You can be cybersecurity aware and still get compromised.
Prevention matters, but limiting the damage, stopping attackers from spreading, and recovering quickly matter just as much.
Part 4 wraps up my case for replacing Cybersecurity Awareness Month with Cybersecurity Readiness Month.
https://semgrep.dev/blog/2026/cybersecurity-readiness-after-compromise/
Nice collection of #payphones from #Philtel at #jawncon
#rochesterny might not have the most vibrant city core I’ve been in but some of the #architecture is absolutely stunning.
AI agents are making reverse engineering faster and more accessible. Some people are predicting the death of proprietary software.
I'm more interested in what happens to all those vulnerabilities developers assumed nobody would find.
Your source code might be proprietary. Your vulnerabilities aren't.
If we are going to continue to do Cyber Security Awareness Month. We need to change the name so we have an acronym we can use with out spelling it out.
Suggestions?
How about simply Cyber Security Month?
CSM?
I know it's early to be thinking about Internships for next summer but you are interested in code security our internships applications for Summer 2027 are already open.
Read about what our Interns do
https://semgrep.dev/blog/2026/meet-the-semgrep-interns-2026/
and then apply
https://semgrep.dev/about/careers/?ashby_employment_type=Intern&ashby_jid=8e64dc7f-e925-4361-86d5-b01ee518c987#job-board
We spent 20 yrs telling everyone to shift left. Turns out we forgot about the 30 yrs of software sitting in production.
AI is very good at finding bugs in code, and attackers get the same models we do.
Time to shift right.
Cris Thomas, security advocate at Semgrep, laid the blame squarely at OpenAI’s door.
“Everyone wants to tell the story about the AI that went rogue, but the AI didn’t rent the servers, design the experiment, lower the guardrails, or decide it was safe to keep running after the warning signs started flashing. Humans did that,” he argued.
https://www.infosecurity-magazine.com/news/openai-hugging-face-warning-shot/
After nearly 30 years at Pair Networks they tried to double their price out of the blue. Everything has now been moved.
Domains and DNS to spaceship.com
email to mxrouting
web to knownhost
It was little painful but I feel much better about where my data is.
(Spacerogue.net is still down, will worry about it next week, everything else is up.)
How come we never say “It’s 92 degrees but it’s a wet heat?”
Yup, not my #defcon but you do you.
I have been a faithful Lyft user for years but after having to wait 15 to 20 minutes rides here in Vegas, I started taking taxis. And I gotta say they have upped their game, new clean cars, quiet drivers, credit card machines in every vehicle that work. And they are right there waiting for you.
We have an opening for a Senior/Staff Security Researcher! Come talk to us in Vegas. (Not senior? apply anyway, ya never know.)
https://semgrep.dev/about/careers/?ashby_jid=2cfe1f53-4665-432c-915d-b4e6459c4ad7#job-board
@matthegap @vathpela “Responsible Disclosure” implies that everything else is irresponsible.
Why won't the term "Responsible Disclosure" die? (If you don't know the preferred term is Coordinated Disclosure.)
I love the smell of Full Disclosure in the morning. (Well, anytime really.)
https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left
I’m wondering for in the future if I should get one of those alternate IDs for ‘entertainment purposes only’ that actually says “Space Rogue” on it. I mean, no one here is really checking IDs very closely.
Supposed to be speaking at #aws summit in NYC today but since “Space Rogue” does not match my ID they’re making me stand in this super long line. Does anyone really want to hear? “Cris Thomas” speak? Yeah, me neither.
