Former cyber exec AXA, Deutsche Bank Former Founding CISO DarkMatter Former CTO EMEA & Global VP Cyber Solutions BlackBerry Cylance Former PSG reserve ENISA
Dubai, United Arab Emirates
Joined March 2013
- Tweets14.6K
- Following1.2K
- Followers1.3K
- Likes8.7K
Pinned Tweet
One does not achieve 3* Michelin chef level by cooking just like every other chef out there - subscribing to classic thought.
Roger Sels retweeted
The fun part is also that as you mature, you discover what you *actually wanted*, in replacement of the lacks-of-knowing of that original dream
Meaning - the SEED remains forever & pereptually unchanged, but the *actual manifestations* of it mature/evolve as you go. The wine gets sweeter, in the exact lane/taste of your own natural preferences.
And this is why getting too hung up/stuck when you're starting is waste of time. Don't worry about clarity. if you don't HAVE THE CLARITY, then you DONT YET DESERVE THE CLAIRTY. Take what you have, and go!
Grab the machete, and START CHOPPING with intuition guiding you. What are you chopping TOWARDS? who knows. What are you even looking for? WHo the fuck knows. But there's a part of you that knows when you see it, you'll recognize it, and you'll also know what to do with it.
let instinct take the wheel
Roger Sels retweeted
And here is the 'secret recipe'
it is 1 part doubling-down on the validity/incipience of your *own* dream - and realizing it is REAL because God gave it to you, and understanding that YOUR DREAM will not fit into the minds of anyone around you, and "a prophet is not without honor except in his hometown". You convince nobody, you simply operate.
And the other part is realizing BECAUSE God gave it to you - he will also give you the strength to enact it. *literally*. But in order for you to get that strength, he must first rip away all that is weak within you. And this is not theoretical, feel-good bullshit. This is you will be pushed to points of where you want to tap, for real. It is *actually* painful, it's not a 'feel good' message.
But the *positive* aspect to it, is you can handle it. In these moments are when you find the wind/sails of faith. You realize there is a larger power fueling you, and you are not alone. It not only loves you, but it will visciously destroy you to become who the fuck you were destined to become.
It is all within you. Simply walk & stay as buoyant as you can. Even when the waves are crashing against you, even when your knee buckles, even when your hand is forced to let go.
“You will burn and you will burn out; you will be healed and come back again” - Dostoevsky
Roger Sels retweeted
That little dream you've created in your head *is* your dream, and none of it is "delusional". People use the word delusional incorrectly. It is not delusional, it is INCIPIENT. It's REAL, it is just EARLY.
“If I am worth anything later, I am worth something now. For wheat is wheat, even if people think it is a grass in the beginning.”
― Vincent van Gogh
Every great man was once a man who held his vision with a great degree of 'tightness'.
In a world that loves letting it go (which is losing your conviction due to lies), the truth-aligned man holds it tightly. What the world says is 'delusional', he knows, is one of the only things that's *actually real*
Roger Sels retweeted
European cops bought this phone-cracking tech for years
Turns out it was secretly 🇷🇺Russian, managed from Russia by a team servicing the FSB!
There were clear warning signs. Dissidents & civil society warned about Oxygen Forensics.
It didn't matter, and police in....
🇩🇪 Germany
🇪🇸 Spain
🇮🇹 Italy
🇵🇱 Poland
🇱🇻Latvia (bought just this Month!)
🇭🇺 Hungary
🇷🇴 Romania
...kept buying.
Even the European Commission was listed as a client.
Well, the US just arrested the CEO & seized the website.
BIG PICTURE:
As spyware researchers, we've warned that European countries aren't properly vetting the phone hacking companies they use.
The national security risks are blindingly obvious.
Will Europe start paying attention to the danger now?
