AI models

The best segue ever? 🏆 "Speaking of holy war and medieval things — Microsoft took us back to the 2000s with a statement that they're going to bring cases against vulnerability researchers who drop zero-days."

This morning 19 May, 09:30 CET Debate in the plenary session of the European Parliament on "EU cybersecurity and preparedness in view of advanced AI systems" www.europarl.europa.eu/plenary/en/h...

Move over, Mythos: Open-source AI systems have been finding serious bugs in critical software for months. I wrote about how a recent DARPA challenge sparked a sea change in AI's bug-finding power, and how it could especially help critical infrastructure. www.cybersecuritydive.com/news/ai-vuln...

Now with RSS and JSON feeds! I am collecting material, sources on LLMs and vulns before and after the recent mythical moment in time. The (searchable) list is here: tzafaar.codeberg.page let me know if your favourite source, paper, blog post is missing.

I am collecting material, sources on LLMs and vulns before and after the recent mythical moment in time. The (searchable) list is here: tzafaar.codeberg.page Take a look and let me know if your favourite source, paper, blog post, repo is missing or submit pr here: codeberg.org/tzafaar/page...

Alternative ALT text: Lone OSS maintainer riding the vulnerability wave. Downstream users cheering them on from a distance.

Our weekly Friday radio show is live everywhere! #threebuddyproblem - YouTube youtu.be/SL5N3Zd6vNI?... - Apple podcasts.apple.com/us/podcast/t... - Spotify (with video) open.spotify.com/episode/6aoL... - Transcript docs.google.com/document/d/1...

The Trump administration is grappling with whether to give U.S. intelligence agencies a bigger role in AI regulation, Russian firm Bureau 1440 has begun launching the country's answer to Starlink, and more in this week's Seriously Risky Business by @tom.risky.biz.

I am collecting material, sources on LLMs and vulns before and after the recent mythical moment in time. The (searchable) list is here: tzafaar.codeberg.page Take a look and let me know if your favourite source, paper, blog post, repo is missing or submit pr here: codeberg.org/tzafaar/page...

Alternative ALT text: Lone OSS maintainer riding the vulnerability wave. Downstream users cheering them on from a distance.

🧑‍🏫 Excited to give a 𝐤𝐞𝐲𝐧𝐨𝐭𝐞 at #ICST'26 on the Insufficiency of Benchmarking! Join us in Daejeon, Korea from 19th to 21st May: conf.researchr.org/home/icst-20... #Agentic #SE #AI #LLM #Testing

Recently I was invited to present on long term software development. I asked around for people's experiences, and they delivered in spades! Please find linked here the collected wisdom. Relevant for everyone shipping software that has to stay viable for a decade or more: berthub.eu/articles/pos...

cc footnote warriors @marasawr.bsky.social @cynicalsecurity.bsky.social

Very lucky to receive the ERC Consolidator this year! This is 5-year funding for groundbreaking research. If you are interested in our perspective on software security analysis at scale, stick around and read on. #ERC #ERCCoG #MPI_SP www.mpi-sp.org/71953/news_p...

this year's gift: a bug advent calendar for my code base