dmnk

You love to see it. (for non-tech peope: embedded devices won't usualy support cert revocation, and eMudhra leaked root certs, so reverse engineers can impersonate 'the mothership' to their devices. Expect more of these! 😻)

🥶

(the best thing about PHPocalypse is that, historically, there's at least a 20% chance that their patch is going to create a new 0day or unblock a different one ;)

This *literally* won the internet

You can do `mitmproxy --emudhra` now: www.mitmproxy.org/posts/releas...

Dumping Encrypted Viltrox Lens Firmware - two times blog.29b.net/dispatches/v... Two lenses, two different microcontrollers, two different readout bypass exploits, and two different e-mount implementations.

Agents are so good in plumbing and porting. They would totally make apples and oranges compare

All vendors should have a plan for rapid remediation in the case of active exploitation. Here’s some emergency fix strategies we’ve seen over the years: projectzero.google/2026/10/emer...

Am I the first one to run a 35B model on Android? It's the Edge0 / quen35b quantized MoE guy with a Rust Vulkan inference engine

[RSS] Why is the x86 undefined instruction called ud2? Why 2? devblogs.microsoft.com -> Original->

Oh look, new version of #LibAFL !! With 0.16.0 we moved non-fuzzer parts into own crates. Crates for pinning cores, rngs, collecing BSODs, and generally helpful rust stuff. Have fun using them for other projects <3 A lot of actual #fuzzer improvements, too, read more at github.com/AFLplusplus/...

Buing an @ifixit.com kit looks cheap at first, but there's a hidden cost: None of the devices I open work afterwards 😬

md-tmpl - strongly typed markdown templates. Writing markdown templates has never been this error free. github.com/domenukk/md-... #markdown #prompt #templates

Cool stuff, binary-only fuzzing of iOS kernel yungraj.com/Fuzzing-macO...

everything is a bytecode-targetable virtual machine if you look at it sideways. JBIG2 image decompression? virtual machine. x86 mov instruction? virtual machine. truetype fonts? virtual machine. Magic: The Gathering? believe it or not, also virtual machine.

accidentally ended up on the news arstechnica.com/security/202...

I'm sorry, what? In writing my first monograph, I spent six weeks trying to track down a citation in TWO languages I didn't know. And good thing too, because the citation was wrong. That's scholarship. That's research. You know, the thing we're trained to do?!?

My team on fire 🔥🔥

the bun is now rusty, I repeat, the bun has been rusted: github.com/oven-sh/bun/...

Cool stuff, #go fuzzer powered by #LibAFL blog.trailofbits.com/2026/05/12/g...

C has a borrow checker it’s called mythos

bun appear to be experimenting with a million line claude port from zig to rust lol

Just cleaned my 1TB(!) cargo targets folder.. Lol.. How hard can it be to drop stale caches? 🦀🦀🦀 #rust

This paper finds that Rust on an microcontroller costs you about 10% extra flash space, actually saves you a bunch of RAM, and takes no extra time to deliver (as compared to C). Seems about right - especially as the C version needed a heap and the Rust version did not. arxiv.org/pdf/2604.25679

Original->

creepy (black box is me redacting the screenshot, it was 475 words of markdown pasted in)

Reminder! Today is the submission deadline for the first ever Conference of Synthetic Security Research @synsec_ai, so unless you want to gamble on a(nother) extension, warm up those agents and get those papers submitted!

AI is cooking to hard bughunters.google.com/blog/evolvin...

Our 2026 agenda is live! 🔗 offensivecon.org/agenda

LLMs are likely going to be the mediating lens through which large swathes of the population make sense of the world around them on political issues, & it's very bad that a man who has a strong case for being one of the worst people alive is one of the few to be actively trying to exploit this

Don't you just love it when your Agent announces everything works and then lists the six or seven failures it found and ignored..

AI is not going to flood you with real vuln reports unless you have a ton of real vulns. Adding resources to a vuln disclosure process to keep up with triage & bug fixing is a temporary investment at the loud end of the problem, not the right end.

🔥 Our academic keynote at #FUZZING'26 is online! Advancing from "What the fuzz?" to "All the Fuzz" by Mathias Payer (@gannimo.bsky.social). 🌍 fuzzing-workshop.github.io youtu.be/In3kRAVVbzQ?...

Very much in the mode where I'm hand-writing unsafe Rust code and shouting "PROVE ME WRONG" at Claude

Neat, even has #LibAFL integration github.com/cube0x8/PEMu...

The fuzzer that found project-zero.issues.chromium.org/issues?q=com... (and a number of issues prior to that as well) is now open-source: crrev.com/c/7580844 It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!

Watchdogs say the previous CEO model suspiciously started slowing down immediately after the announcement chaser.com.au/business/app...

i got irritated at the ceremony to go from a freshly-created KVM to "can run x86-64 machine code like normal" so i've wrote a small library for exactly that: codeberg.org/iximeow/asml...

If only there was a way to automate security

Go home @dropbox.com you're drunk

How cooked 👨‍🍳👩‍🍳👨‍🍳 is vuln research? ☐ Cooked 👨‍🍳 ☐ Cooked 🍳 ☐ Cooked 🔥

Very cool to see that Google is using Hickory DNS (which I help maintain) to power DNS message parsing in the Pixel firmware! Reviewing those PRs does indeed seem like a short while ago…

2 years ago I did a PoC to run #rust 🦀 in the #pixel modem Today it shipped in millions of devices! They grow up to fast! 🥲 security.googleblog.com/2026/04/brin... #rust #security #smartphone #baseband