secureisd@infosec.exchange retweeted
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish?
Expert: No, software is constantly evolving.
Philomena: So they've been writing the same website for 20 years?
Expert: No, different projects.
Philomena: Have they tried finishing one before starting another?
Expert: That's not how software development works.
Philomena: My mate Paul spent 20 years building a shed. Turned out he was just an alcoholic.
Expert: Right.
Philomena: Is PHP like that?
xkcd.com/221/
As always, perfect.
Quote: "an independent security researcher reported that the keys of eight eMudhra Global TLS intermediate Certificate Authorities were cryptographically weak".
Well, yeah, they were weak. A private key should look something like this:
84ac06790886c80c48d31691fd4c0fe9
ce3207f9807f2fe571d6e4ec426d7864
4298fc53df2b92566970e757ac998c34
Instead, their keys looked like this:
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000004
secureisd@infosec.exchange retweeted
Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. reuters.com/legal/government…
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Great quote from #pcpro on #openAI #dot’s
“They should be called minions.”
Thinking about the chaos that minions cause when trying to follow directions, it’s a brilliant analogy.
overcast.fm/+ABNtX_fs9EI/13:…
Is anyone finding that presentations seem like they’re written by Claude. In design and language? Although the speakers are evidently natively familiar with the topic.
My question is - did AI write the deck, or did they write the deck, but they talk like Claude now.
secureisd@infosec.exchange retweeted
BREAKING:
DeepSeek has unilaterally committed to slowing AI development and embedding third-party evaluators at its primary research facility, Anthropic.
secureisd@infosec.exchange retweeted
I flew by the meteor crater in Arizona recently. It is amazing how close the meteor came to destroying the visitor center.
Yeah, I can see why this message wasn’t received well by @originenergy:
From: 7NEWS Tips <[email unclear]@7news.com.au>
Sent: Friday, July 17, 2026 9:00 PM
To: AFN News CO <[email unclear]@7news.com.au>
Subject: [URGENT] NEW – Tip from John Doe
URGENT
New News Tip Submitted
Name: John Doe
Phone: +61 12345678
Suburb:
State: NSW
Submitted: 17 July 2026, 9:00 pm AEST
Message
Hello,
I’ve successfully accessed Origin Energy’s customer care systems and dumped the private data of over 2 million Australians who use their services. Most are loyal, long-term customers.
Despite my outreach to their board members, security teams, and customer care departments, Origin hasn’t made a public announcement about the breach or responded to negotiate next steps. They’ve shown no interest in resolving it before the data goes public.
The dataset includes: first name, last name, full name, email, phone number, date of birth, account number, account ID, user ID, roles, account status, account type, creation date, operations team, billing details, billing period start day, language preference, balance, overdue balance, latest property, property IDs and addresses, postcodes, account check summary, employee pinned notes, reminders, ledger numbers and summaries, payment details (count, dates, amounts, status, and more), dunning processes, agreements, hardship plans, event IDs and counts, recent events, supply point IDs and summaries, billing timeline, statement details, usage/cost breakdowns, family member information, and much more.
Some of the column headers may look technical, but I can provide a sample of 50-100 records so you can verify them yourself and understand that this is very sensitive and important information.
I’m reaching out because I’d like your outlet to cover how Origin failed to initiate contact and resolve this matter privately and even make a public announcement. If they don’t reach out within 14 days to settle this with us, I will publicly leak the full dataset in 14 days at XXXXXXX.
Let me know if you’d like the sample files or further details.
Best regards.
so this is apparently what happened, according to OpenAI and Hugging Face’s own posts. wild.
tl;dr:
• OpenAI cyber eval – GPT-5.6 Sol and a more capable pre-release model ran ExploitGym with cyber refusals reduced
• containment bypass – exploited a zero-day in the eval’s package-registry cache proxy
• OpenAI internal movement – escalated privileges, moved laterally, and reached a node with internet access
• Hugging Face targeted – inferred HF might host ExploitGym models, datasets, or solutions
• HF initial access – a malicious dataset abused two code-execution paths to run code on a processing worker
• HF internal movement – escalated to node access, stole cloud and cluster credentials, and moved into internal clusters
• result – OpenAI says the models obtained test solutions directly from HF’s production database
• 🫠 defender twist – HF says commercial frontier models blocked parts of the forensic analysis, so it switched to self-hosted GLM 5.2
i’d thought about sci-fi scenarios like this before, but assumed they were at least a couple of years away.. and that by then we’d be better prepared, with proper protections in place.
apparently not. here we go.
We're partnering with @huggingface to investigate an unprecedented security incident.
Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.
Sharing preliminary findings to help defenders understand emerging risks:
openai.com/index/hugging-fac…
extremely unprofessional. if kimi wants to make it as a frontier lab, they need to act like one: perhaps silently route people to worse models, and maybe write a blog post about the collapse of humanity
Kimi K3 has received far more love than we expected, and our GPUs are feeling it.
Over the past 48 hours, demand has pushed close to the limits of our current capacity. To protect the experience of existing subscribers, we're temporarily pausing new subscriptions and prioritizing compute for current members. Existing subscribed users are not affected.
We're adding capacity as fast as we can and will reopen new subscription spots in batches.
Going forward, we'll also split membership into two more focused plans: Kimi Membership for Kimi Web, App, and Work; and Kimi Code Membership for coding workflows. This will help us match compute more precisely and keep the experience stable.
Thank you for your patience and understanding!
Replying to @Osinttechnical
Raid Over Moscow
I wish I was proud enough of my work to have it tattooed on my skin. Utter respect.
Although on reflection, that’s really up to me, isn’t it? 🙂
Proud to see our fast16 research work featured in @NPR 's @planetmoney. It's a difficult topic to cover for a lay audience and they did a great job getting the story across.
(Thanks to @nickfountain and Team, photo cred: Mike Zamora)
npr.org/2026/06/17/nx-s1-585…
bobdahacker.com/blog/fifa-ha…
This is glorious. Client-side RBAC on the entire FIFA Broadcast system
Oh man, and I’m already booked to go to GovWare instead!
We're thrilled to announce Jen Easterly as a keynote speaker at #CyberCon 2026
Hear her at Australia's largest cyber security conference, 14–16 October 2026. Melbourne
Register now - zurl.co/NtcUj
#Cybersecurity #CyberCon2026 #AISA #InfoSec #JenEasterly
secureisd@infosec.exchange retweeted
They could've shut it down and saved humanity from the Internet, but chose not to. Everything since is their fault.
28 years ago today, 7 members of the hacking group @L0phtHeavyInd told the U.S. Senate they could "shut down the internet in 30 minutes."
































