This is a new one for me. I'm #8 and #31 on this top 100 list. Do you want Chris the the CTO of Veracode or Chris the security pioneer. 😂 www.futuristsspeakers.com/top-100-cybe...

Can we all forget about the email disclaimers now? The information contained in this communication is confidential, may be attorney-client privileged, may constitute inside information, and is intended only for the use of the addressee. It is the property of JEE

In order to collect a bug bounty, a researcher was required to sign an NDA to not discuss the vulnerability. zuernerd.github.io/blog/2026/01...

Vulnerability disclosure norms are a control system for incentives. They made vulnerability handling predictable enough to industrialize. We get more finding, more fixing, and more secure software.

This looks interesting. Teenage hackers. I was one. I didn’t do this type of thing though. www.amazon.com/dp/133500193X

ATM jackpotting is still very much alive in 2025. Two attackers physically opened ATMs, connected a laptop, installed malware, and forced the machines to dump all their cash. DOJ convictions, prison time, restitution, deportation.

This FDA announcement says over 700 people were harmed and 7 people died due to a bug in the Abbot FreeStyle Libre device. www.fda.gov/medical-devi...

Massachusetts lawmakers introduced bipartisan bills (HD 5563 / SD 3606) to curb abandoned consumer electronics by requiring vendors to disclose software support lifetimes, warn users before end-of-life, and explain lost features and security risks.

New from Anthropic. red.anthropic.com/2026/cyber-t...

Microsoft released NTLMv2 in 1998, no doubt because tools like L0phtCrack were able crack NTLMv1 passwords with the measly computing power then. NTLMv1 is still in use today! Mandiant has now released rainbow tables for NTLMv1 that can crack any pw in 12hrs on a $600 computer.

UK NCSC: pro-Russian hacktivists are still hammering critical infra & local gov w/DDoS attacks. Low-tech, high impact, disrupting services & costing serious recovery time/money. Shouldn't critical infra & local gov be able to mitigate these attacks? What do they use? Cloudflare? Akamai? ISPs?

Tell your older relatives to turn personalized ads off everywhere. Scammers target this demographic.

“Prompt injection” is the wrong mental model. LLM attacks increasingly look like malware campaigns, not single exploits. This paper frames them as promptware and maps a 5-stage kill chain: initial access → priv esc → persistence → lateral movement → actions on objective. arxiv.org/html/2601.09...

BIG NEWS! Rachael Morrison’s JOYBUBBLES will have its #WORLDPREMIERE at the 2026 #SundanceFilmFestival (@sundance.org) on JAN 26 at 6 PM! Executive produced by @cameowood.com & Charming Stranger Films, the film will screen in person JAN 26—JAN 31 & online screenings begin JAN 29: loom.ly/xnAbh1w

"A draft amendment to the BND Act, circulating by German media, would transform the agency’s reach by authorizing it to break into foreign digital systems, collect and store large portions of internet traffic, and analyze those communications retroactively." reclaimthenet.org/germany-bnd-...

Tickets for in-person and online viewing go on sale tomorrow! I hope I get to see some friends in the audience on opening night!

iPhones now have "delete and report spam" for unknown messages and callers. If everyone was to choose "delete and report spam" for every spam message and call would they stop? If not, what is the point?

Before the word hacker meant anything at all there was a blind kid who whistled 2600 Hz and bent Ma Bell to his will. Joybubbles tells the story of Joe Engressi, the original phone phreak and a reminder that hacking started as curiosity, play, and defiance. festival.sundance.org/program/film...

CES Worst in Show is a reminder that “innovation” now means: more attack surface, less ownership, permanent surveillance, and DRM on objects you physically bought. Congratulations to the ad-powered fridge for completing the arc. www.youtube.com/watch?v=cxZg...

“The Conscience of a Hacker” by The Mentor is 40 years old today.

Manufacturing cyber compromises are expensive. An attack in 2025 forced Jaguar Land Rover to suspend production at its factories in the UK, Slovakia, Brazil and India through September and pushed it into a quarterly loss of almost £500m. www.theguardian.com/business/202...

Outlook emailing me that someone “reacted” to my email feels very Dilbert, like the Pointy-Haired Boss getting his emails printed.

[un]prompted is a new practitioner-led AI security con taking place Mar 3–4 at Salesforce Tower in SF. If you’re working hands-on w/AI systems, I strongly encourage you to submit a talk. Take a look at the CFP & review boards guidance on the kinds of submissions we’re hoping to see unpromptedcon.org

In life, as in music, all time scales coexist. The ‘now’ is not a fleeting instant but a field that extends forward and backward through memory and anticipation. Perception and context shape how we experience this layered present.

🚨 Critical React + Next.js RCE Alert 🚨 New flaws in the React Server Components “Flight” protocol (CVE-2025-55182 & CVE-2025-66478) allow unauthenticated remote code execution on default installations. Attackers only need one malicious HTTP request to take over a server.

