Spotted an interesting comment on LinkedIn this morning.

In my latest post, I ponder whether Project Glasswing is just a private freemium tier, designed to hook the world’s largest software makers into fueling an endless token bonfire. open.substack.com/pub/defender...

TL;DR - Reddit posts are now SEO/AEO, which means Reddit has become a battleground trying to fight off corporate marketing posts

For anyone interested, I've shared the slides from my @bsidesknoxville talk hosted-files.sched.co/bsidesknoxvi...

Happy DBIR day everyone! It's really good, as always. I wrote up some thoughts: www.defendersinitiative.com/p/verizons-1...

You've probably heard about Anthropic's Mythos, but did you know open-source AI tools have been doing the same thing for the past year? I wrote about these bug-finding systems and why they might be better than Mythos for critical infrastructure firms. www.cybersecuritydive.com/news/ai-vuln...

April 2026: LOL, enterprises would have to be mad to consider using OpenClaw internally May 2026: Oh, a client has a question about some OpenClaw vulns that affect them, this is normal

Is NPM the new DNS? As in, "it's always NPM"

Defense is Offense’s child, but Offense has traumatized its children #randomthoughts

You know, for an OS that sets the standard for vulnerable implementations, at least the default lock screen image is nice to look at, right?

This isn't an AI problem. In any context, if the reporter didn't observe the quote, they needed to cite their source. And that's more than just the wording of the quote. The reporter is responsible for the inferred meaning matching the actual context of a statement.

Potential hot take: vulnerabilities are sparse if a vulnerability is required to have value to an attacker.

It's ticket time! bsides-knoxville-2026.eventbrite.com

Hey Claude, is it possible that threat actors make more money off hacking firewalls/VPNs than companies make selling them #AIQuestions

So yesterday: This vuln is being exploited in the wild Today: To date, threat actors have earned $247M from this vuln

Copy Fail? Also looks like memory safety, but is actually complexity. xint.io/blog/copy-fa... I am going to link to this while rejecting changes to Go crypto for years. Anyway, feeling pretty validated in my "ssh in as root, only gVisor or Firecracker are an actual security boundary" approach.

I'm putting together a webinar on modern vulnerability management and I'm REALLY trying to drive a point home So naturally, I bought 3 old Sonicwall firewalls

yeah sure, okay

Starting to get some coverage from the media on the Destroyed by Breach site! www.cybrsecmedia.com/breaches-don...

This is _the_ most underrated cybersecurity project. Awesome to have a website instead of the spreadsheet 🥳

We are very happy that today Apple issued a patch and a security advisory. This comes following 404 Media reporting that the FBI accessed Signal message notification content via iOS despite the app being deleted.

Big news: Sean Plankey has withdrawn from consideration to be Trump's CISA director after his nomination languished for more than a year amid bipartisan holds in the Senate. CISA hasn't had a permanent director since Trump retook office. www.politico.com/news/2026/04...

I am thrilled to announce that my Destroyed by Breach research project finally has a proper website! destroyedbybreach.com

🚨 BREAKING: Vercel has been breached. A threat actor has listed their customers' data, source code, databases, and keys up for sale. Vercel has also publicly disclosed they've identified a security incident involving unauthorized access to their internal systems.

Some thoughts on the Vercel/Context breach turducken www.defendersinitiative.com/p/breach-les...

Notepad sheds Copilot from toolbar as Microsoft gives subtlety a try

Saturday morning vibes Making brunch in the kitchen in utter silence like a psycho No music, no YouTube, no audiobook, no podcast

Monday #RSAC sessions with CyberCanon Committee Members and Authors: 🤖 Caroline Wong - The Foundations of AI 👁️ Adrian Sanabria - A Failure Is a Terrible Thing to Waste: The Case for Breach Transparency 🪖 Nicole Perlroth - Resilient Infrastructure as National Defense (part 1/3)

Vulnerability management is in some trouble and I have thoughts on how to deal with it. TL;DR - exploitation is happening too fast for traditional vuln mgmt to be effective. open.substack.com/pub/defendersi…

Saturday repair project time! My partners’ thousands of hours in Rocket League have taken their toll on these poor PS5 controllers.

This Italian hacking magazine needs to calm down

✍️ 𝗥𝗲𝘃𝗶𝗲𝘄 𝗗𝗿𝗼𝗽𝗽𝗲𝗱 🪖 We have back-to-back reviews from Larry Pesce. Today, Larry offers his insights on Chris Miller's widely well-regarded book, 𝘾𝙝𝙞𝙥 𝙒𝙖𝙧, from a cyber pro's perspective: 📝 You'll want to read this review cybercanon.org/chip-war-the... #CybersecurityBooks | @haxorthematrix

New: Fintech firm Marquis, used by hundreds of banks & credit unions across the U.S., told its customers that it plans to seek compensation from its firewall provider SonicWall after blaming the company for a breach that allowed hackers to steal tons of people's personal and financial data & SSNs.