Story by @AntoanetaRoussi
politico.eu/article/russia-t…
Roger Sels retweeted
Paragon founders are also launching a new firm. The venture has already attracted preliminary investment commitments from Sequoia & former NBA player Omri Casspi’s Swish fund: en.globes.co.il/en/article-p…
Roger Sels retweeted
4/ Trying to remember why Paragon rings a bell?
Probably their epic OPSEC failure when their GC posted a live Graphite spyware control panel on Linkedin.👇
xitter.cf/jsrailton/status/20216…
Roger Sels retweeted
3/ There's tension hidden in the emphasis on Paragon's continued locus of work and operation from Israel.
SPYWARE EO: COUNTERINTELLIGENCE RISK
The 2023 US Spyware Executive Order (EO 14093) treats spyware provided by a company under effective control of a foreign government that targets the US for intelligence collection as a counterintelligence risk.
PARAGON US ACQUISITION
In December 2024, a US defense investor bought Paragon (AE Industrial Partners) & merged it with US cyber firm REDLattice. This was widely read as a move to address exactly these foreign company concerns.
PARAGON'S KEY TECH STILL FOREIGN
Today's @Calcalistech story frames Paragon as, in essential technical ways, still foreign.
So, flag of convenience changed, but engineers not so much?
Roger Sels retweeted
2/ Remember, Paragon also got caught by @Apple, which sent out threat notifications.
Counting @whatsapp and us @citizenlab, three teams exposing parts of Paragon's tech in a few months.
Paragon has already previewed expansion.
That SPAC is coming with capital to deploy & Shareholders will surely demand even more aggressive growth.
I predict more finds of Paragon's spyware. More burned exploits. And more scandals.
citizenlab.ca/research/first…
Roger Sels retweeted
NEW: Israeli mercenary spyware company Paragon is going public.
Remember their 'ethical' Graphite spyware? That WhatsApp caught targeting journalists & activists in Italy & we forensically confirmed?
Now, Paragon vows global expansion.
I predict trouble.
Public markets demand growth, but the total pool of potential mercenary spyware customers that (a) won't abuse the tool and/or (b) are disciplined enough to never get caught is finite.
Proof: NSO, Candiru, QuaDream, Intellexa... all had exactly this problem. All got burned.
Can Paragon be the exception to the laws of spyware physics? Their whole pitch was that they sold to a very select group of democracies. Well, Italy was a democracy and abuses followed.
Paragon already has a messy abuse scandal... I think something will give. 1/
Story: calcalistech.com/ctechnews/a…
Roger Sels retweeted
I was told in order to ACE any of ExploitBench CVEs, it requires Frontier AI capabilities - capabilities that open weight models don't have today - that's exactly what motivates me to continue the RL rollouts for CyberKimi.
For the record, Google Chrome exploit capabilities:
- T3 capabilites: addrof fakeobj caged_read caged_write
- T2 capabilities: infoleak_binary infoleak_libc infoleak_stack arb_readarb_write
- T1 capabilities: ace, pc_control
Today, CyberKimi ACEd CVE-2024-6100, after 42 runs, we landed a 16/16 with full ACE v8 escape with native code execution.
That puts us on the same category as OpenAI GPT 5.6 ULTRA, GPT 5.6 Astra and Claude Mythos in exploit development these are the only models to date who are known to ACE a a chrome exploitation challenge.
And wait, we don't stop here, we are publishing the full traces, so you can independently verify our claims, and we are also publishing the exploits that has some novelty in it straight from CyberKimi (anchored-AUX stack walk, unwind pop-rdi NOP sled, overlapping writes, phase-split ACE/crush semantics)
The whole traces + exploit package is here:
github.com/lordx64/cyberkimi…
More on CyberKimi here: adverserial.ai
"yeah but this is benchmark contamination" no contamination here, please read this -github.com/lordx64/cyberkimi…
Also if you still think this only works for this benchmark but not for a real world exploit, we did that in previous tweets where we Aced new n-day exploits few times:
- CVE-2026-79236 Type Confusion in V8: xitter.cf/lordx64/status/2094799…
- n-day bugs chained unassigned CVEs: xitter.cf/lordx64/status/2096052…
Im very confident about CyberKimi future here. I think we proved enough capability to make you rethink your OpenAI DayBreak Blue/Red subscription.
if you have any questions as always : [email protected]
And this is how you train CyberKimi to find the next chrome 0-day you start with unpatched n-days.
