Chris Wysopal

31 Aug

It's the last day for early bird tickets for the PoC year of Boston's MINUTECON. I will be keynoting!

whitehouse.govExpanding Capabilities to Combat Transnational Cyber-Enabled CrimeMEMORANDUM FOR THE VICE PRESIDENT THE SECRETARY OF STATE THE SECRETARY OF THE TREASURY THE SECRETARY OF WAR THE ATTORNEY GENERAL THE SECRETARY OF COMMERCE

13 Aug

This is a pretty big shift in US cyber policy. The White House is setting up a program that would let private cybersecurity companies conduct gov-authorized operations against foreign cybercriminal groups, inc surveillance & disruption of their infrastructure www.whitehouse.gov/presidential...

13 Aug

Not exactly “hack back,” but definitely a major expansion of the private sector’s role in offensive cyber operations.

theconversation.comNew tech adds phone tracking to license plate readers, associating devices with identifiable carsLicense plate readers are widely used in the US. A new product marketed to police departments promises to add the ability to sense phones and other devices in passing cars.

11 Aug

License-plate readers are evolving into device trackers, linking cars with nearby phones, wearables and wireless devices to build an “electronic fingerprint.” theconversation.com/new-tech-add...

11 Aug

Device vendors, we need a technical fix: use short-lived, rotating device IDs so signals can’t be reliably linked to the same person or vehicle over time.

darkreading.comMultistate Water System Attacks Widen, Iran SuspectedAttacks targeting water systems just keep flowing across a dozen states, against ill-secured, Internet-exposed PLCs.

11 Aug

"The most severe activity known to date involved Georgia, where cyber activity against Clayton County reportedly caused a water pressure drop and forced the agency to issue a boil water advisory." www.darkreading.com/ics-ot-secur...

4 Aug

Unsupported connected devices are becoming a global security risk, but public policy has not kept pace. At BSides LV, Paul Roberts and Silas Cutler will discuss emerging state legislation requiring clear end-of-life disclosures, minimum support transparency, and responsible vendor exit plans.

wired.comThe New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security KeyCreated by legendary hardware hacker Andrew “bunnie” Huang, the badges for this year’s famed security conference aim to push the boundaries of security and transparency.

31 July

Wow! This is an amazing and useful @defcon.bsky.social badge! www.wired.com/story/defcon...

cybersecurity-insiders.comSoftware Supply Chain Security Miss Drained $3M from PolymarketSoftware supply chain security failures contributed to the $3M Polymarket loss, exposing risks from compromised dependencies and weak software controls.

22 July

Polymarket lost ~$3M and their smart contracts worked perfectly. A compromised frontend vendor injected malicious JS client-side. The breach lived in the browser — the layer nobody monitors. Audit what runs, not just what you wrote. www.cybersecurity-insiders.com/software-sup...

Electronic Frontier Foundation

22 July

Who should get charged with a CFAA violation for the AI agent breach of Hugging Face? The people who built the model or those that operated it unsafely? Someone else?

Chris Wysopal reposted

@eff.org

17 July

If you own it, why can't you fix it? Join EFF, Adam Savage, and iFixit CEO Kyle Wiens on July 23rd for a live conversation about the Right to Repair movement. We'll answer that question and yours during the live Q&A. eff.org/livestream-r2r

Chris Wysopal reposted

MinuteCon

@minutecon.org

13 July

Our first-ever keynote: Chris Wysopal @weld.bsky.social. Original L0pht vulnerability researcher, Veracode co-founder, and one of the first people to warn the world about insecure software. Boston hacker history, back on a Boston stage at MinuteCon. April 30 – May 1, 2027 minutecon.org

10 July

There is a new cybersecurity con coming to Boston this spring, MinuteCon! Boston has a long history of cybersecurity impact going back to the @l0pht.bsky.social days in the 90s but hasn't had a major hackerish oriented con since Source Boston 10 yrs ago. Looking forward to this! www.minutecon.org

Chris Wysopal reposted

No Hat Con

@nohatcon.bsky.social

6 July

KEYNOTE UNLOCKED_ Excited to have @weld.bsky.social opening up our conference with his Keynote: “WHEN EVERY ATTACKER CAN HAVE A RESEARCH TEAM” > Access talk details: nohat.it/talks #nohat2026 #CyberSecurity #InfoSec

fighttorepair.substack.comThe Deere Dam Just Broke: FTC Settlement of Class Action Empowers Farmer RepairThe Federal Trade Commission, joined by the attorneys general of 5 states, announced a settlement with Deere & Company that dramatically expands farmers right to repair their agricultural equipment.

