I understand that there are people who think we must pass through the Vulnpocalypse to get to Vulnhallah, a time when all code is written by AI then checked by AI and has no vulns that AI can find, while we sit back and feast. But I don't think we can get there from here.
I see it is time to change this slide in my upcoming talk from "Vulnpocalypse Now?" to "Vulnpocalypse Now!"
No, really, these PHP vulns are quite serious and you should drop everything and patch. https://www.php.net/index.php
Another day, another story where my work on mass surveillance overlaps with my work in domestic abuse in the most terrible goddamn way.
WaPo found cops who kept using Flock to spy on women after they left the force.
One used it for five years after retirement, tracking his wife during a custody battle.
Another ran searches while he was suspended (and later fired) after killing a 15-year-old boy.
When a platform offers you privacy, always ask "Privacy from whom?"
"Of course, while locking a chat can limit access, it doesn’t address concerns about how sensitive information is stored or handled...locking a chat doesn’t create end-to-end encryption or a separate encrypted vault, change how long it retains the chat, remove information that ChatGPT remembered before a chat was locked, or change the 'Improve the model for everyone' setting."
https://techcrunch.com/2026/10/20/chatgpt-now-lets-you-lock-your-chats/
New York is the one place on Earth where I quickly realize that I don't jaywalk aggressively enough.
Today I learned that Andy Ngo has written a book about the Zizians.
Everything about that sentence is deeply, deeply cursed.
"This report exposes zero-click spyware delivered via targeted ads, which we call AdFection, and is the first technical demonstration that mercenary spyware is being distributed via targeted advertisements."
True. All of the other examples I can think of involve govts that roll their own malware.
Additional highlights from the Citizen lab report include:
"Discover-Tech...also leveraged the European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union."
https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
If you would like a good laugh, please note that Candiru has changed its name to "Integrity Labs."
Citizen Lab finds Candiru's mercenary spyware on the phones of Al Jazeera journalists, infected using Discover Tech to deliver the malware using targeted ads. https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
ChatGPT now lets you target ads based on specific prompts or any phone number or email address. This is absolutely 100% going to be used for harassment.
https://www.404media.co/how-chatgpt-targets-ads-to-you-based-on-your-prompts-phone-number-and-email/
Elevation Lab pulls its AirTag silencing tool. Good things can still happen, occasionally through the power of shame. Kudos to @glennf on this one: https://www.elevationlab.com/blogs/news/an-apology
RE: https://mementomori.social/@maijanlainen/117435589734913543
My Mastodon replies continue to be very cool and normal.
so @kimzetter absolutely killin it today reporting on implants in crypto wallets - including some from authorized sellers.
https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/
https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants/
A lot of people I know shared posts about the Yandex datacenter bombing resulting in a decrease in Russian misinformation/disinformation bot activity, sometimes with charts. Let this be a reminder every one of us could be fooled by a story that we really want to be true.
RE: https://hachyderm.io/@evacide/117412045251981085
I have now heard from several maintainers of open source projects who tell me that this is something they specifically asked for and/or that it is a big improvement on the status quo, so this hot take was wrong.
@evacide TBF we were getting those emails anyway and the Glasswing reports are both higher quality and come with .patch files as starting off points for fixes. The reports even triage the issues rather than report everything as a level 9 CVE.
As far as damage limitation goes then, it takes the edge of all those people with claude max subs who want CVE fame and for whom claude has replaced metasploit cli as the only security tool they know
I understand that Anthropic thinks they're doing open source projects a favor here, but what they're actually doing is creating an enormous amount of work for people that they are not paying.
https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source
Another example of the ways in which misbehaving agents have affected the digital commons and some thoughts about what should be done about it.
"While OpenAI admits to agents behaving 'unpredictably', they must also acknowledge their responsibility to monitor and prevent these risks. AI companies are not doing enough to secure their systems and protect the public from the harm they cause. That burden is falling onto everyone else, including smaller organizations. At a minimum, their systems should operate in a way that non-profit website owners like us can easily identify, and choose how they interact with our services."