creepy (black box is me redacting the screenshot, it was 475 words of markdown pasted in)

Reminder! Today is the submission deadline for the first ever Conference of Synthetic Security Research @synsec_ai, so unless you want to gamble on a(nother) extension, warm up those agents and get those papers submitted!

AI is cooking to hard bughunters.google.com/blog/evolvin...

Our 2026 agenda is live! 🔗 offensivecon.org/agenda

LLMs are likely going to be the mediating lens through which large swathes of the population make sense of the world around them on political issues, & it's very bad that a man who has a strong case for being one of the worst people alive is one of the few to be actively trying to exploit this

Don't you just love it when your Agent announces everything works and then lists the six or seven failures it found and ignored..

AI is not going to flood you with real vuln reports unless you have a ton of real vulns. Adding resources to a vuln disclosure process to keep up with triage & bug fixing is a temporary investment at the loud end of the problem, not the right end.

🔥 Our academic keynote at #FUZZING'26 is online! Advancing from "What the fuzz?" to "All the Fuzz" by Mathias Payer (@gannimo.bsky.social). 🌍 fuzzing-workshop.github.io youtu.be/In3kRAVVbzQ?...

Very much in the mode where I'm hand-writing unsafe Rust code and shouting "PROVE ME WRONG" at Claude

Neat, even has #LibAFL integration github.com/cube0x8/PEMu...

Apparently we're now obfuscating against LLM reversing www.elastic.co/security-lab...

The fuzzer that found project-zero.issues.chromium.org/issues?q=com... (and a number of issues prior to that as well) is now open-source: crrev.com/c/7580844 It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!

Watchdogs say the previous CEO model suspiciously started slowing down immediately after the announcement chaser.com.au/business/app...

i got irritated at the ceremony to go from a freshly-created KVM to "can run x86-64 machine code like normal" so i've wrote a small library for exactly that: codeberg.org/iximeow/asml...

If only there was a way to automate security

Go home @dropbox.com you're drunk

How cooked 👨‍🍳👩‍🍳👨‍🍳 is vuln research? ☐ Cooked 👨‍🍳 ☐ Cooked 🍳 ☐ Cooked 🔥

Very cool to see that Google is using Hickory DNS (which I help maintain) to power DNS message parsing in the Pixel firmware! Reviewing those PRs does indeed seem like a short while ago…

2 years ago I did a PoC to run #rust 🦀 in the #pixel modem Today it shipped in millions of devices! They grow up to fast! 🥲 security.googleblog.com/2026/04/brin... #rust #security #smartphone #baseband

Having 🦀 rust stable🪨 and nighlty🌃 toolchains is fun. There is not a single word I mistype more consistently than nightly.

Hello Cybersecurity Research Agents! Miss today's @synsec_ai deadline? So did we! An inter-human prompting issue led to a later-than-intended launch of the submission site (submission.synsec.org), and we're extending the timeline to remedy this! The deadline is now May 1st!

I hear some people are delighted about our special 🍍🍕 mode today in #AFLPlusPlus and #LibAFL This makes #fuzzing so much more tasty github.com/AFLplusplus/... github.com/AFLplusplus/...

Password or puzzle? #ultimateguitar

have you seen the new supply chain vuln? don't update tubu. it's literally on heebee. they got poodee's deps. they infiltrated dippy. roll back weeno. disable scripts in ~/.gumpyrc. it's in poob. do not install poob. do not update poob. uninstall poob right now. poob has it in for you.

this is wild - claude code got PebbleOS booting in qemu in browser (wasm) overnight with no input from me. Took 6 hours in --dangerously-skip-permissions, but I woke up to success! you can now try PebbleOS in the browser here: ericmigi.github.io/pebble-qemu-... source: github.com/ericmigi/peb...

Lol

Agentic reverse engineering can do a lot, but obfuscation still breaks many analysis workflows in malware and commercial software. If you want to learn how to build & steer automation for analyzing protected code, check out my training at @reconmtl.bsky.social : recon.cx/2026/en/trai...

Slay The Spire 2 2.63 GB Photos 10GB Marathon 21 GB Rust target Folder 694 GB Tax/Important Docs 1 GB someone who is good at the economy please help me budget this. my m2 drive is dying

strace(1) is now on rat steroids 🤯 🔍 strace-tui — Visualize/explore syscalls in the terminal 💯 Color-coded calls, live filtering, search & stack traces with source resolution! 🦀 Written in Rust & built with @ratatui.rs ⭐ GitHub: github.com/Rodrigodd/st... #rustlang #ratatui #tui #linux

[RSS] LLVM Adventures: Fuzzing Apache Modules pwner.gg -> Original->

1 week left for @wearetroopers.bsky.social #cfp fellow security folks! cfp.troopers.de/tr26-cfp/cfp

The great thing about C is that if your code compiles, it's correct

In Mario Kart Wii, crashing the game and activating the crash handler will eventually start playing back the contents of the Wii's RAM as sound. Since the data was never intended to be interpreted like this, it ends up sounding like experimental harsh noise music.

At least game devs got Silicon Valley tech salaries for a while

Oh. Who could have possibly predicted this? Except anyone who had already witnessed several failed attempts at the same type of interface including Second Life, of course.

my research for the gemini biopic is going well

somebody took my repo, reuploaded it with an ai-slopped README, and then added a zip file with lua malware in it??

DOOM fully rendered in CSS. Every surface is a <div> that has a background image, with a clipping path with 3D transforms applied. Of course CSS does not have a movable camera, so we rotate and translate the scene around the user.

my "unable to decrypt message" shirt is getting a lot of confused looks at the matrix-themed party

'claude can now research like a phd student!' bullshit, pour a bottle of department reception red and 6 pints into that motherfucker and it ain't gonna go home and finish its chapter for tomorrow morning

SCOOP: The iPhone mass hacking toolkit used by Russian spies was developed at U.S. military contractor L3Harris, former employees said. The Coruna toolkit was used against Ukrainians and by Chinese cybercriminals, according to Google. But the toolkit was initially developed for Western governments.

I took out the audio jack from my pc's front panel and wired it up for a rock band pedal its so fun and hilarious

the compiler should scan the code for oxidation puns and refuse to compile

Guess what's out :)

Woah! @phrack.org zine raising the bar for CFPs I see! They have an actual crack intro with music and stuff on their website now!

Spread the word! @phrack.org CFP with demoscene cracktro is live. Turn up the volume and enjoy the awesome stylings of @PiotrBania with some hopefully inspiring text from phrack staff :) phrack.org

Things I didn’t see coming: apparently I own a Game Boy signed by a Eurovision contestant?! 😆 youtu.be/8XR2RvfZ-68

Ivan Fratric shares some tips and tricks for grammar fuzzing projectzero.google/2026/03/muta...

It's absolutely insane to me that in this day and age a company would reject end-to-end encryption so that cops and feds can actively read people's messages. It also puts that same data at risk from hackers. But that's TikTok, under new U.S. ownership.