@erratarob.bsky.social I imagine they don't even realize that they're reusing a security tool name which makes me feel old www.databricks.com/blog/announc...

A joke for the history buffs: Germany’s satirical newspaper @der-postillon.com titles: “Vienna Academy of the Arts offers Trump admission as a student — They don’t want to get blamed again“

Attack surface management used to mean “outside the firewall.” Now it’s everything: cloud, SaaS, IoT, shadow IT... In this Enterprise Security Weekly webcast, @hdm.io + @todb.hugesuccess.org join @sawaba.bsky.social to talk how to find gaps before attackers do. ▶️ www.runzero.com/resources/as...

Is *If You Give a Mouse a Cookie* about people with ADHD? #RandomThoughts

It's that time of year again. The #WinterSolstice. The day the only hand on my annual clock points straight up, at 12:00

I'm gonna be live with @JohnHammond, talking about Cyber Deception in 25 minutes! www.youtube.com/watch?v=Zn2X...

NSF is about to dismantle NCAR at Russell Vought's direction to protect the fossil fuel industry. It's hard to communicate just how much NCAR does, so let's take a look: I've never worked at NCAR, and I've worked with NCAR researchers once ever. What scientific discoveries has NCAR made possible? 👇

As someone not with NCAR, I use NCAR-based software everyday to help identify and track regions of excessive precipitation to help NWS forecasters protect lives and property. NCAR is extremely valuable and we need them.

0️⃣🔐 𝗖𝘆𝗯𝗲𝗿𝗖𝗮𝗻𝗼𝗻 𝗥𝗲𝘃𝗶𝗲𝘄 𝗗𝗿𝗼𝗽 0️⃣🔐 This week, Adrian Sanabria provides his perspective on George Finney's existing Hall of Famer, 𝙋𝙧𝙤𝙟𝙚𝙘𝙩 𝙕𝙚𝙧𝙤 𝙏𝙧𝙪𝙨𝙩. 🏆 Review: cybercanon.org/project-zero... 🛍️ Support our mission: amzn.to/3XspBon #CybersecurityBooks #CyberCanonHallofFame #ZeroTrust @sawaba.bsky.social

I'm baffled every time someone claims attackers are getting more advanced and sophisticated. They don't need to be, because their targets aren't getting more advanced or sophisticated. Adversaries aren't about doing extra work they don't need to do to achieve their goals.

if you missed the recent interview of Rob Reiner by Terry Gross, it was a good one.  "Rob Reiner's 'Spinal Tap' Still Goes To 11" Fresh Air

Operation Bluebird wants to relaunch “Twitter,” says Musk abandoned the name and logo arstechnica.com/information-...

Exposure is everywhere now — cloud, SaaS, IoT, shadow IT, unmanaged vendors. Replay the SC Media webcast with @sawaba.bsky.social, @hdm.io & @todb.hugesuccess.org to learn why continuous discovery matters & how attackers exploit what you can’t see. 👉 www.runzero.com/resources/as...

💡𝗧𝘂𝗲𝘀𝗱𝗮𝘆, 𝗥𝗲𝘃𝗶𝗲𝘄 𝗗𝗮𝘆💡 “Antifragile isn’t a cybersecurity book, but it might be one of the most important books for cybersecurity leaders to read." --Walt Powell in his review of Nassim Nicholas Taleb's 𝘼𝙣𝙩𝙞𝙛𝙧𝙖𝙜𝙞𝙡𝙚, a Hall of Fame nominee! 📝Review: cybercanon.org/antifragile-... (1/2..)

So proud of my Dad. The pinnacle of his engineering career, he’s been working on ITER for many, many years now and it just made the cover of National Geographic!

📺 Live webcast Dec 3 with SC Media! Your attack surface doesn’t end at the firewall. Join @hdm.io, @todb.hugesuccess.org, and @sawaba.bsky.social to learn how continuous discovery + attack path mapping keeps you ahead. 👉 www.scworld.com/cybercast/at...

On a road trip to Savannah, we stopped just north of Columbia at a roadside diner. I spotted “raw fries” on the menu and am intrigued. Surely they’re not going to bring raw potatoes over??? I order it and the waitress asks “floppy or crispy?” I request crispy. This is what hit the table.