Prasanna retweeted
Everything I have seen about Rashmika and Vijay Deverakonda has been against my will.
Prasanna retweeted
Just a few of the biggest security incidents in the past week... we're still accelerating:
* PHP2Shell: Two critical RCE bugs in PHP core
* eMudhra: Eight intermediate certificates had extremely weak private keys due to a key-generation script error that created keys with tiny values.
* GitLab: integer overflow RCE
* Plex Media Server: flaws compromised internet-facing servers used for cryptominers and proxy tools.
* Arista VeloCloud Orchestrator zero-day: Actively exploited authenticated SQL injection enabling privilege escalation.
* Node.js Brotli decoder RCE
* NGINX critical heap/use-after-free issues
* Railway breach: Attacker accessed systems storing customer environment variables and, for some, obtained decrypted contents (API keys, database credentials, private registry logins, etc.)
* Zeabur breach: ~321,810 accounts and over 3.2 million environment-variable records exposed. Company announced it is shutting down.
* LiteLLM supply-chain compromise: Malicious version 1.107.0 pushed to PyPI and Docker Hub containing a credential stealer and remote-access/backdoor capability.
* California public school data theft: 5.7M+ student records leaked, including names, dates of birth, addresses, demographics, and disability status.
* Capcom breach: Unauthorized access to ~11.77 million CAPCOM ID records
* Quest Diagnostics: Unauthorized access to Quanum Lab Services Manager system used by some clients; potential access to certain patient records.
* State Bank of India breach: customer records appearing on dark web
Prasanna retweeted
I found a new RCE bug in PHP, missed by previous auditing teams. It’s unpatched in PHP v8.5.12
Prasanna retweeted
It's wild how low effort disinformation operations have gotten. 10 years ago you had to create a sockpuppet account and pretend to be a concerned citizen. Now you can just be like "Hey, it's me, Deedy McAnthropicInvestor here. I've come to show you this impartial Anthropic post about why their competitors are all dangerous/bad and should be banned.
Prasanna retweeted
The way frontier labs have restricted access to cyber capabilities makes no sense. If you're considered a "defender" you're not allowed access to the "offensive" versions of the models (the ones that can do development/validation of malware and exploits).
So for example, if you want to build some sample malware to test a detection system, nope.
Or if there's a major crisis due to a critical vulnerability in PHP and you need to rapidly triage fake exploits to see if there are any real ones floating around so you can warn people, nope.
Want to build a remote code exploit to make sure the detection rules you plan on proposing to the clients actually work? Hard nope.
You gotta call your red team friend and wait for them to do your job for you, because "defender" are only allowed to play in the sandbox with the children.
Not an expert, but I think that the ability to triage in-the-wild exploits during a major crisis affecting 40 million systems is possible maybe important.
And then they want to ban abliterated open weight models, which half of the people are only using because frontier labs will only give them access to lobotomized models.
Prasanna retweeted
i own a relatively new (2025) samsung tv.
i kept getting weirdly targeted ads.
i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic.
zero days it is. root shell on new samsung TVs!
discovered PRIVACY HORROR. write up?
Prasanna retweeted
i am no longer afraid of things falling apart. i have seen what happens after the worst of it. the sun still rises, people still laugh, new things still begin, and one day, you find yourself happy about something you once thought you would never recover from.
Prasanna retweeted
New on Secjuice: how to check whether a war video was made with AI. NetSniffer shows why the hidden AI labels are usually gone by the time a clip reaches you, and which free checks still work. secjuice.com/ai-war-videos-w…
Prasanna retweeted
The auto translation feature from x is second deadliest disaster happend to japan and Japanese twitter after 1945 thing.
Prasanna retweeted
Nobody who could even colorably hold that title (not even sure what it would mean) would be caught dead calling themselves that.
Prasanna retweeted
Probably a good time to remind everyone that academia has produced decades of incredible security research, much of which has never been implemented or explored beyond a paper.