New policy paper out: An Achilles Heel of Today’s Armed Forces: Managing Software Supply Chain Risk in the Military Sector Armed forces should pay more attention to their software supply chains. These are complex networks of software components, vendors, service providers, and other companies. /1

Veracode Research finds that OpenAI GPT-5 writes more secure code than other models. www.forbes.com/sites/the-wi...

I'm heartbroken to share that my friend of 30 yrs, Arthur Phillip Delchi, @delchi.bsky.social, DJ Delchi, has left us. A founding force behind DEF CON’s Hackers with Disabilities, a member of cDc Ninja Strike Force, a L0pht regular who DJed our wildest parties (two of those moments captured below)

Kociemba has launched the No Longer Evil project, an open-source initiative aimed at breathing new life into decommissioned first- and second-generation Nest thermostats. www.techspot.com/news/110186-...

Secure by design is shifting from vision to standard. Progress: >50% of apps now pass OWASP Top 10 checks (up from <33% in 2020), exploitable flaws dropped from 3.6% to 2.6%. But 70% of apps still have major flaws. Success means making security part of every build. www.forbes.com/councils/for...

Veracode found a malicious npm package “@acitons/artifact” impersonating @actions/artifact (206K+ DLs). It targeted GitHub repos to steal build tokens & publish malware. 6 versions used a post-install hook to fetch undetected malware. Veracode blocked & notified npm www.veracode.com/blog/malicio...

Some encouraging #righttorepair news out of DC... No, really!

The @consumerreports.org cybersecurity testing lab has helped improve security for several connected products. We showcase a few examples of what they have found and how they work with companies to improve product security. Also, if you're building a connected device, encrypt your traffic.

I'm struggling to understand why the attackers are classified as hacktivists and not nation-state attackers as when Salt Typhoon made similar compromises. www.bleepingcomputer.com/news/securit...

Well doesn’t this @axios cybersecurity news item just sum up the state of consumer internet privacy

“If you’re being arrested at 17, you’re being weaponised at around 11. It’s not happening overnight & the entry point is gaming, which acts as a live lab for skill set development. These young people are modifying and hacking games to find the loopholes.” www.theguardian.com/from-play-to...

Regulation of white hat hackers is coming soon to Russia. The FSB will be able to set requirements for white hats: those who do not comply with them will be banned from working. Programmers will have to share the found "gaps" in information protection with both the company and the special services

Mother Jones on First Wap's SS7 based tracker. The old an insecure phone system keeps giving. www.motherjones.com/politics/202...

Was this DEFCON eBPF bug talk hallucinated? www.thestack.technology/defcon-ebpf-...

Hackers are getting younger and we need to stage an intervention. “Twenty-five years ago, you had to use unconventional talent in cybersecurity because there were no degree programmes or bootcamps,” We need to tap in to this talent like we did back then. www.computing.co.uk/feature/the-...

Stellar weekend in Newport, RI. My daughter got married to a wonderful man! My son even played in the band. So happy and grateful for family!

Are you ready for the 2036 Epochalypse and the 2038 Time Rollover? This makes Y2K seem easy.

gofund.me/ae3e52797 It is with great sadness I share the passing of Caspian Shea youngest son of Johanna and Dylan. We are asking for your support covering medical and funeral arrangements during this unimaginable time. Please consider donating - but do share far and wide

I write this post with a sad and heavy heart. My close friends Dylan and Jo's child, Caspian, has died. You may know Dylan as FreqOut, a longtime member of the hacker community (cDc). The family faces significant medical and funeral costs. If you can, please donate or share: gofund.me/13b9506f0

Teen hackers aren’t villains-in-waiting, they’re untapped defenders. We can intercept talent early, show real career paths, and turn curiosity into cyber defense. My take on building ethical on-ramps for #cybersecurity www.forbes.com/councils/for...

30 years ago today, I saw Hackers in theaters with my crew @l0pht.bsky.social Later, I met my wife @debdebdeb.bsky.social on IRC. Then I co-founded a cybersecurity company @veracode.bsky.social with fellow L0pht hacker @dildog.l0pht.com What a journey! Anyone else feeling old? Post your story.

BOSTON AREA #synthsky! Hidden Fountain is having our video release show at the French Club in N Cambridge this Saturday. Music from us, Mute City, Bell System (sifu.tweety.fish), and Kathy Snax, followed by videos and short films from Coco Roy and AV Carraway! info/tix at hiddenfounta.in.

On this Sept 11, we remember. My wife served at Ground Zero as a first responder. Yesterday she rang the radiation bell, a milestone on her road to beating breast cancer. Grief + gratitude, service + strength. Proud of her. #NeverForget #FirstResponder #BreastCancer