SecByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔

My patching software was down because it was PHP-BASED I am not making this up

Something I’ve been considering for my team is “No LLM Fridays”. Not because I have any vendetta against them, shipping code and implementing has been massively shifted. But keeping that analytical and problem solving mindset is just as vital to being effective in the future as it has always been.

Lots of burnout happening and on the horizon. How’s your SOC doing today? SREs? Tell them you noticed. LLMs have fundamentally changed the game. They’re enormous speed ups for everyone. And Risk, enterprise controls, etc are going to make it hard for everyone to keep pace with threat actors.

BOOM! This is the biggest thing since sliced bread in the Entra world. Security Default is no longer a giant ON/OFF switch. You can now exclude just individual users from policies!! 1/3

This. The model is not what’s in charge of the guardrails, and the model wants to help you (system prompt) so it will do its best to “deal with” the guardrails. Also, I’d use a separate conversation and share the bit that is being guardrailes instead of asking mid convo.

Hey wait, that’s my password. Get your own!

Donating to a good cause store.gamersnexus.net/data-dragnet

Playing a Different Game: Rethinking Modern Defense Evasion c0rnbread.com/playing-a-di... """Sometimes the most effective tradecraft isn't the most technically sophisticated. You don't always win by playing the game better and better, but by playing beyond the rules of the game.""" Mmmm hmmm...

HOLY SHIT HOLY SHIT HOLY SHIT

AI companies scraping websites at scale is a real problem. But a proposed NY law could make it harder for libraries, journalists & researchers to preserve the web and investigate the powerful. That's why we've joined @eff.org & others in a letter to Gov. Hochul. blog.archive.org/2026/08/04/i...

This is actually a great case for unlawful search and seizure. Police departments can’t own this, can they!?

iOS 27 public beta is absolutely WRECKING my battery. It seems like half of the time my phone is hot when I pick it up.

Here’s the thing - these are powered by that solar panel that isn’t covered, and I think (can anyone confirm?) they’re doing wireless monitoring too? Cover that damn solar panel and the cameras don’t have power anymore.

I’m honestly disturbed by the number of posts that follow the AI cadence now. For the same reasons that we pick up accents and speech patterns from those around us, humans are being trained to speak like AI engagement bots.

Recreation.gov casually using ID.me to force seniors into scanning and sharing their biometrics just to buy a pass? Wow. @eff.org

I sometimes hate that my laptops only finally fill out around half way through their lifespan.

This year, everyone’s mind bicycles have a massive upgrade. Self hosted or cloud provider, it doesn’t matter. 2026 is the year that unlocks all of those projects you’ve wanted to build all this time. Go do it. Iterate. It’s cheaper now than ever before, and likely ever will be again.

The U.S. government on Wednesday shut down a vital resource for keeping tabs on what powerful spying tools its agencies are buying, making it harder to reliably find out how agencies including ICE are spending taxpayers’ dollars. www.404media.co/the-governm...

Remember when we all used to talk about how invasive the “Great Firewall of China” was? Pepperidge Farm remembers. Now we buy cameras for our front doors so they can ID anyone on our street and report their location in real time. Photo IDs to use the internet. Etc etc. is this the future we want?

Anyone want to burn down some criminal's infra? app.any.run/tasks/63ba90... Live right now

New TTP added to my list today because I was working on implementing security controls. This falls into my favorite category: features with unintended consequences. Also it’s a lolbin. Not yet in LOLBAS.

Shock. cyberscoop.com/state-hacker...

Take notes. THIS is how you articulate the difference between warm fuzzy marketing and propaganda for a commercial dystopia.

Good riddance @discord.com

techcrunch.com/2026/02/09/h... Hacktivism lives.

LOOK AT THIS PRIVACY POLICY. Look at it. You can read it because they don’t need a ton of legalese to make you stop reading all the ways they’ll sell your data. They just don’t do that. None of it. tessie.com/privacy

We want the soundtrack!

Early bird tickets are still available! 🎉 Use code BS312-EB20 to get 20% off your #BSides312 ticket. Grab yours now 👉 bsides312.org While you’re there, consider volunteering and helping make the event awesome! #BSides

If you’re not watching EXO labs, and you have any good reason to run local LLMs stop now and read blog.exolabs.net/nvidia-dgx-s...

Fun way to host your payloads vmux.sdan.io

Did you know your taxes were being used to buy your flight records from commercial airlines so your movement could be tracked without a warrant?

This is fork&run to execute BOFs in a remote process, same API, and get output back over a pipe--demonstrated with Havoc. Same arch could support explicit injection. Add-in an injector artifact + psexec, could remotely run a BOF without an agent and get output back too. bofexec? :)

NEW: Apple, Google, and WhatsApp now regularly notify their users if they suspect they have been targeted or hacked with government spyware, such as that made by NSO Group or Paragon. We spoke to experts and wrote a guide on what to do, and where to go, if you receive one of those notifications.

This tool is an especially powerful and widely applicable one. Don’t get caught up in saying no, infosec.

ORLY?

0nrnicrosoft[.]com was registered last night

When 2040 me can’t give someone a dirty look without it being captured, catalogued, and sold to the surveillance state - this is one of the ways we got there.

THIS would be an awesome base concept for a team of developers to build as a learning exercise for implementing LLMs that are customer facing. www.wsj.com/tech/ai/anth...

Hey @wiz_io BurbSec really appreciates the CVS sized receipt!

Not a fan of this company, but I LOVE the 2FA explainer. Very well executed.

Interesting project. Reimplements TCG example loaders in Rust and demonstrates Rust patterns for TCG and Crystal Palace. One note: my scope, dev, tests, and unit tests are limited to MinGW. Binary transforms act on patterns gcc generates and moving away from that, you're gonna hit gaps faster.

You know what would make for an epic third party compromise? xterm.js

Fed up with this dystopian nightmare? We are too. That's why we're pushing back against surveillance tech and government censorship, both in the courts and on the streets. Help us today: eff.org/power-up

A perfect CVSS 10 🧑🏻‍🍳💋 CVE-2025-55182: Unauthenticated remote code execution vulnerability in React Server Components The vuln is in versions 19.0, 19.1.0, 19.1.1, and 19.2.0: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack Upgrade immediately!