If you own it, why can't you fix it? Join EFF, Adam Savage, and iFixit CEO Kyle Wiens on July 23rd for a live conversation about the Right to Repair movement. We'll answer that question and yours during the live Q&A. eff.org/livestream-r2r

Our first-ever keynote: Chris Wysopal @weld.bsky.social. Original L0pht vulnerability researcher, Veracode co-founder, and one of the first people to warn the world about insecure software. Boston hacker history, back on a Boston stage at MinuteCon. April 30 – May 1, 2027 minutecon.org

There is a new cybersecurity con coming to Boston this spring, MinuteCon! Boston has a long history of cybersecurity impact going back to the @l0pht.bsky.social days in the 90s but hasn't had a major hackerish oriented con since Source Boston 10 yrs ago. Looking forward to this! www.minutecon.org

KEYNOTE UNLOCKED_ Excited to have @weld.bsky.social opening up our conference with his Keynote: “WHEN EVERY ATTACKER CAN HAVE A RESEARCH TEAM” > Access talk details: nohat.it/talks #nohat2026 #CyberSecurity #InfoSec

Big win for farmers right to repair! fighttorepair.substack.com/p/the-deere-...

I'm very excited to speak and meet new colleagues at No Hat in Italy this October!

A third #FOIA release from the #FBI for records on broadcast signal #hacker Captain Midnight and this time it is a recording of a radio interview with the man himself on Portland's KXL radio station at midday. 1986 - I'm unsure of the exact date but it was before he surrendered himself to the feds.

28 years ago today, 7 members of the hacking group L0pht Heavy Industries told the U.S. Senate they could "shut down the internet in 30 minutes."

Couldn’t agree more with @weld.bsky.social about @windowsnyder.bsky.social for @darkreading.bsky.social being “one of the most important security leaders of the past two decades," for her ability to achieve systemic change. Great #Darkreading20 special coverage.

AI is not going to flood you with real vuln reports unless you have a ton of real vulns. Adding resources to a vuln disclosure process to keep up with triage & bug fixing is a temporary investment at the loud end of the problem, not the right end.

We've just published the 2nd episode of our documentary series "How the World Got Owned". This one looks at the 1990s and features interviews with Kevin Poulsen, @weld.bsky.social, @thedarktangent.bsky.social and Alpeh One (Elias Levy). Subscribe to the stories feed now! risky.biz/HTWGO2-stori...

Phrack call for papers is out! Check out the cool demoscene graphics at phrack.org

I’m excited to let you know that the talks from [un]prompted—the AI Security Practitioner Conference—are now live on YouTube. No fluff, no hype—just real-world AI security from people actually doing the work. www.youtube.com/playlist?lis...

RCE vulnerability in the Yamaha PSR-E433 synthesizer, discovered by Anna Antonenko, allows exploitation through crafted MIDI files that trigger a hidden firmware backdoor with hardcoded password "#0000". it4sec.substack.com/p/remote-cod...

Doesn't everyone watch Akira on LaserDisc with their figurines?

Security debt is becoming a governance issue for CISOs 📖 Read more: www.helpnetsecurity.com/2026/03/02/c... #cybersecurity #cybersecuritynews #CISO #riskmanagement @weld.bsky.social

We wished we had more time to find the right words, and it is with deep regret that we have to tell you that our founder Felix “FX” Lindner passed away on 2026-03-01. blog.recurity-labs.com/2026-03-02/F...

RIP FX - You are a legend

Another NAFO legend has left us...💔 Jason Snitker @jasonsnitker (on Twitter) AKA Parmaster "Par" has passed away!🕯️ He was one of the first hackers, a legend in the hacking scene and a huge supporter of Ukraine and #NAFOfella. >> SIGNAL LOST: PARMASTER >> STATUS: GONE BUT NOT FORGOTTEN

🕯️There will be a online memorial for Par 🕯️ Jason Snitker "Parmaster" Memorial Service Feb 28, 2026 04:00 PM Confirmed Speakers: Par's Aunt Deb Wysopal Mudge John Lee Tom Sloan (former Secret Service) Registration Link: us02web.zoom.us/meeting/regi...

Jason Snitker Rebel. Legend. Friend. Rest in Peace, ParMaster

My wife @debdebdeb.bsky.social and I are heartbroken to share the sad news that our old friend @jasonsnitker.bsky.social AKA Parmaster, has passed away.

New $10k FULU bug bounty for Ring video doorbells just announced. bounties.fulu.org/bounties/rin...

This is a new one for me. I'm #8 and #31 on this top 100 list. Do you want Chris the the CTO of Veracode or Chris the security pioneer. 😂 www.futuristsspeakers.com/top-100-cybe...

