Cool stuff, binary-only fuzzing of iOS kernel yungraj.com/Fuzzing-macO...

This is absolutely nuts: hackers are hijacking high-profile Instagram accounts by simply asking Meta's AI chatbot to change the email on the account. Meta's AI does it, hacker gets password reset code, they're in. A staggering security issue www.404media.co/hackers-simp...

everything is a bytecode-targetable virtual machine if you look at it sideways. JBIG2 image decompression? virtual machine. x86 mov instruction? virtual machine. truetype fonts? virtual machine. Magic: The Gathering? believe it or not, also virtual machine.

accidentally ended up on the news arstechnica.com/security/202...

I'm sorry, what? In writing my first monograph, I spent six weeks trying to track down a citation in TWO languages I didn't know. And good thing too, because the citation was wrong. That's scholarship. That's research. You know, the thing we're trained to do?!?

My team on fire 🔥🔥

the bun is now rusty, I repeat, the bun has been rusted: github.com/oven-sh/bun/...

Cool stuff, #go fuzzer powered by #LibAFL blog.trailofbits.com/2026/05/12/g...

C has a borrow checker it’s called mythos

bun appear to be experimenting with a million line claude port from zig to rust lol

Just cleaned my 1TB(!) cargo targets folder.. Lol.. How hard can it be to drop stale caches? 🦀🦀🦀 #rust

This paper finds that Rust on an microcontroller costs you about 10% extra flash space, actually saves you a bunch of RAM, and takes no extra time to deliver (as compared to C). Seems about right - especially as the C version needed a heap and the Rust version did not. arxiv.org/pdf/2604.25679

Original->

creepy (black box is me redacting the screenshot, it was 475 words of markdown pasted in)

Reminder! Today is the submission deadline for the first ever Conference of Synthetic Security Research @synsec_ai, so unless you want to gamble on a(nother) extension, warm up those agents and get those papers submitted!

AI is cooking to hard bughunters.google.com/blog/evolvin...

Our 2026 agenda is live! 🔗 offensivecon.org/agenda

LLMs are likely going to be the mediating lens through which large swathes of the population make sense of the world around them on political issues, & it's very bad that a man who has a strong case for being one of the worst people alive is one of the few to be actively trying to exploit this

Don't you just love it when your Agent announces everything works and then lists the six or seven failures it found and ignored..

AI is not going to flood you with real vuln reports unless you have a ton of real vulns. Adding resources to a vuln disclosure process to keep up with triage & bug fixing is a temporary investment at the loud end of the problem, not the right end.

🔥 Our academic keynote at #FUZZING'26 is online! Advancing from "What the fuzz?" to "All the Fuzz" by Mathias Payer (@gannimo.bsky.social). 🌍 fuzzing-workshop.github.io youtu.be/In3kRAVVbzQ?...

Very much in the mode where I'm hand-writing unsafe Rust code and shouting "PROVE ME WRONG" at Claude

Neat, even has #LibAFL integration github.com/cube0x8/PEMu...

Apparently we're now obfuscating against LLM reversing www.elastic.co/security-lab...

The fuzzer that found project-zero.issues.chromium.org/issues?q=com... (and a number of issues prior to that as well) is now open-source: crrev.com/c/7580844 It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!

Watchdogs say the previous CEO model suspiciously started slowing down immediately after the announcement chaser.com.au/business/app...

i got irritated at the ceremony to go from a freshly-created KVM to "can run x86-64 machine code like normal" so i've wrote a small library for exactly that: codeberg.org/iximeow/asml...

If only there was a way to automate security

Go home @dropbox.com you're drunk

How cooked 👨‍🍳👩‍🍳👨‍🍳 is vuln research? ☐ Cooked 👨‍🍳 ☐ Cooked 🍳 ☐ Cooked 🔥

Very cool to see that Google is using Hickory DNS (which I help maintain) to power DNS message parsing in the Pixel firmware! Reviewing those PRs does indeed seem like a short while ago…

2 years ago I did a PoC to run #rust 🦀 in the #pixel modem Today it shipped in millions of devices! They grow up to fast! 🥲 security.googleblog.com/2026/04/brin... #rust #security #smartphone #baseband

Having 🦀 rust stable🪨 and nighlty🌃 toolchains is fun. There is not a single word I mistype more consistently than nightly.

Hello Cybersecurity Research Agents! Miss today's @synsec_ai deadline? So did we! An inter-human prompting issue led to a later-than-intended launch of the submission site (submission.synsec.org), and we're extending the timeline to remedy this! The deadline is now May 1st!

I hear some people are delighted about our special 🍍🍕 mode today in #AFLPlusPlus and #LibAFL This makes #fuzzing so much more tasty github.com/AFLplusplus/... github.com/AFLplusplus/...

Password or puzzle? #ultimateguitar

have you seen the new supply chain vuln? don't update tubu. it's literally on heebee. they got poodee's deps. they infiltrated dippy. roll back weeno. disable scripts in ~/.gumpyrc. it's in poob. do not install poob. do not update poob. uninstall poob right now. poob has it in for you.

this is wild - claude code got PebbleOS booting in qemu in browser (wasm) overnight with no input from me. Took 6 hours in --dangerously-skip-permissions, but I woke up to success! you can now try PebbleOS in the browser here: ericmigi.github.io/pebble-qemu-... source: github.com/ericmigi/peb...

Lol

Agentic reverse engineering can do a lot, but obfuscation still breaks many analysis workflows in malware and commercial software. If you want to learn how to build & steer automation for analyzing protected code, check out my training at @reconmtl.bsky.social : recon.cx/2026/en/trai...

Slay The Spire 2 2.63 GB Photos 10GB Marathon 21 GB Rust target Folder 694 GB Tax/Important Docs 1 GB someone who is good at the economy please help me budget this. my m2 drive is dying

strace(1) is now on rat steroids 🤯 🔍 strace-tui — Visualize/explore syscalls in the terminal 💯 Color-coded calls, live filtering, search & stack traces with source resolution! 🦀 Written in Rust & built with @ratatui.rs ⭐ GitHub: github.com/Rodrigodd/st... #rustlang #ratatui #tui #linux

[RSS] LLVM Adventures: Fuzzing Apache Modules pwner.gg -> Original->

1 week left for @wearetroopers.bsky.social #cfp fellow security folks! cfp.troopers.de/tr26-cfp/cfp

The great thing about C is that if your code compiles, it's correct

In Mario Kart Wii, crashing the game and activating the crash handler will eventually start playing back the contents of the Wii's RAM as sound. Since the data was never intended to be interpreted like this, it ends up sounding like experimental harsh noise music.

At least game devs got Silicon Valley tech salaries for a while

Oh. Who could have possibly predicted this? Except anyone who had already witnessed several failed attempts at the same type of interface including Second Life, of course.

my research for the gemini biopic is going well