This may be the only offering of my fuzzing class at a conference this year and includes updates for targeting edge devices and arm64!

🚨 In 2026, Richard Johnson - @richinseattle.bsky.social - returns to OffensiveCon with a training on "Advanced Fuzzing and Crash Analysis". More details here🔗https://buff.ly/I8w5EEO 🚀 Don't miss this chance to improve your skills - sign up now!

@richinseattle.bsky.social’s ai agents for cybersecurity course at RE//verse looks neat!

Miss our #defcon panel hosted by @richinseattle.bsky.social @vacci.ne and chompie? It's up on YouTube!

Phrack turns 40. The digital drop is live. Download it. Archive it. Pass it on. 💾 www.phrack.org #phrackat40 #phrack72

NEW: Earlier this month, two hackers published their findings in Phrack magazine after earlier breaking into the computer of a North Korean government hacker. Now, in speaking with @lorenzofb.bsky.social, the two hackers explain why they went public — even though their breach was probably illegal.

Are you going to @defcon.bsky.social?? We'll be giving away 9500 print copies of Phrack! Come by main stage Sunday @ noon to see @vacci.ne @richinseattle.bsky.social and chompie talk hacker history! This will mark the first time Phrack staff appear together on DEF CON’s main stage.

AI Agents for Cybersecurity by Richard Johnson (@richinseattle.bsky.social) www.hexacon.fr/trainer/john...

@richinseattle.bsky.social Richard Johnson, at the forefront of AI Security Research for years, is doing a new two day dojo course at CanSecWest2025_newtype, before 24/25 conference. Check out his presentation last year at CanSecWest "The DL on LLM Code Analysis " at secwest.net/2024-recordi...

Generated a few fuzz harnesses using new local models, OlympicCoder was best, fixing own bugs zero-shot & few hallucinations Open R1 OlympicCoder 32B DeepSeek R1 Distill Qwen 32B QwQ 32B Gemma-3-27b-it All 4bit quant. Coder was by bartowski, the rest were Unsloth dynamic quant

My new APPLIED DEEP LEARNING AI FOR CYBERSECURITY training class is now available for sign ups at @reconmtl for 5500 CAD ($3838 USD) early bird pricing Full syllabus and registration here: recon.cx/2025/trainin...

My Applied Deep Learning AI for Cybersecurity training will be at RECON’s 20th anniversary con! I have a fuzzing harness gen section but will also cover model training/tuning & AI agents w/ applications in malware, RE, bug hunting, and web app pen-testing. There are also 3 other fuzzing trainings!

Friends, FBI has responded to my FOIA request for Kevin Mitnick's files, and have made them available to everyone via the FBI public portal here: vault.fbi.gov/kevin-mitnic...

Get your macOS 15.2 xnu CodeQL database here! 🎉 github.com/blacktop/dar...

Mount up, time to ride!

New Year, New Life.

Happy New Year!

Did anyone else get a blue box for Christmas?

We updated our CFP for Phrack 72! The deadline is now April 1st 2025. Check the site for specifics on how to contribute, as well as some inspiration! We also posted a link to purchase physical copies of Phrack 71, and a donation link too. Enjoy! phrack.org

So I guess I'm going to be participating in the Solana hackathon with some LLM magic. I could not have predicted this at the beginning of the year.

News: Murderer was fond of a game where you take the role of an assassin. The game? Among Us. Never mind the cute cartoony aesthetic, this is a training ground for would-be killers! ROFL.

I approve this message. A little digital hygiene will save your ass.

If you're developing backend services for the web, you should probably be publishing your APIs using MCP so AIs know how to use them. www.anthropic.com/news/model-c...

Watch the recording of my #ekoparty talk "Advanced #Fuzzing with #LibAFL" here: youtu.be/FI7C37lz4Rg?... Thanks @fede-k.bsky.social for this amazing event!

I need some 2d sprite animations for a project. Dall-e knows what that means but is being stubborn. Anyone know a good resource besides fiverr?

