Some encouraging #righttorepair news out of DC... No, really!

The @consumerreports.org cybersecurity testing lab has helped improve security for several connected products. We showcase a few examples of what they have found and how they work with companies to improve product security. Also, if you're building a connected device, encrypt your traffic.

I'm struggling to understand why the attackers are classified as hacktivists and not nation-state attackers as when Salt Typhoon made similar compromises. www.bleepingcomputer.com/news/securit...

Well doesn’t this @axios cybersecurity news item just sum up the state of consumer internet privacy

“If you’re being arrested at 17, you’re being weaponised at around 11. It’s not happening overnight & the entry point is gaming, which acts as a live lab for skill set development. These young people are modifying and hacking games to find the loopholes.” www.theguardian.com/from-play-to...

Regulation of white hat hackers is coming soon to Russia. The FSB will be able to set requirements for white hats: those who do not comply with them will be banned from working. Programmers will have to share the found "gaps" in information protection with both the company and the special services

Mother Jones on First Wap's SS7 based tracker. The old an insecure phone system keeps giving. www.motherjones.com/politics/202...

Was this DEFCON eBPF bug talk hallucinated? www.thestack.technology/defcon-ebpf-...

Hackers are getting younger and we need to stage an intervention. “Twenty-five years ago, you had to use unconventional talent in cybersecurity because there were no degree programmes or bootcamps,” We need to tap in to this talent like we did back then. www.computing.co.uk/feature/the-...

Stellar weekend in Newport, RI. My daughter got married to a wonderful man! My son even played in the band. So happy and grateful for family!

Are you ready for the 2036 Epochalypse and the 2038 Time Rollover? This makes Y2K seem easy.

gofund.me/ae3e52797 It is with great sadness I share the passing of Caspian Shea youngest son of Johanna and Dylan. We are asking for your support covering medical and funeral arrangements during this unimaginable time. Please consider donating - but do share far and wide

I write this post with a sad and heavy heart. My close friends Dylan and Jo's child, Caspian, has died. You may know Dylan as FreqOut, a longtime member of the hacker community (cDc). The family faces significant medical and funeral costs. If you can, please donate or share: gofund.me/13b9506f0

Teen hackers aren’t villains-in-waiting, they’re untapped defenders. We can intercept talent early, show real career paths, and turn curiosity into cyber defense. My take on building ethical on-ramps for #cybersecurity www.forbes.com/councils/for...

30 years ago today, I saw Hackers in theaters with my crew @l0pht.bsky.social Later, I met my wife @debdebdeb.bsky.social on IRC. Then I co-founded a cybersecurity company @veracode.bsky.social with fellow L0pht hacker @dildog.l0pht.com What a journey! Anyone else feeling old? Post your story.

BOSTON AREA #synthsky! Hidden Fountain is having our video release show at the French Club in N Cambridge this Saturday. Music from us, Mute City, Bell System (sifu.tweety.fish), and Kathy Snax, followed by videos and short films from Coco Roy and AV Carraway! info/tix at hiddenfounta.in.

On this Sept 11, we remember. My wife served at Ground Zero as a first responder. Yesterday she rang the radiation bell, a milestone on her road to beating breast cancer. Grief + gratitude, service + strength. Proud of her. #NeverForget #FirstResponder #BreastCancer

Top cybersecurity conferences are introducing new rules that require researchers to formally address ethics in their work. Starting with the 2026 USENIX Security Symposium, all submissions must include a stakeholder-based ethics analysis. www.helpnetsecurity.com/2025/09/08/c...

Who hacks the hackers? arxiv.org/abs/2508.21669

During a routine cybersecurity review, DHS CIO discovered significant security vulns that gave a threat actor access to FEMA’s network. FEMA CIO, CISO, 22 IT employees terminated Lack of MFA, prohibited legacy protocols, failing to fix known and critical vulns, inadequate operational visibility.

The AI Vulnerability Crisis is Coming — Can Defenders Catch Up? securityboulevard.com/2025/09/the-...

An app developer has jailbroken Echelon exercise bikes to restore functionality that the company put behind a paywall last month, but copyright laws prevent him from being allowed to legally release it. www.404media.co/developer-un...

LLM automated attacks and extortion is here www.nbcnews.com/tech/securit...

We know very little about how cell-site simulators (CSS), devices that masquerade as legitimate cell-phone towers, are being deployed in the US or globally, but with Rayhunter, we hope to change that. www.eff.org/deeplinks/2...