Can we all forget about the email disclaimers now? The information contained in this communication is confidential, may be attorney-client privileged, may constitute inside information, and is intended only for the use of the addressee. It is the property of JEE

In order to collect a bug bounty, a researcher was required to sign an NDA to not discuss the vulnerability. zuernerd.github.io/blog/2026/01...

Vulnerability disclosure norms are a control system for incentives. They made vulnerability handling predictable enough to industrialize. We get more finding, more fixing, and more secure software.

This looks interesting. Teenage hackers. I was one. I didn’t do this type of thing though. www.amazon.com/dp/133500193X

ATM jackpotting is still very much alive in 2025. Two attackers physically opened ATMs, connected a laptop, installed malware, and forced the machines to dump all their cash. DOJ convictions, prison time, restitution, deportation.

This FDA announcement says over 700 people were harmed and 7 people died due to a bug in the Abbot FreeStyle Libre device. www.fda.gov/medical-devi...

Massachusetts lawmakers introduced bipartisan bills (HD 5563 / SD 3606) to curb abandoned consumer electronics by requiring vendors to disclose software support lifetimes, warn users before end-of-life, and explain lost features and security risks.

New from Anthropic. red.anthropic.com/2026/cyber-t...

Microsoft released NTLMv2 in 1998, no doubt because tools like L0phtCrack were able crack NTLMv1 passwords with the measly computing power then. NTLMv1 is still in use today! Mandiant has now released rainbow tables for NTLMv1 that can crack any pw in 12hrs on a $600 computer.

UK NCSC: pro-Russian hacktivists are still hammering critical infra & local gov w/DDoS attacks. Low-tech, high impact, disrupting services & costing serious recovery time/money. Shouldn't critical infra & local gov be able to mitigate these attacks? What do they use? Cloudflare? Akamai? ISPs?

Tell your older relatives to turn personalized ads off everywhere. Scammers target this demographic.

“Prompt injection” is the wrong mental model. LLM attacks increasingly look like malware campaigns, not single exploits. This paper frames them as promptware and maps a 5-stage kill chain: initial access → priv esc → persistence → lateral movement → actions on objective. arxiv.org/html/2601.09...

BIG NEWS! Rachael Morrison’s JOYBUBBLES will have its #WORLDPREMIERE at the 2026 #SundanceFilmFestival (@sundance.org) on JAN 26 at 6 PM! Executive produced by @cameowood.com & Charming Stranger Films, the film will screen in person JAN 26—JAN 31 & online screenings begin JAN 29: loom.ly/xnAbh1w

"A draft amendment to the BND Act, circulating by German media, would transform the agency’s reach by authorizing it to break into foreign digital systems, collect and store large portions of internet traffic, and analyze those communications retroactively." reclaimthenet.org/germany-bnd-...

iPhones now have "delete and report spam" for unknown messages and callers. If everyone was to choose "delete and report spam" for every spam message and call would they stop? If not, what is the point?

Before the word hacker meant anything at all there was a blind kid who whistled 2600 Hz and bent Ma Bell to his will. Joybubbles tells the story of Joe Engressi, the original phone phreak and a reminder that hacking started as curiosity, play, and defiance. festival.sundance.org/program/film...

CES Worst in Show is a reminder that “innovation” now means: more attack surface, less ownership, permanent surveillance, and DRM on objects you physically bought. Congratulations to the ad-powered fridge for completing the arc. www.youtube.com/watch?v=cxZg...

“The Conscience of a Hacker” by The Mentor is 40 years old today.

Manufacturing cyber compromises are expensive. An attack in 2025 forced Jaguar Land Rover to suspend production at its factories in the UK, Slovakia, Brazil and India through September and pushed it into a quarterly loss of almost £500m. www.theguardian.com/business/202...

Outlook emailing me that someone “reacted” to my email feels very Dilbert, like the Pointy-Haired Boss getting his emails printed.

[un]prompted is a new practitioner-led AI security con taking place Mar 3–4 at Salesforce Tower in SF. If you’re working hands-on w/AI systems, I strongly encourage you to submit a talk. Take a look at the CFP & review boards guidance on the kinds of submissions we’re hoping to see unpromptedcon.org

In life, as in music, all time scales coexist. The ‘now’ is not a fleeting instant but a field that extends forward and backward through memory and anticipation. Perception and context shape how we experience this layered present.

🚨 Critical React + Next.js RCE Alert 🚨 New flaws in the React Server Components “Flight” protocol (CVE-2025-55182 & CVE-2025-66478) allow unauthenticated remote code execution on default installations. Attackers only need one malicious HTTP request to take over a server.