new @velocidex artifact and write-up detailing CVE-2025-14847 and how to detect #MongoBleed from @eric_capuano 🤓🔥🦖 https://t.co/je4XU0j7Fp

@karpathy Opus 4.5 is pretty good

the team you build is the company you build

PSA from @CuratedIntel, CLOP is attacking CentreStack file servers 👇

Heads up - active exploitation of Cisco Secure Email Gateway / Cisco Secure Email and Web Manager appliances with the Spam Quarantine feature exposed to the internet. https://t.co/2PWrNGHcvN

Happy Birthday Commander Keen!

Pushed a new update to https://t.co/9CqANckHK0 -- it now scans for the RCE payload via reflection. Use the --waf-bypass flag to bypass WAFs, works well for Cloudflare/AWS. Other WAFs might need tinkering with the payload, depending on whether they don't have a max context limit.

An unauthenticated RCE PoC for the React vuln (CVE-2025-55182) is now public. Confirmed to work on my test setup (Next.js 16.0.6 with React 19.2.0).

successful agent engineering is just repeating "bitter lesson will kill this some day but hey this works for now lets do it" again and again until agi

Sharing an interesting recent conversation on AI's impact on the economy. AI has been compared to various historical precedents: electricity, industrial revolution, etc., I think the strongest analogy is that of AI as a new computing paradigm (Software 2.0) because both are

The details on the CVSS 9.9 request smuggling in Kestrel are finally out! Great find by @praetorianlabs. https://t.co/ej5QVIbm04

ultimately, what happens when individual devs can build software at the complexity level of (today's) leading software companies

testing is getting easier and better, and with testing comes visibility to underlying issues, but... if i have to bet, we're headed for more and more exploitable logic bugs in the future

this is not /necessarily/ a bad thing, complex software can handle more complex cases, but with complexity comes insecurity

almost everyone is underestimating just how complex software systems are becoming. llms may have enabled 3x productivity, but also, 10x complexity

So everyone else reads "Attackers were in our network for at least 12 months." as "We only keep logs for 12 months, so who knows how long they were in there." too, right?. 😏

The idea that every technological innovation cycle should produce exactly one bubble is ludicrous. Astrology pretending to be economics.

MATH

SCIENCE