You’re still going to wonder if the AI pentester missed something.

ok now my dictation software (yes I yell at my computer, don't you?) keeps replacing cloudflare with Claude Flair. I think I'm done with computers for today.

Nothing seems more useless than this button. WTF even happens when this is pressed?

Claude, every. single. time. "You're absolutely right! That would be much better. "

As its cyber sec awareness month 🤣

🚨 Open source supply chain attacks are exploding. Starting today, that ends. We’re releasing Socket Firewall — FREE, zero-config, CLI that blocks malware before it lands on your laptop or CI. Just run: npm i -g sfw sfw npm install lodash Works for: npm, yarn, pnpm, pip, uv, and cargo.

Happy Monday. Hack the planet!

Got my performance review.

I miss working on the node security project. Haven’t found a similar joy since.

The Python Software Foundation warns of a phishing campaign targeting PyPI users. The phishing domain is pypi-mirror[.]org, a variation of the main pypi[.]org domain. blog.pypi.org/posts/2025-0...

Fun fact about me. I wake up most days with physically manifesting crippling anxiety. It's the best™

Got root today.

hehe. People putting up honeypot Shai-Hulud repos with trash in them; presumably to trip up the attackers exfil automation? github.com/nshadov/Shai...

Woke up to a $500 bounty from Kong for a bug I reported in ...checks notes... May

Testing and tasting gates.

I did a quick analysis of what's currently publicly available leaked data from the Shai-Hulud malware. Trufflehog verification was used by the actor so we have some decent signal to go through. cat * | jq -r 'select(.Verified==true) | .DetectorName'|sort |uniq -c|sort -nr Results in the thread...

🚨 Malicious update to @ctrl/tinycolor on npm is part of an active supply chain attack hitting 40+ packages across multiple maintainers. Audit & remove affected versions. Our analysis of the malware: socket.dev/blog/tinycol... #NodeJS #JavaScript

Dude dude dude, I gotta talk to you a minute, listen listen listen. I copied a garbage file from...

Everyone remember to leave some Jolt out for Razor and Blade!

Sure, but this is better done with regular cadences of automated dependency updates and *lockfiles* not `--before` flags.

This is a good control. Wait until the community / security vendors competing over threat intel have had some eyes on the packages you depend on before you install them...

Said goodbye to an old hacker friend this weekend. The not so gentle reminder to say the thing, do the thing before you can not. RIP.

Anyone proposing that an official be allowed to revoke the passport of a citizen for criticizing *this* country would be rightly regarded as batshit insane and deeply hostile to this country's laws and traditions. Proposing that they can do that if we criticize some *other* country? Fuck. That.

Finally put the exclamation P up on the wall. I made it last year to promote the sidequests game camp psychoholics ran at Toorcamp. #PFY Gotta think about what to do for next camp….

Fuck the police.

"The unsettling feeling that your device is spying on you is real — but the culprit isn't a secret microphone. It's the data broker industry," EFF’s @evacide.bsky.social tells @CNET.com. www.cnet.com/tech/servic...

Bueller....

Man some days I just don't want to do any of it.

JWT is short for "leaked"

Let's echo 23, see what's up.

BSidesPDX needs you! We’re looking for volunteers to help run this year’s event! It’s community-led, low-key, and a great way to meet people in the PNW cyber scene! 📍 Oct 24–25 bsidespdx.org/events/2025/...

hello it's me your CEO texting from a number you've never seen, I need 46 gas station hot dogs for an important business deal no time to explain why

SEATTLE 1988

We were going to do another big marketing stunt for THE TOXIC AVENGER UNRATED. Instead, Toxie, whose life was upended by crushing medical bills, has joined forces with Undue Medical Debt to erase at least $5 million in un-payable medical debt for those who need it most. Learn more:

🚨 Supply chain attack on Nx npm packages (4.6M weekly downloads) Malware abused AI CLI tools (Claude, Gemini, Q) to steal creds + wallets, then exfiltrated to GitHub repos (s1ngularity-repository*). More than 1,000 victim accounts confirmed. 🔗 socket.dev/blog/nx-pack... #nodejs

I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes! Learn how below: portswigger.net/research/inl...

Kilmar Abrego Garcia is the last one they come for before they come for you.

Docker Fixes CVE-2025-9074, Critical Container Escape Vulnerability With CVSS Score 9.3

@hacker0x01.bsky.social Tell sales to contact me back. I've filled the god damn form out twice.

With the MN state fair going on right now I'm reminded that the first concert I ever attended was there! It was Vanilla Ice when I was 12 (with my mother) or should that be (word to your mother?)

Over 14 years ago I dropped DVCS-Pillage - github.com/evilpacket/D... - I’ve done very little to maintain it 😅, yet every now and then I still get DMs from people telling me it landed them a bounty or a shell. Thanks to everyone that have used my shitty tool to hack something.

Every single Thursday.

Don't want drive-by Ollama attackers snooping on your local chats? Patch now

no cheating, post the last pic of your pet.

Neat sticker is neat.

This rules so hard

Sometimes the grass is greener because it’s growing on a drain field.