Framing the php2shell story as "AI uncovered php2shell" is like hearing an awesome song and crediting the guitar instead of the player. It's just incorrect and steals credit from a good researcher.

The underlying bug was discovered in 2020, a related one in 2024, and they were both rediscovered again through exploitation in 2026 by a human researcher. The researcher used LLM tech to help with parts of the process, not all of it, and says so in the writeup.

https://calif.io/php2shell/

So glad someone is saying it. We've been seeing similar. LLMs are only useful for specific kinds of problems, and when applied to the wrong kind of problem, they produce garbage or waste your time. This fact doesn't change when applied to malware.

https://www.darkreading.com/threat-intelligence/ai-slop-ruining-cyberattacks

#malware

There's been so much hype, misinformation, and downright uninformed takes that exaggerate what LLM technology can do for malware developers. I can say that with confidence, because we've spent the past year (and more) looking at LLM-generated ICS malware to understand the reality. At DISC, we'll share what we learned from the experience.

DISC takes place on Nov 4-6 in Hanover, MD. Register here:

https://events.dragos.com/disc2026/12067109

#otsecurity #icssecurity #malwareanalysis

WILL TRANSCENDENT SUPERINTELLIGENCE EMERGE FROM AN INFINITELY RECURSIVE DIET OF REDDIT THREADS? THE SHITTIEST PEOPLE IN EXISTENCE WANT TO FIND OUT.

Polymorphism, detection evasion, obfuscation.. these sorts of things haven’t been difficult for literally decades now. If you think AI has significantly tipped the scales in these areas, you haven’t been paying attention to the field. AI isn’t upgrading these areas, it’s just providing another avenue.

Like just look at Tigress. They’ve been working on this since 2012, Tigress itself came out in 2018, and that’s only a recent example.

https://tigress.wtf/tigress-publications.html

We are pleased to release tmp.0ut 5 Volume!

Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!!

https://tmpout.sh/5/

I never want to see the word “actually” again. It wasn’t great before but LLMs have ruined it.

Dragos has a Vulnerability Analyst position open!

https://job-boards.greenhouse.io/dragos/jobs/5369221008

#vulnerabilityanalysis
#ICS
#ICSsecurity

We have two fully remote malware analyst positions open at Dragos!

There are a lot of malware analysis jobs where your analysis, reports, or signatures disappear into the void when you're done. But at Dragos, it's really easy to see the impact of your work on the company, product, customers, and the wider ICS industry. Malware analysis works with IR, Hunt, Detections, our OT Watch service, and even Engineering, which means you get to work on all kinds of cases from all sorts of OT environments and contribute to the defense of those sites. One week you're analyzing ransomware found at a manufacturing site, and the next a trusted source is mailing you a physical CD with a sample suspected to be part of an electric-sector attack (true story, I swear). And every once in a while, a sample you analyze makes the news.

It's a meaningful job with a lot of responsibility. And crucially, it never lets you forget that you're contributing to an important mission.

https://job-boards.greenhouse.io/dragos/jobs/5371376008

#malwareanalysis #reverseengineering

I used to spend hours finding wrong answers to Linux issues on Reddit before giving up and figuring it out myself. Now, an LLM gives me the wrong answers instantly, boils the ocean, and forces me to manually solve the problem sooner. I feel so productive!

Diving into the depths of Widevine L3

https://neodyme.io/en/blog/widevine_l3

#Security #DRM #ReverseEngineering

Greetings! How are you all doing? It's been raining here on and off for a couple days now. But that's not going to stop #NakedDieFriday is it.

Today's exhibit is a sibling of the venerable 6502. This is almost the same, but made in CMOS: R65C02 by Rockwell. The design has been enhanced in several aspects over the NMOS one.

Full-res map: http://infosecdj.net/map/rockwell/r65c02p3/infosecdj_nikpa40x/

NOTE: The map is layered, you can see the metal layer and the poly layer.

#retrocomputing #reverseengineering #icre #microscopy

Anytime I run into a problem with a Snap package, the solution seems to be “remove the snap, install the native package”. But, when I run into an issue with a Flatpak, there seems to be a straightforward way to amend the permissions.

Is this just my anecdotal experience? Are snap permissions really so limiting that most people and package maintainers would rather just not?

AI has turned into the new Excel: the 2nd best tool for a job because most folks don’t feel like looking up a better way, or asking the AI to find an established way and using that method.

I feel as though I’ve been reading more books as a defensive reaction to all this AI nonsense. Like my brain is trying to preserve its ability to recognize good human writing. I think I need to re-read a style guide like “The Sense of Style” too.

“The AI wrote it, so it must be good” is a trap, and a poor excuse to ignore a human edit. At the very least:

- Rewrite the headings
- Remove useless adverbs (AI loves “actually”)
- Check that the flow of ideas is coherent.
- Check for accuracy.
- Ask yourself “Does this sound like me?” (Or whatever voice is required)

Otherwise, your writing will sound the same as all the other copy-pasted AI slop, and you risk having your work ignored.

My "Introduction to ICS Malware Analysis" workshop was accepted at the SANS ICS Security Summit.

You'll learn about ICS malware by analyzing samples modeled on FrostyGoop and CRASHOVERRIDE. No prior RE experience needed.

It's running twice: June 8 and June 10. Hope to see you there!

https://www.sans.org/cyber-security-training-events/ics-security-summit-2026#schedule

#ICS #malware

Quoted in Dark Reading on the latest LotusWiper release by Kaspersky. I'm always glad when our team's expertise can reach a wide audience.
We've seen an uptick in Wiper use since 2022, which makes sense. They're cheap to develop and effective at turning access into damage.

https://www.darkreading.com/cyber-risk/lotus-wiper-attack-targeted-venezuelan-energy-firms-utilities

ZionSiphon is an AI-generated, non-functional attempt at ICS malware. Malicious intent doesn't imply ability, and broken malware like this is a distraction when we have proven threats like VOLTZITE/Volt Typhoon out there hitting water utilities.:

https://www.dragos.com/blog/zionsiphon-ot-malware-analysis

#ICS #malware

Ironically, S4 dropped my talk on vibe coding ICS malware on the same day that non-functional AI-slop OT "malware" is making headlines. It’s hype “malware” distracting us from real threats.

More to say, but it's Friday :) In the meantime, I hope you enjoy the talk.

https://www.youtube.com/watch?v=v0grXXc5zgw