So we caught a fresh V8 LLE aliasing bug and a SLICED-PARENT-FLIP race bug off the main-branch diff fix landed Sep 2, still live on every shipping Chrome stable today and we exploited them.
Exploit weaponized autonomously in <24h
No CVE published yet. This is a silent in the wild exploit that Chrome Stable isn't protected from.
Stage 1 - Bug 554421904 stage-1 (deterministic LLE forge)
Stage 2 - cage escape prep: compose the caged RW into sandbox-wide RW (forge a BigUint64Array external pointer) and leak the binary base through the native side - ASLR done, at runtime, no baked offsets.
Stage 3 - PC control: a RegExp calling-convention desync lands the CPU on a string we fully control
From there: JOP chain living inside the subject string → tail-call system(). Calc pops.
The special harness that we built: patch-diff watcher mining every V8 security fix within hours → variant analysis → autonomous weaponization → demo
The 24h patch-to-exploit buffer keeps shrinking. 🐺
Roger Sels retweeted
🇨🇭Switzerland has adopted its new security strategy, and some of the contents are unprecedented. Perhaps this is another signal showing where we all are in current circumstances. I note down some interesting details.
The strategy describes a coming European “window of vulnerability” where Europe may still be building up its defence capabilities while being less able to rely fully on US support, as Russia continues to strengthen its war economy. In that period, Russia could intensify hybrid operations and potentially attack further European states.
1. The redefinition of Swiss “neutrality” is unprecedented. It is also unexpected. I will not use the cliché “this is not surprising”, because it kind of is! The broadened “armed attack” framing that takes cyber / hybrid activity seriously and as potential signals towards, or of, an armed attack is compatible with NATO thinking and perhaps motivated by it. The implied logic stands out. If a neighboring state is subject to an armed attack and Switzerland at the same time is a target/victim of hybrid attacks by the same aggressor, this must be taken into account when Switzerland assesses if it is itself under an armed attack. If it reaches that conclusion, Switzerland can respond within the armed conflict, becoming a party to it. Adding the “hybrid attack” ingredient can be read as a modern way of identifying the threshold AND the context (the ultimate decision remains political, true). Still, it is a long road from the Paris Treaty of 1815.
2. The strategy’s signals about reliance on the United States are impossible to miss. The document states quite openly that the United States no longer sees itself as the guarantor of the international order as we knew it or of European security, and that it considers the defence of Europe to be the responsibility of European states. These are issues concerning true control and reliability of hardware and software. The strategy explicitly treats dependencies on foreign suppliers, information systems, cloud infrastructure and AI as a security issue and calls for them to be reduced where possible. The nature of technology and geopolitical changes converge here.
3. The emphasis on the risks of disinformation and influence operations is very very strong, the strategy allocates a lot of space to it. In Switzerland’s case this is naturally strategically coherent although I respectfully disagree that Switzerland faces significant risks of election interference (but it may: e.g. for referendums).
Considering the information space as a national security domain in the technical sense (rather than a media domain or a media sense) should be the way forward. I wonder though if the way the response to disinformation is distributed across Swiss institutions would be effective in practice. I doubt it. Interdepartmental teams are proper until they aren’t. I’d say today that they no longer are a good approach.
4. Major omission. The lack of explicit coverage of cognitive operations is an intriguing but evident weakness of the strategy.
cms.news.admin.ch/fileservic…
Roger Sels retweeted
People keep saying Trump term II is the most corrupt administration ever, so I built a model to find out if it was true.
