Teen hackers aren’t villains-in-waiting, they’re untapped defenders. We can intercept talent early, show real career paths, and turn curiosity into cyber defense. My take on building ethical on-ramps for #cybersecurity www.forbes.com/councils/for...

30 years ago today, I saw Hackers in theaters with my crew @l0pht.bsky.social Later, I met my wife @debdebdeb.bsky.social on IRC. Then I co-founded a cybersecurity company @veracode.bsky.social with fellow L0pht hacker @dildog.l0pht.com What a journey! Anyone else feeling old? Post your story.

BOSTON AREA #synthsky! Hidden Fountain is having our video release show at the French Club in N Cambridge this Saturday. Music from us, Mute City, Bell System (sifu.tweety.fish), and Kathy Snax, followed by videos and short films from Coco Roy and AV Carraway! info/tix at hiddenfounta.in.

On this Sept 11, we remember. My wife served at Ground Zero as a first responder. Yesterday she rang the radiation bell, a milestone on her road to beating breast cancer. Grief + gratitude, service + strength. Proud of her. #NeverForget #FirstResponder #BreastCancer

Top cybersecurity conferences are introducing new rules that require researchers to formally address ethics in their work. Starting with the 2026 USENIX Security Symposium, all submissions must include a stakeholder-based ethics analysis. www.helpnetsecurity.com/2025/09/08/c...

Who hacks the hackers? arxiv.org/abs/2508.21669

During a routine cybersecurity review, DHS CIO discovered significant security vulns that gave a threat actor access to FEMA’s network. FEMA CIO, CISO, 22 IT employees terminated Lack of MFA, prohibited legacy protocols, failing to fix known and critical vulns, inadequate operational visibility.

The AI Vulnerability Crisis is Coming — Can Defenders Catch Up? securityboulevard.com/2025/09/the-...

An app developer has jailbroken Echelon exercise bikes to restore functionality that the company put behind a paywall last month, but copyright laws prevent him from being allowed to legally release it. www.404media.co/developer-un...

LLM automated attacks and extortion is here www.nbcnews.com/tech/securit...

We know very little about how cell-site simulators (CSS), devices that masquerade as legitimate cell-phone towers, are being deployed in the US or globally, but with Rayhunter, we hope to change that. www.eff.org/deeplinks/2...

Applying lessons from my @l0pht.bsky.social days: transparency, collaboration, & curiosity drive cybersecurity progress. Read how we turned hacker insights into modern security practices: www.forbes.com/councils/for... #Cybersecurity #L0pht #Innovation

“RapperBot, Eleven Eleven Botnet, and CowBot, which abused ensnared IoT devices, mainly DVR devices and Wi-Fi routers, to launch massive DDoS attacks against victims in more than 80 countries” I wonder how many were EOL or were difficult to patch/secure. www.securityweek.com/rapperbot-bo...

Hackers aren’t the enemy. Ignoring them is. While cyber gangs recruit on Discord & gaming forums, the industry is missing out on young, self-taught talent. “It’s time to go back to our roots.” www.computerweekly.com/feature/Woul...

Source: Oracle Chief Security Officer Mary Ann Davidson, who joined in 1988 and became the company's first CSO, is leaving as part of a recent reorganization (Bloomberg) Main Link | Techmeme Permalink

MeshCore party!

Watching Hackers on Laserdisc!

Honored to be named an Industry Visionary in the 2025 #CyberScoop50. Special respect to Amit Yoran, who was posthumously awarded Lifetime Achievement. Amit’s vision & integrity shaped our industry. Many of us followed his lead, myself included. His example endures. cyberscoop.com/cyberscoop-5...

New @veracode.bsky.social report on the security risks of software written by LLMs: "Across all models and all tasks, ... in 45% of the tasks, the model introduces a known security flaw into the code. Security performance has been largely unchanged over time, /1

AppSec and Security Engineering, what is your response to vibe coding and "fast fashion SaaS"?

Over the last 2 yrs LLMs have vastly improved their ability to write syntactically correct code, but they haven’t improved in ability to write code without vulnerabilities which is steady at 45% coding tasks with vulns.

A bug bounty program is economically beneficial to a firm when the firm has low in-house efficiency finding a vuln or when the firm faces a high proportion of coopetitive hackers (bug reporters who would otherwise pose a security risk by misusing vuln info) Paper: papers.ssrn.com/sol3/papers....

17, 17, 19 and 20 year olds "M&S was the first retailer to be attacked in April in an incident that forced the closure of its online store for nearly seven weeks." www.theguardian.com/uk-news/2025...