China announced a ban on exports of Gallium, Germanium, and Antimony - natural resources used in semiconductors, solar cells, lead alloys for military etc. I found myself looking for what that might mean for our industries and found these annual natural resource reports from USGS

Am I the only one who gets really annoyed about plagiarism on social media? It’s important to credit your sources no matter the medium.

This thread seems to be copied from someone else on Twitter without credit but is a good summary. Original: x.com/omarsar0/sta...

I can only imagine the cringe, ain’t nobody got time to read that pathetic shit.

I love when cmake just works to build other peoples code, but it always takes an hour to debug when I find one that hasn’t been properly written. It’s almost always me brute forcing my way to build targets on windows. Fortunately my experience in fuzzing has fortified my patience for such things.

Nah include me in the dataset I go willingly my ass is gonna live forever through the machines. 100000 year SwiftOnSecurity chalice will clink against those of the future and settle scores past my death

I'm launching a new website: sdk.blue - a list of all libraries/SDKs for building things on #ATProto, grouped by language 🙂 If I forgot anything important, or you have an ATProto/Bluesky library that you think would be a good fit there (or if I should remove anything), please send me a PR :) #atdev

Dance with the Dead makes some pretty great gothic/baroque synth metal darkwave music to keep the juices flowing, all their albums are free on YT youtube.com/playlist?lis...

Polymorphic Log4J exploit that is a valid JSON REST API request (credit tw:@d0znpp)

Blog comments section using AtProto (just comment on the thread from Bluesky to have it appear on blog comments). Very cool, though bots might make moderation a pain.

Illustration from TAP Magazine, 70s phone phreak publication.

github.com/0xricksanche... just got more rusty, stable, (hopefully) easier to maintain and contribute to. Also, we have a bunch of new features like deterministic generation and fuzzing modes :)!

AI research will be the true test of human exceptionalism and I think we will find our intelligence is not that much different from other biological or synthetic intelligences we will eventually build.

tired: "large language models are stochastic parrots" wired: mechanistic interpretability showing evidence of abstraction, generalization, motivation, and reasoning

If you've used Llama 3 you may have heard of RoPE or Rotatry Positional Encoding. Self-attention does not take the order of the sequence of tokens into account. RoPE enhances attention by adding that information. This blog does a deep dive on the developments in positional encoding that led to RoPE.

Oh this is fun.

Dario Amodi (Anthropic CEO) on forging your own path and hiring a great team lexfridman.com/dario-amodei... www.youtube.com/watch?v=ugvH...

NIST enumerates hardware threat models with 98 different failure scenarios www.nist.gov/publications...

Cyber folks, you can monitor for CVE mentions fright from the Jetstream with websocat & jq: $ websocat "wss://jetstream1.us-east.bsky.network/subscribe?wantedCollections=app.bsky.feed.post" | jq 'select(.commit.record.text != null) | select(.commit.record.text | test("CVE-\\d{4}-\\d+"))'

The 3rd segment of @lexfridman.bsky.social's podcast with Anthropic AI focuses on mechanistic interpretability - the analysis of what weights in a model are activated by a particular input. Part of it mentions identifying weights that map to vulnerabilities and backdoors youtu.be/ugvHCXCOmm4?...

Going into effect in January. US investment firms cannot finance foreign AI development of 10^25 FLOPS models which is current scale of GPT/Claude/Gemini frontier models. They are setting the limit around GPT-3.5 scale. Currently only impacts ByteDance’s TikTok and Zhipu AI, both from China.

piping websocat to jq had weird buffering, so here's an ugly bash oneliner that infinitely listens to jetstream for some seconds, writing identity records to a file, then processing them to add bidirectional mappings for DID and Handle to redis gist.github.com/richinseattl...

This is such a good story about how "gotofail" started as a drunken brag in a bar and ended up being disclosed to Apple via a burner phone. It was Ryan all along, finally taking credit after all these years!

This is a fair critique of the current state of decentralization for Bluesky that made front page of hackernews. One of the key points here is the did->handle mapping is owned by Bluesky but that's easy enough to recover yourself, dump this to CSV or redis cache