A random person on the internet interested in InfoSec and NatSec. Tweets are my own and do not reflect my employers views. Engagement is not endorsement.

Nuclear bunker in New Zealand
Joined May 2021
AI has made serious offensive exploitation child's play. You should rightfully be scared at how trivial it is now to achieve RCE across a multitude of systems. What will you do to adjust your way of life to mitigate this? Now is a better time than ever to review your posture.
1
2
21
804
Lol should I drop 3 BootROM 0days now and follow the trend? :) (Nothing to do with Pixels before people start to freak out)
1
8
189
If someone were to give me a few million USD I will make an ARM SoC that you want to buy, with modern IP blocks , MTE, an Opentitan RoT and a formally verified BootROM. And that's just the start....
3
3
24
558
Can confirm this is real lmao
La vérité, c’est comme ça maintenant.
2
186
Say what you will about Windows (OS), but the NT kernel really is an engineering marvel that still puts Linux to shame in many ways. The quickest way to describe it for a programmer, is NT was more like an object-oriented language, with a strong security model from day one, whereas Linux is very…not. A lot of the “good” features in Linux feel bolted-on (SELinux, Capabilities, Namespaces) because…well they were. I love to imagine an alternate history where NT won. IMO, Microsoft *should* have made an “Open NT” in the early 2000s; not fully GPL-style open, but one where a large org could say…swap out a memory allocator for their own. (they sorta did this with limited source access, but it was too restrictive) You could imagine say…an early Amazon forking OpenNT to create an “AmazonNT” for EC2, where they have a modified scheduler, network stack, whatever. But, the security+compatibility contract keeps a stable baseline on the Microsoft side. Controversial take, but if we enter this era where users are giving AI agents increasingly higher levels of access control; the Linux kernel is legitimately a poor fit. Think about it; answer the question “What exactly is this AI agent allowed to do?” On Standard Linux, it’s disgustingly messy with lots of overlap. Do you use UIDs? GIDs? ACLs? CGROUPs? Policies? SELinux? Filesystem modes? There’s not a singular coherent graph of capabilities you can point to. Too many ways you can escape an initially narrow scope. NT, by comparison, can go the route of explicitly typed resources, and then you could have these really strong centralized audit trails when an agent goes haywire…etc. I know I’m rambling, but the point is…if you were greenfielding an OS kernel from scratch, in 2026, with the intent of being forward-looking, it would *not* look like Linux. Frankly, it’d probably look a lot closer to NT, or even a BSD fork…
502
305
111
4,427
318,638
All I want for Christmas is a DS1101A Fault Injection Laser System please
3
125
So is nobody else thinking "How many of these are just web scrapers running Linux?"
Unironically, 2026 really is the year of the Linux desktop
1
7
184
Platforms with media handling should be having such functionality either in a sandbox or the handling should be in a memory safe language. We've solved such problems time and time again but SDLC in projects overall generally sucks and the industry as a whole needs to get a grip.
‼️ BREAKING: OpenAI was hacked by an Anthropic model. A HEIF photo uploaded to OpenAI's public support forum triggered a bug in the site's image decoder, led to code execution on the forum, and, through a second flaw in OpenAI's own login, ended with a pull request in OpenAI's internal GitHub. The forum runs Discourse, the off-the-shelf software behind countless community sites. Discourse was still shipping an old copy of libheif, the library that decodes iPhone-style photos. The bug in it had already been fixed upstream. But the fix was never labelled a security fix, so nobody treated it as urgent. Hacktron's researchers uploaded a HEIF image and got their own code running on community[.]openai[.]com. Then came the second bug, in OpenAI's own single sign-on, the "log in with OpenAI" button the forum uses. It turned that forum foothold into the actual ChatGPT and Codex accounts of people who had signed in there. OpenAI employees among them. And a ChatGPT account is no longer just a chatbot. Through Codex, users wire in Gmail, Outlook, Drive, Slack, GitHub. To prove the access was real, they used one employee account to have Codex open a harmless pull request in OpenAI's internal repo. They say they read no sensitive code. OpenAI patched the SSO flaw roughly 14 hours after the report and paid a $6,500 bug bounty. The team says Anthropic's Opus 4.8 found the libheif bug, and Opus 5 turned it into a working exploit. Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more were also vulnerable and compromised by the same team of researchers.
2
170