The Black Hat USA keynote list has dropped. Impressive!

Do we need the term PoliPhish when government officials are voice and text spoofed. www.newser.com/story/371511...

The EU Product Liability Directive will take effect Dec 2026. Software, firmware, applications, AI systems, and will now be subject to the same strict liability regime as traditional physical goods. Cybersecurity vulnerabilities will be considered product defects. www.lexology.com/library/deta...

Attacking AI agents. AIJacking? labs.zenity.io/p/a-copilot-...

"[A]utonomy means losing the plot. Humans are about to find themselves on the outside looking in, facing security decisions made by AIs whose reasoning isn’t just complicated—it’s fundamentally inaccessible." @daveaitel.bsky.social and Dan Geer on how AI is reshaping code security.

Hey everyone, I’m emceeing the @eff.org benefit poker tournament at Planet Hollywood. Shenanigans for a cause… #DFIU www.eff.org/event/bettin...

Here we go again! Thrilled to bring you this year’s @eff.org benefit poker tournament at @defcon.bsky.social! Just next door from the Horseshoe at the Planet Hollywood gorgeous new poker room!

Great article on slopsquatting and more LLM vulnerability invention. www.usenix.org/publications...

Are you reviewing your NPM dependancies for malicious code? #devsecops #appsec #npm www.scworld.com/news/complex...

"Absurd" 12-step malware dropper spotted in malicious npm packages. Supply chain attack effort used steganography, a "dizzying wall of Unicode characters" and more. www.thestack.technology/absurd-12-st...

Trump's Cybersecurity EO eliminates from Biden's last Cybersecurity EO: Mandatory, machine-readable attestations & SBOMs from every federal software supplier A CISA-run Repository for SW Attestations & Artifacts and program that randomly validates those filings & publicly names vendors that fail.

Trump issues new Cybersecurity EO

Researchers from Rice and Stanford refer to this recursive data contamination as Model Autophagy Disorder (MAD), analogous to mad cow disease. (Reminder: do not eat the neural tissue of your own species.) therepublicjournal.com/essays/the-c...

“Cryptome actually published the embarrassing US diplomatic cables that landed Assange in hot water the day before WikiLeaks…”

Cyber hard problems, unsolved technical & research problems for which progress toward solution would have a significant impact on the practical security of cyber systems, are frequently caused or sustained by human or societal factors & misaligned incentives nap.nationalacademies.org/catalog/2905...

Hyde Hack to the Future Hackathon going on at Veracode has had some incredible moments. doc’s car paid us a visit and since I’m Weldy McPond I decided to wear my orange down vest to get into my role.

Last time I was in a play, I was Falstaff in "A Midsummer Night’s Dream" (yeah, that’s not a typo. it was 5th grade). Now I’m back as Weldy McPond in @veracode.bsky.social's “Hack to the Future.” From Shakespeare to cyber-chaos—what could go wrong?

The @l0pht.bsky.social got a Battlezone machine in 1995 when it was 15 years old. It was the first FPS arcade game! Now it's pushing 45 and needs repair. It got new resistors and a cleaning. Still work to be done however as it gets to the gameplay screen and no tanks show up including yours!

"A threshold has been reached. We are effectively being DDoSed. If we could, we would charge them for this waste of our time," arstechnica.com/gadgets/2025...

At her @RSAConference keynote, DHS Sec. Noem said CISA would continue to promote “secure by design” practices in technology procurement.

I’ve been nominated for a CyberScoop 50 Award in Industry Leadership! If my work in security over the years has helped or inspired you — I’d be honored to get your vote. 🗳 Vote here: cyberscoop.com/cyberscoop50... ✅ Click Industry Leadership, find me (Chris Wysopal), hit Vote Thanks for your support

Who remembers when checking your email was opening a terminal window, SSHing into your account and running Pine?

CISA reverses course, extends MITRE CVE contract cyberscoop.com/cisa-reverse...

Remember what it was like before CVE? The authoritative source for vuln info was a mailing list list, or worse, a website that could disappear at any time. That’s what happened when Symantec acquired @stake.

Palo Alto crosswalk buttons apparently hacked to imitate Musk, Zuckerberg voices saying some wild things. www.paloaltoonline.com/technology/2...

Why didn’t I think of that!

Think e-waste is just cheap, no-name junk? Think again. Major brands like Google, Amazon & Microsoft are killing support for devices in under 2 years—piling on 130+ million pounds of trash. @securesilient.bsky.social #RightToRepair #EWaste #EOL pirg.org/edfund/resou...