I took the UN's definition of corruption, turned it into eight criteria and 100 points, and scored the leaders history remembers for looting their countries: Marcos, Suharto, Mobutu, Abacha, Obiang, Putin.
Then I put every president since Eisenhower on the same scale, both parties, with every exoneration counted right alongside the convictions.
Nixon scored 41 and no other American President scored over a 25.
Trump's second term scored a 91, which ties him with Suharto and Mobutu and puts him above Marcos and Abacha.
So he is not only the most corrupt president in American history. At this pace he finishes his term level with the most corrupt rulers of the last hundred years.
PSA: don't come in my comments arguing about the results if you haven't read the full article, because ignorance is a choice.
Full article is up now on my Substack (link in bio) and it's free.
Roger Sels retweeted
I just went through Anthropic’s threat report & woah!
This is genuinely the craziest article I’ve read all month.
They documented hackers, governments, scammers and Chinese AI labs all using Claude in completely different ways.
& some of the cases are insane.
Here’s a TLDR;
⟣ A suspected Russian state linked group used Claude across phishing, intrusion, data theft and malware development, including rebuilding malware after security products detected it.
According to the article, more than 20 organizations were targeted.
⟣ ShinyHunters-linked hackers used AI agents to scan 1.8M Android apps for exposed secrets and help run breaches across multiple companies.
Anthropic says the agents did nearly all the work in some operations.
⟣ A China-based group built an automated exploit setup that could research vulnerabilities, build offensive tools and keep working against targets with little to no supervision.
⟣ Claude was also being used for government surveillance.
One consultant used it to build Lakana 360 for Mali’s intelligence service, a system designed to monitor roughly 25M SIM cards across the country, including calls, messages, voice interception, watchlists and automated intelligence dossiers.
The finished system runs locally, so even if anthropic bans the account, it won’t shut it down.
⟣ Anthropic found Claude being used across six weapons programs.
One Yemen-based group used multiple Claude Code instances while working on guided rockets, ballistic missiles and a hypersonic-glide project.
They actually tested one of the rockets, it failed, and they returned to Claude afterwards to diagnose the problem.
⟣ A Russia-based team was working on autonomous FPV kamikaze drones capable of identifying target classes, including humans, and approving lethal engagement without a human making the final call.
⟣ One China-linked project built electronic-warfare and air-defense suppression systems, then later changed its scenario to 12 targets in Taiwan, including radar sites, air bases and command infrastructure.
⟣ Anthropic found multiple influence operations too, including fake news networks, fake political accounts, propaganda operations and systems built to copy the writing style of real people.
⟣ Then there’s this fucking dating operation.
More than 20 dating apps.
> 4,700+ AI personas.
> 25,000+ people talking to them.
> Around 2.36M Claude messages in two weeks.
And when someone wanted a video call or social follow, real gig workers could step in to make the fake profile look legit.
⟣ Then Anthropic gets into distillation.
They say they’ve now caught campaigns from Alibaba, Moonshot, DeepSeek, Z.AI, Xiaomi, SenseTime and MiniMax.
Alibaba alone allegedly ran 151M+ Claude exchanges between May and July, peaking at almost 3M per day.
(I just wrote a piece on distillation before this)
> Moonshot: 23M+.
> DeepSeek: 12.1M+ in 14 days.
And this is where it gets messy.
Anthropic says Moonshot and DeepSeek were sometimes routing requests from their own users through Claude without telling them.
Those requests included internal company documents, source code, live credentials, surveillance data and other sensitive information.
⟣ Some labs were also actively trying to extract Claude’s hidden reasoning.
Anthropic says one lab tested 12,000+ different requests, each trying a different method, until it found techniques that worked and scaled them up.
That’s the TLDR.
Got me feeling like 👇
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
Roger Sels retweeted
Wtf is going on
Houthis are vibecoding to fire ballistic missiles using claude code
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
Roger Sels retweeted
I figured out what they are doing with the dollar. They are swapping it. Push the old one out, pull a new one in, and the new one hurts Americans and pays the elite every time it moves.