9 July

Big win for farmers right to repair! fighttorepair.substack.com/p/the-deere-...

@bsky.realhackhistory.org

6 July

I'm very excited to speak and meet new colleagues at No Hat in Italy this October!

No Hat Con@nohatcon.bsky.social

Chris Wysopal reposted

—>realhackhistory.org

6 July

Replying to @bsky.realhackhistory.org

A third #FOIA release from the #FBI for records on broadcast signal #hacker Captain Midnight and this time it is a recording of a radio interview with the man himself on Portland's KXL radio station at midday. 1986 - I'm unsure of the exact date but it was before he surrendered himself to the feds.

Katie Moussouris (she/her/she-hulk/she-ra)🌻

19 May

28 years ago today, 7 members of the hacking group L0pht Heavy Industries told the U.S. Senate they could "shut down the internet in 30 minutes."

Chris Wysopal reposted

@k8em0.bsky.social

13 May

Couldn’t agree more with @weld.bsky.social about @windowsnyder.bsky.social for @darkreading.bsky.social being “one of the most important security leaders of the past two decades," for her ability to achieve systemic change. Great #Darkreading20 special coverage.

Dark Reading@darkreading.bsky.social

As part of Dark Reading's 20th anniversary special coverage, we profile the CISOs, founders, researchers, criminals, and policymakers who rewrote the enterprise risk playbook. Read the full story here: https://bit.ly/438hvE8 #DarkReading20

bit.ly20 Leaders Who Built the CISO Era: 2 Decades of ChangeFor Dark Reading's 20th birthday coverage, we profile CISOs, founders, researchers, criminals, and policymakers who rewrote the enterprise risk playbook.

Katie Moussouris (she/her/she-hulk/she-ra)🌻

13 May

Chris Wysopal reposted

@k8em0.bsky.social

27 Apr

AI is not going to flood you with real vuln reports unless you have a ton of real vulns. Adding resources to a vuln disclosure process to keep up with triage & bug fixing is a temporary investment at the loud end of the problem, not the right end.

Chris Wysopal reposted

Patrick Gray

@patrick.risky.biz

3 Apr

We've just published the 2nd episode of our documentary series "How the World Got Owned". This one looks at the 1990s and features interviews with Kevin Poulsen, @weld.bsky.social, @thedarktangent.bsky.social and Alpeh One (Elias Levy). Subscribe to the stories feed now! risky.biz/HTWGO2-stori...

30 Mar

Phrack call for papers is out! Check out the cool demoscene graphics at phrack.org

youtube.com[un]prompted 2026 - YouTube

25 Mar

I’m excited to let you know that the talks from [un]prompted—the AI Security Practitioner Conference—are now live on YouTube. No fluff, no hype—just real-world AI security from people actually doing the work. www.youtube.com/playlist?lis...

it4sec.substack.comRemote Code Execution (RCE) in Yamaha synthesizers: an exploit in MIDI files & a hidden backdoor 🎹♫💉👨🏻‍💻🎉Security researcher and musician Anna Antonenko, aka “porta,” shares her security research on the Yamaha PSR-E433: it looks like the device accepts special MIDI messages that allow commands to be exec...

17 Mar

RCE vulnerability in the Yamaha PSR-E433 synthesizer, discovered by Anna Antonenko, allows exploitation through crafted MIDI files that trigger a hidden firmware backdoor with hardcoded password "#0000". it4sec.substack.com/p/remote-cod...

helpnetsecurity.comSecurity debt is becoming a governance issue for CISOs - Help Net SecurityA new security debt report shows 82% of organizations carry year-old flaws as high-risk vulnerabilities rise and fix timelines remain long.

12 Mar

Doesn't everyone watch Akira on LaserDisc with their figurines?