Applying lessons from my @l0pht.bsky.social days: transparency, collaboration, & curiosity drive cybersecurity progress. Read how we turned hacker insights into modern security practices: www.forbes.com/councils/for... #Cybersecurity #L0pht #Innovation

“RapperBot, Eleven Eleven Botnet, and CowBot, which abused ensnared IoT devices, mainly DVR devices and Wi-Fi routers, to launch massive DDoS attacks against victims in more than 80 countries” I wonder how many were EOL or were difficult to patch/secure. www.securityweek.com/rapperbot-bo...

Hackers aren’t the enemy. Ignoring them is. While cyber gangs recruit on Discord & gaming forums, the industry is missing out on young, self-taught talent. “It’s time to go back to our roots.” www.computerweekly.com/feature/Woul...

Source: Oracle Chief Security Officer Mary Ann Davidson, who joined in 1988 and became the company's first CSO, is leaving as part of a recent reorganization (Bloomberg) Main Link | Techmeme Permalink

MeshCore party!

Watching Hackers on Laserdisc!

Honored to be named an Industry Visionary in the 2025 #CyberScoop50. Special respect to Amit Yoran, who was posthumously awarded Lifetime Achievement. Amit’s vision & integrity shaped our industry. Many of us followed his lead, myself included. His example endures. cyberscoop.com/cyberscoop-5...

New @veracode.bsky.social report on the security risks of software written by LLMs: "Across all models and all tasks, ... in 45% of the tasks, the model introduces a known security flaw into the code. Security performance has been largely unchanged over time, /1

AppSec and Security Engineering, what is your response to vibe coding and "fast fashion SaaS"?

Over the last 2 yrs LLMs have vastly improved their ability to write syntactically correct code, but they haven’t improved in ability to write code without vulnerabilities which is steady at 45% coding tasks with vulns.

A bug bounty program is economically beneficial to a firm when the firm has low in-house efficiency finding a vuln or when the firm faces a high proportion of coopetitive hackers (bug reporters who would otherwise pose a security risk by misusing vuln info) Paper: papers.ssrn.com/sol3/papers....

17, 17, 19 and 20 year olds "M&S was the first retailer to be attacked in April in an incident that forced the closure of its online store for nearly seven weeks." www.theguardian.com/uk-news/2025...

The Black Hat USA keynote list has dropped. Impressive!

Do we need the term PoliPhish when government officials are voice and text spoofed. www.newser.com/story/371511...

The EU Product Liability Directive will take effect Dec 2026. Software, firmware, applications, AI systems, and will now be subject to the same strict liability regime as traditional physical goods. Cybersecurity vulnerabilities will be considered product defects. www.lexology.com/library/deta...

Attacking AI agents. AIJacking? labs.zenity.io/p/a-copilot-...

"[A]utonomy means losing the plot. Humans are about to find themselves on the outside looking in, facing security decisions made by AIs whose reasoning isn’t just complicated—it’s fundamentally inaccessible." @daveaitel.bsky.social and Dan Geer on how AI is reshaping code security.

Hey everyone, I’m emceeing the @eff.org benefit poker tournament at Planet Hollywood. Shenanigans for a cause… #DFIU www.eff.org/event/bettin...

Here we go again! Thrilled to bring you this year’s @eff.org benefit poker tournament at @defcon.bsky.social! Just next door from the Horseshoe at the Planet Hollywood gorgeous new poker room!

Great article on slopsquatting and more LLM vulnerability invention. www.usenix.org/publications...

Are you reviewing your NPM dependancies for malicious code? #devsecops #appsec #npm www.scworld.com/news/complex...

"Absurd" 12-step malware dropper spotted in malicious npm packages. Supply chain attack effort used steganography, a "dizzying wall of Unicode characters" and more. www.thestack.technology/absurd-12-st...

Trump's Cybersecurity EO eliminates from Biden's last Cybersecurity EO: Mandatory, machine-readable attestations & SBOMs from every federal software supplier A CISA-run Repository for SW Attestations & Artifacts and program that randomly validates those filings & publicly names vendors that fail.

Trump issues new Cybersecurity EO

Researchers from Rice and Stanford refer to this recursive data contamination as Model Autophagy Disorder (MAD), analogous to mad cow disease. (Reminder: do not eat the neural tissue of your own species.) therepublicjournal.com/essays/the-c...

“Cryptome actually published the embarrassing US diplomatic cables that landed Assange in hot water the day before WikiLeaks…”