Security Research Manager. 10 times @BlackHatEvents speaker. Co-Founder @ZenGo acq by @etoro Advisor @ZeroNetworks. x-VP Research Aorato, acq by @Microsoft.
Israel
Joined April 2014
- Tweets16.9K
- Following2.1K
- Followers11.3K
- Likes14K
Even OpenSSH, the poster child of security-oriented architecture, benefited from this attack-surface hardening
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
Small D Energy
arstechnica.com/security/202…
The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
Tal Be'ery retweeted
Yes. What he said. And, if you look close, all very knowable in advance when you're able to distinguish between what's possible vs what's probable.
1/ My new blopost on "Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)?"
TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are.
medium.com/@TalBeerySec/why-…
גם אני מתכוון להצביע בנט @naftalibennett
Tal Be'ery retweeted
We were turning away work before AI. What changed is the mix, not the exploit curve.
We’re not seeing more 0-days or 1-days in our cases. That CVE spike barely shows up in our IR queue.
What’s driving volume is AI inside the house:
AI-written code shipping more vulns and logic flaws
AI-generated configs leaving things exposed
Agents misbehaving and breaking things on their own. We call it AI-induced destruction.
So yes, AI is the root cause, just not the way people think. Breaches aren’t rising because attacks got better. They’re rising because what we ship got worse.
IR folks (@GelosSnake @ProferoSec @Mandiant @Volexity @attrc @uuallan @TalosSecurity others, please tag): trying to put numbers on breaches.
Vs. a year ago (or whatever makes sense), how many more cases are you seeing?
Are you really "turning away work" as @RGB_Lights says?
Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. reuters.com/legal/government…
The @elder_plinius mystery continues..
Will present @BlackHatEvents Europe event, but remotely
blackhat.com/europe/briefing…
#BHEU #BHEU26
Tal Be'ery retweeted
Ironically, after Hillary Clinton got her leaked emails authenticated by DKIM signing, Matt went on to write a blog post "Ok Google: please publish your DKIM secret keys"blog.cryptographyengineering…
1/ "Your Number Is Up: When 3.5 Billion Strangers Can Exploit Your WhatsApp Devices"
Our @BlackHatEvents Asia 26 talk video is live.
youtube.com/watch?v=FXV0LWPc…
#bhasia #bhasia26
Old but gold from @matthew_d_green: OTR/Signal/WhatsApp's "plausible deniability" property — what enables chat history forging — is mostly a vanity feature.
"'Dammit, they used a deniable key exchange protocol' said no Federal prosecutor ever."
blog.cryptographyengineering…
Burning a possible @BlackHatEvents submission just to make a point:
I modified WhatsApp to permanently rewrite its own chat history by editing the local message DB. Kill the app, reopen it — the altered history is still there. For good.
Even the DB cannot prove authenticity.
מעולה!
בן שנתיים כמעט, אבל העצה של @DannyLeshem (עם קרדיט ל @OmerAlali7) ירוקת-עד.
טריויאלי: לעשות סטארטאפים רק אם יש לך יתרון לא הוגן.
לא טריויאלי, ללחוץ על ההדק כשיש הזדמנות נכונה: להכין לעצמך עתודות (כסף ו/או זמן) כדי שתוכל טכנית , ולהתאמן דרך הימורים כדי שתוכל מנטלית.
בפרק 21 של הפודקאסט ״כסף חכם״ דיברתי עם @brand_yona93102 על סטארטאפים, פאונדרס, ניצול הזדמנויות (תודה @OmerAlali7!), השקעות הון סיכון, ולמה משתלם לשחק פוקר ולאמן את המוח ב-degenerate gambling.
מוזמנים לצפות פה, או להאזין בפלטפורמה המועדפת עליכם :)
youtube.com/watch?v=1DCg8TD9…
Finally, the Linux networking stack achieves five nines
The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug.
CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️
pwn.ai/blog/pwnescape
Great read!
Last month, Meta AI published research on "Unslopping AI", describing their attempt to train models to write better. Ironically, it read a lot like AI slop, so I decided to decode it into plaintext and share it along with some critique... enjoy the read ;)
ophirharpaz.com/posts/unslop…
A secure mobile app is a great usability vs. security trade-off.
@zengo welcomes Ledger to the club.
LATEST: @Ledger announces the Atom, an Android-based device launching mid-2027 that combines everyday smartphone apps with hardware-level crypto security.
It features a tamper-proof enclosure designed to block the screen-reader implants used in last week’s attack.
1,000 swordsmen vs. a gun. This cannot be the future.
Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos cnbc.com/2026/10/14/anthropi…
Good data on the fix-to-CVE gap. But the conclusion that "CVE publication in many cases helps attackers more than defenders" doesn't follow.
If anything, the opposite: attackers watching commits get a 39-day head start; the CVE is when defenders finally get the signal.
Tal Be'ery retweeted
בדיוק היה לי שרשור עם @TalBeerySec על דרישת ההוכחה שיש לזה בבית משפט. בגדול? ברגע שהטענה היא "זה לא אני" אז נטל ההוכחה די עובר לצד שלך. מביאים מומחים פורנזיים שמציגים את כל הנסיבות מדוע זה לא הוא (יש כמה דרכים) אבל בסוף השופט מתרשם מהעדים.
xitter.cf/TalBeerySec/status/210…