Interested in all things related to Computer Science. Also on BSky @profw.bsky.social
University of Surrey
Joined November 2011
- Tweets26.1K
- Following833
- Followers31.5K
- Likes2.8K
Running PHP? Then please pay attention to what is happening right now. You need to fix it. cve.tools/blog/php2shell-cve…
Not looking good huntress.com/blog/vendor-cre… and appears to be affecting M365 via Connectwise. Supply chain at play again. connectwise.com/company/trus…
An interesting piece of analysis “overseen” by @matthew_d_green - I was fascinated to see confirmation of how well studied lattice based cryptography is when I often hear it is “young” and thinly examined.
I was curious about a question: how much cryptanalytic work have human beings done on various problems, and how much AI inference does that represent? So I asked Claude and Astra to measure. bitsofwork.org
Classic McEliece looks like it’s officially out fir future developments bsi.bund.de/SharedDocs/Downl…
For those privacy minded people, and particularly those who may talk about about sensitive info in their car, a reminder for Dutch security services aivd.nl/actueel/nieuws/2026/…
No AI model is jailbreak-proof. The UK's AI Security Institute has found a universal jailbreak in every system it's tested. The real questions: who's watching the door, and do defenders keep their access? profwoodward.substack.com/p/…
🤦♂️
#HMDFuse: Sophisticated #AI, #CSAM detection, can't be disabled or circumvented.
"A phone incompatible with pornography", they said.
Turn it sideways.
paul.reviews/harmblock-world…
#childSafety #harmblock #AI #HMD #xplora #SafeToNet @NCSC @CEOPEducation @IWFhotline
Alan Woodward retweeted
The bots and I made a little thing for my cryptography class: the one-way function transform lab.
Interactively write security proofs (reductions + analysis) and attacks, both correct and wrong, for a variety of natural function transforms.
web.eecs.umich.edu/~cpeikert…
Jan 2026 the best structural attack on Classic McEliece cost 2^298+. By Aug, distinguishing cost ~2^120. Now full key recovery is claimed at 2^94–2^102 (ePrint 2026/1984), with an argument that no realistic parameters fix it. Nothing deployed is decryptable but margins vanishing.
For those in a risk group please read this - it’s not gonna make headlines but it does actually matter.
Today, the NCSC alongside the @FBI and the Dutch AIVD, has published an advisory exposing spyware used by Iranian state actors to target dissidents, activists, and journalists. 1/2
👇👇👇👇👇 worst thing BBC ever did was take this Click off the TV. And whilst he was a great presenter, he knew his stuff! Where has this level of common sense gone.
Amodei says recursive self-improvement "started this summer". A 75-page survey posted 2 days earlier by researchers building RSI commercially found the only two direct tests of what’s needed for exponential growth came back negative. arXiv:2609.11873 They can’t both be right.
This is a quote I would support.
"It's fine to warn people. It's even better to warn people with a solution. And it's absolutely inappropriate to make things up."
#FightTheFUD
not a bad quote that..... #AI #FUD #Cyber #Security
Looks like CRIME attack against TLS is much more powerful than originally thought as demonstrated by @kennyog and his team at @ETH_en eprint.iacr.org/2026/1972.pd… Now this something I will worry about - I suggest cyber security folk read it too.
AI models can hack. What they can't do is judge: no doubt, no stakes, no knowing when to stop. Cyber security's police work stays human, as it always has been. Not a happy lot, but ours. I try to explain why here profwoodward.substack.com/p/…
Alan Woodward retweeted
We've reached the point where, after 25y in cybersecurity, I feel morally obligated to say this for the record:
The narrative being pushed around AI safety, sandbox incidents, and the suggestion that METR be treated as an authority is dangerous, deceptive, and morally corrupt.
