LLMs will happily remove your auth middleware if it helps them complete the task faster. I wrote up the defensive layers I actually use: pre-commit hooks, review agents, and CI that catches LLM mistakes before they ship. ~30 seconds per commit, but worth it. brooksmcmillin.com/blog/coding-...

Microsoft is handing over Bitlocker keys to law enforcement. www.forbes.com/sites/thomas...

We run a tight ship to keep CactusCon accessible, and part of that commitment is ensuring students can access CactusCon for FREE. STUDENTS! Email [email protected] from a valid student email account to request a coupon code for Eventbrite. We are so excited to have you join us! #cc14

Speaking at CactusCon 14 next month! "Breaking Model Context Protocol: Back to Security Basics" — how MCP is repeating every OAuth mistake from the 2010s, and what to do about it. Feb 6, 3:30 PM. See you there.

Well, that’s a bit awkward… #crowdstrike

Something is rotten in Denmark. mastodon.social/@chatcontrol...

1/5 LLMs keep recommending a Python package called "huggingface-cli" that doesn't exist. A security researcher noticed this and actually created the package to demo the supply chain risk.

Vibe Coding Will Get You Hacked! - with @davidbombal.bsky.social https://twp.ai/9PUaq3

Charlie Kirk was one of the main campaigners for Ross Ulbricht's freedom, and had pushed in Trump's first term for a pardon. Ulbricht's most recent speaking engagement was in July at Turning Points USA event in Tampa where he credited for helping him. www.nytimes.com/2025/09/07/t...

If you once wrote software that continues to be used beyond its end-of-life, please don't let the domain expire. If you can't afford to keep using it, contact a local CERT or something. Otherwise, this happens; victims included dissidents and journalists www.trendmicro.com/en_us/resear...

Google is apparently going to become an APT. Will be interesting to see how that works - cyberscoop.com/google-cyber...

Creepers, cheaters, and privacy besiegers, you’re done! Don’t Record Me will be ready soon, we let you choose when AI transcribers can capture your conversation. Big thanks to @sfstandard.com for the shoutout! Sign-up link here: dontrecord.me

Always fun to find more legitimate use cases of Adversarial AI like dontrecord.me which breaks AI transcribers.