Make. It. Stop.

@hrbrmstr meanwhile, huge shoutout to the real staffers who actually make this stuff work and who’re feeling VERY TIRED for a variety of reasons rn

Spiffy pre-print by @horizon3ai folks that used the Honeyquest framework on AI-based attackers — https://arxiv.org/html/2606.21037v2

Here's a quick write-up on it (unless you like reading academic papers) — https://ai.rud.is/posts/2026-08-18-rethinking-cyber-deception-for-ai-attackers

BUT I would encourage folks to pore over the references the H3 team has in the paper. They're a gold mine.

I am *shocked* that lazy, juvenile staffers and lazy, evil lobbyists farm out this work to AI bots (likely the free tier and with equally lazy prompts).

https://www.politico.com/news/2026/08/17/ai-slop-lawmakers-congress-01008376

The @CVE_Program is a whole ecosystem — Top-Level Roots, Roots, and hundreds of CNAs organized under them.

You can now explore that entire hierarchy directly in Vulnerability-Lookup: browse the structure tree, unfold the CNAs operating under each root, jump from any CNA to the vulnerabilities it has assigned, and see the latest publications per root at a glance.

Try it on https://vulnerability.circl.lu the instance operated by @circl .

#OpenSource #CyberSecurity #Vulnerability #CVE #RSS #ThreatIntel

The site observatory bot picked up

```
"socthreebot/1.0 (+https://socthree[.]com/about; discovering publicly published SOC 3 reports)"
```

yesterday.

This site — https://socthree.com/ — crawls the internet for SOC 3 reports (public version of SOC 2) and keeps track of relevancy status (current, stale, unknown).

Neat!

Every morning when I get up, I check social media, to see what has happened in the war during the night.

Almost every day, Ukraine has hit a military target, Russia has struck a civilian home, and the free world shrugs it off saying, “Ukraine’s got this”.

This morning, Russia hit Pechenihy in the Kharkiv region with a missile, hitting a café and a post office, killing 10 civilians and wounding 17.

We need a D-day intervention.

The coalition of the willing needs to step up and be willing.

FWIW

```bash
$ ollama run hf.co/dealignai/Qwen3.8-27B-CRACK-GGUF
```

🤩

Jeebus this entire piece is a phenomenal piece of writing.

We placed a tracking device in a shipment of rare books to see which AI company was buying it, and found an Amazon facility where Amazon scans and destroys books.

https://www.404media.co/we-tracked-a-shipment-of-rare-books-it-ended-at-an-amazon-ai-training-facility/

ZOMGOSH #DUICKDB 2.0 IS COMING SOON WITH TRIGGERS AND A REAL SERVER MODE AND EVEN MORE CRUNCHY GOODNESS!

https://duckdb.org/2026/08/17/duckdb-20-highlights

#EPSS gives us a lens into global exploit pressure.

But to further understand our vulnerability risk posture, we need to adjust that pressure through the lens of our own controls — and their measured effectiveness.

In my latest blog, I show you how to take EPSS asset-level exploit likelihoods (EPSSg) and update them with #Bayesian inference to reflect control effectiveness.

It’s a simple but powerful way to turn the Swiss cheese model from a metaphor into something measurable — a living model that evolves as new evidence arrives.

#cve #infosec

https://stephenshaffer.io/quantifying-swiss-cheese-the-bayesian-way-b2b512472d85

@hrbrmstr FYI there is no Monocacy County in Maryland.

RE: https://infosec.exchange/@denzuko/117111158674464609

more of this, pls

what about itasha "painful car"?

"The experiment confirms that beliefs translate weakly into intended action."

O_O

#doomed

https://www.ft.com/content/e04f286c-f5ed-46d1-8e3f-0bbe4cce4d3e

(paywall free) https://freedium-mirror.cfd/https://www.ft.com/content/e04f286c-f5ed-46d1-8e3f-0bbe4cce4d3e

Hetzner is now only offering Qwen3.6 and Qwen3.8-27B on their experiments api.

I read Anthropic's August 2026 risk report with a sole focus on cyber takeaways so you didn't have to: https://ai.rud.is/posts/2026-08-15-anthropics-august-2026-risk-report-reading-it-for-the-cybers

Interestingly enough: there is no dedicated section on cyber despit it being a throughline for the entire report. O_o

Google didn't bother releasing a summary update for Chrome Stable on Desktop last week b/c it was 'early'. It just has a note to go read the log o_O — https://chromereleases.googleblog.com/2026/08/early-stable-update-for-desktop.html

Said log — https://chromium.googlesource.com/chromium/src/+log/151.0.7922.138..152.0.7977.42?pretty=fuller&n=10000 — is yuge and takes a bit to load b/c it's generated on the fly on the backend from the git log.

How is this helping defenders and researchers, again?

I may try to distill it later today.

Weekly Bulletproof Hosting Report is up using intel from @HoneyLabs, @censys, & my tiny fleet — https://ai.rud.is/posts/2026-08-17-weekly-bulletproof-report

Certificate common names `YE1`, `YE2`, `YR1`, & `YR2` appear across HOSTKEY, ROUTERHOSTING, PFCLOUD, PLI-AS, & KAOPU-HK. Combined counts exceed 70K certs. The issuer names `XUI.one` & `Gozargah` appear on PFCLOUD. These names identify X-UI proxy panels. The operators run a shared panel toolchain. (1/3)