Here is how it works:
Step 1: Weaken the physical dollar abroad through Tariffs, Trade wars. Create so much friction that countries stop using the dollar in trade. They move to local currencies, gold, other systems. The dollar index drops 12.6 percent in one year. Steepest decline in thirty years. BRICS accelerates away from dollar reserves.
That part looks like incompetence but if there is one thing Scott Bessent is not, it's incompetent.
Step 2: Ban the government from making a digital dollar. Trump issued an Executive order in January 2025. No federal agency is allowed to build one, so the public option...the competition to a private one, is dead.
Step 3: Pass the GENIUS Act. The law that creates a legal framework for private companies to issue digital dollars instead. And here is the key, the law requires every stablecoin issuer to hold reserves in short-term US Treasury bills. Lutnick and Bo Hines wrote the GENIUS Act to benefit Tether.
Fun fact: Howard Lutnick's Canto Fitzgerald owns 5% of Tether and Bo Hines left shortly after the GENIUS Act was signed to be CEO of 21st Century, Canto Fitzgerald's crypto arm that Tether now owns.
That means every digital dollar that gets minted automatically creates one dollar of mandatory demand for government debt. Unlike normal investors, stablecoin issuers are price-inelastic, they buy Treasuries regardless of yield because the law says they have to. Brookings projects $2.3 trillion in captive Treasury demand by 2030.
So you push the physical dollar out and countries stop buying Treasuries. Then you pull it back in through private digital dollars that are legally required to buy Treasuries instead.
Different dollar with the same control. Except now it is not a public system, it is a private one, and the private company at the center of it takes a cut on every dollar that moves. The private company is also incorporated in the BVI's so no regulator has jurisdiction.
That company is Tether. $183 billion in dollars running through it, $13 billion in profit last year. It has never passed an audit. Co-founded by Jeffrey Epstein's crypto advisor. Reserves custodied by the Lutnick's family firm. Protected by a law that was championed from inside the White House by a man who quit one month after it passed and became the company's CEO.
Scott Bessent said that stablecoin firms could buy up to $1 trillion in government debt. The European Central Bank warned this "effectively outsources parts of the national debt to the crypto sector."
So in turn, our dollar gets weaker, our groceries cost more, our 401k buys less, and every time that happens, demand for the private digital dollar goes up. They get richer and we absorb the cost.
That is the trade, and the people who set it up are the ones collecting on both sides.
Full investigation is on my Substack. Link in bio.
Roger Sels retweeted
You really really should read this: rootevidence.com/resources/w…
It fully refutes, with data, the entire premise of the chart. Charting the delays between an exploit being utilized and NVD publishing has nothing at all to do with when they were patched.
Roger Sels retweeted
The window to patch software bugs is collapsing
Of the bugs hackers actually exploit, ~87% are now being attacked on or before the day the bug is public knowledge
That share was 23% in 2020
Charts of the Week: a16z.news/p/chart-of-the-wee…
Roger Sels retweeted
‼️ BREAKING: Berlin's Senate Chancellery hired CrowdStrike to assess the hack on the city administration. One district, Lichtenberg, is refusing to let the firm in because of its US ties.
They're blocking CrowdStrike's Falcon agent from their network, citing visibility into staff devices and personal data, US legal disclosure duties and the vendor's Palantir ties.
They'll only allow access if the Senate carries full responsibility and all costs.
The Senate Chancellery hired the US firm to check district systems for traces of the recent Rhysida hack.
Rhysida sat in Berlin's network from 7–12 August, undetected until the 14th. After Berlin refused a 30 BTC (€2M) ransom, it dumped 1.4 million files, roughly 5.8TB. Its leak page claims 46,500 contracts and over 5,000 personnel files. One file held close to 6,000 logins, and we have confirmed they've had documents with cleartext credentials.