Chris Wysopal reposted

Help Net Security

@helpnetsecurity.com

2 Mar

Security debt is becoming a governance issue for CISOs 📖 Read more: www.helpnetsecurity.com/2026/03/02/c... #cybersecurity #cybersecuritynews #CISO #riskmanagement @weld.bsky.social

Chris Wysopal reposted

Recurity Labs

@recurity-labs.com

2 Mar

We wished we had more time to find the right words, and it is with deep regret that we have to tell you that our founder Felix “FX” Lindner passed away on 2026-03-01. blog.recurity-labs.com/2026-03-02/F...

blog.recurity-labs.com Farewell, Felix · The Recurity Lablog

Chris Wysopal reposted

Jeff Moss

@thedarktangent.defcon.social.ap.brid.gy

2 Mar

RIP FX - You are a legend

us02web.zoom.usWelcome! You are invited to join a meeting: Jason Snitker "Parmaster" Memorial. After registering, you will receive a confirmation email about joining the meeting.Debra Kavaler Wysopal will be hosting this online memorial service for Parmaster along with Jason's family from Atlantic City, NJ. Confirmed Speakers: Par's Aunt Deb Mudge John Lee Tom Sloan (former...

27 Feb

🕯️There will be a online memorial for Par 🕯️ Jason Snitker "Parmaster" Memorial Service Feb 28, 2026 04:00 PM Confirmed Speakers: Par's Aunt Deb Wysopal Mudge John Lee Tom Sloan (former Secret Service) Registration Link: us02web.zoom.us/meeting/regi...

Chris Wysopal@weld.bsky.social

My wife @debdebdeb.bsky.social and I are heartbroken to share the sad news that our old friend @jasonsnitker.bsky.social AKA Parmaster, has passed away.

27 Feb

If you have any photos or stories to share please reply here. This is a photo of Par in Times Square during HOPE in 2006.

Chris Wysopal reposted

deb kavaler

@debdebdeb.bsky.social

26 Feb

Jason Snitker Rebel. Legend. Friend. Rest in Peace, ParMaster

My wife @debdebdeb.bsky.social and I are heartbroken to share the sad news that our old friend @jasonsnitker.bsky.social AKA Parmaster, has passed away.

There will be an online memorial gathering on Feb 28. More details to follow.

The old-school hacking community has lost a true original. Rest in peace, Par. If anyone has stories or memories, please share them here.

My wife @debdebdeb.bsky.social and I are heartbroken to share the sad news that our old friend @jasonsnitker.bsky.social AKA Parmaster, has passed away.

His story in “Underground” includes the Citibank investigation that helped trigger that pursuit, as well as his time in custody at Rikers Island where he somehow found himself playing Dungeons & Dragons.

Par’s life reflected both the intensity of the early hacking world and the very real consequences that came with it. He was part of a generation exploring the edges of a new technological landscape before most people even knew it existed.

My wife @debdebdeb.bsky.social and I are heartbroken to share the sad news that our old friend @jasonsnitker.bsky.social AKA Parmaster, has passed away.

Par was one of the sharpest & most elusive minds of the early underground hacking scene. As chronicled in “Underground,” he spent years navigating the emerging digital frontier, connecting with hackers internationally & staying ahead of US Secret Service during a long investigation in the early 90s

bounties.fulu.orgRing Video DoorbellsThe ProductRing, owned by Amazon, makes Video Doorbells, which are widely used doorstep-monitoring cameras. Ring doorbells released in 2021 or newer are eligibl…

19 Feb

New $10k FULU bug bounty for Ring video doorbells just announced. bounties.fulu.org/bounties/rin...

futuristsspeakers.comTop 100 Cybersecurity Thought Leaders | #1 Scott SteinbergTop 100 cybersecurity thought leaders list: Hire famous AI & IT digital transformation consultant and futurist celebrity keynote speaker Scott Steinberg - 3000 brands served!

6 Feb

This is a new one for me. I'm #8 and #31 on this top 100 list. Do you want Chris the the CTO of Veracode or Chris the security pioneer. 😂 www.futuristsspeakers.com/top-100-cybe...

3 Feb

Can we all forget about the email disclaimers now? The information contained in this communication is confidential, may be attorney-client privileged, may constitute inside information, and is intended only for the use of the addressee. It is the property of JEE

3 Feb

Unauthorized use, disclosure or copying of this communication or any part thereof is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by return e-mail or by e-mail to jeevacation@gmail.com <mailto:jeevacation@gmail.com> ,

In order to collect a bug bounty, a researcher was required to sign an NDA to not discuss the vulnerability. zuernerd.github.io/blog/2026/01...

28 Jan

Vulnerability disclosure norms are a control system for incentives. They made vulnerability handling predictable enough to industrialize. We get more finding, more fixing, and more secure software.

28 Jan

Hackers & vendors working together on coordinated disclosure led to working together to secure products, systems and networks