@adulau

Enjoy when humans are using machines in unexpected ways. I break stuff and I do stuff. @adulau@infosec.exchange

 Europe
foo.be/
Joined June 2008
  • Tweets14.5K
  • Following7.4K
  • Followers7.6K
1.2KMedia
MISP v3.0 Early Access: a first look at what's new #misp #cti #OpenSource #ThreatIntelligence misp-project.org/2026/10/16/…

MISP v3.0 Early Access: a first look at what’s new

MISP Threat Intelligence & Sharing

misp-project.org
1
5
15
817
GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference #cve #gcve #cybersecurity #vulnerabilitymanagement #cra gcve.eu/2026/09/01/gcve-work…

GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference

GCVE Workshop Before The Vulnopticon Conference

gcve.eu
2
595
Alexandre Dulaunoy @[email protected] retweeted
Andrew Case
@attrcJul 21
To summarize: HuggingFace got autonomously compromised by a model from an American company. HF then tried to use American frontier model(s) to defend themselves, but were blocked by guardrails. HF then had to turn to open source Chinese models to defend themselves from another American company.
OpenAI
@OpenAIJul 21
We're partnering with @huggingface to investigate an unprecedented security incident. Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation. Sharing preliminary findings to help defenders understand emerging risks: openai.com/index/hugging-fac…

OpenAI and Hugging Face partner to address security incident during model evaluation

OpenAI and Hugging Face share early findings from a security incident during AI model evaluation, highlighting advanced cyber capabilities and lessons for defenders.

openai.com
277
2,428
316
23,290
1,763,755
This method was invented before 2008 for SYN & SYN+ACK, over IPv4 & IPv6. 2nd citation in Hershel paper: [2] P. Auffret, “SinFP, Unification of Active and Passive Operating System Fingerprinting,” Journal in Computer Virology, vol. 6, no. 3, pp. 197–205, Nov. 2010.
John Althouse@4A413313 Feb 2024
Latest additions to JA4+ include TCP fingerprinting! Technical write up: github.com/FoxIO-LLC/ja4/blo… If you see an Epson Printer logging into your Okta server, you're about to have a bad day. JA4T/S available now in Arkime, Wireshark, JA4TScan tool is coming next week as a zmap module. Blog post after that.
3
7
2
14
2,419
Sovereignty Is Engineered, Not Procured #opensource #europe #palantir #cybersecurity foo.be/2026/06/Sovereignty-I…
5
6
607
Dropping 0day isn’t the worst thing a researcher can do. It’s not ideal, but at least orgs can take steps to mitigate. Non disclosure is far worse. What drives researchers toward non disclosure? Threats from vendors. Researchers aren’t criminals unless their crime is curiosity.
7
46
4
298
17,478
Vulnerability-Lookup 5.0 Released: Making Coordinated Vulnerability Disclosure Easier for GCVE GNAs #gcve #cve #vulnerabilitymanagement #cybersecurity gcve.eu/2026/05/29/vulnerabi…

Vulnerability-Lookup 5.0 Released: Making Coordinated Vulnerability Disclosure Easier for GCVE GNAs

The GCVE initiative is pleased to welcome the release of Vulnerability-Lookup 5.0.0, a major new version of the open-source software that powers db.gcve.eu. This release is especially important for...

gcve.eu
1
1
288
Replying to @passthesaltcon @Regiteric @guedou
GCVE by @adulau , a new way to handle and track VLN in an open security ecosystem 👉 cfp.pass-the-salt.org/pts202…
1
1
2
369
Publishing GCVE enriched dumps with VLAI severity classification. GCVE is building a practical, decentralized, and reproducible ecosystem around vulnerability publication, enrichment, and consumption. gcve.eu/2026/05/21/gcve-enri… #gcve #vulnerabilitymanagement #cybersecurity

Publishing GCVE enriched dumps with VLAI severity classification

GCVE is not only about allocating vulnerability identifiers. It is also about building a practical, decentralized, and reproducible ecosystem around vulnerability publication, enrichment, and...

gcve.eu
2
3
410
hack.lu is celebrating its 20th edition! There is still time to be part of this special anniversary edition: submit your talk, presentation, workshop, or even a short talk for the Call For Failures. 2026.hack.lu/blog/hack.lu-20… #hacklu #cfp #cybersecurity
5
9
663
Alexandre Dulaunoy @[email protected] retweeted
Adam4real@Adam4real4May 10
Excited to announce a major milestone for Agent Threat Rules (ATR)! Agent Threat Rules (ATR) has been officially integrated into MISP Taxonomies — one of the world’s most widely used open-source threat intelligence platforms, used by governments, CERTs, SOC teams, and enterprises globally. MISP Taxonomy: github.com/MISP/misp-taxonom… PR #323 (Merged): github.com/MISP/misp-taxonom… What this means: • ATR is now a first-class taxonomy in MISP • Security teams worldwide can tag AI agent threats using structured tags like: atr:category=“prompt-injection” atr:category=“tool-poisoning” atr:rule-id=“ATR-2025-00123” Currently includes 330+ production-validated rules covering prompt injection, tool poisoning, agent manipulation, data poisoning, and more. This integration marks another important step toward making ATR the open standard for runtime detection in the AI agent ecosystem — alongside integrations with Microsoft, Cisco, NVIDIA Garak, and ongoing work with PyRIT & Anthropic. Huge thanks to MISP core maintainer Alexandre Dulaunoy (@adulau) for the review and fast merge! Links: • ATR Repository: github.com/Agent-Threat-Rule… • PanGuard (Enterprise): panguard.ai #AISafety #AISecurity #OpenSource #ThreatIntelligence #MISP
1
1
339
Modeling Sparse and Bursty Vulnerability Sightings: Forecasting Under Data Constraints Cedric Bonhomme, Alexandre Dulaunoy arxiv.org/abs/2604.16038 [𝚌𝚜.𝙲𝚁]
Understanding and anticipating vulnerability-related activity is a major challenge in cyber threat intelligence. This work investigates whether vulnerability sightings, such as proof-of-concept releases, detection templates, or online discussions, can be forecast over time. Building on our earlier work on VLAI, a transformer-based model that predicts vulnerability severity from textual descriptions, we examine whether severity scores can improve time-series forecasting as exogenous variables. We evaluate several approaches for short-term forecasting of sightings per vulnerability. First, we test SARIMAX models with and without log(x+1) transformations and VLAI-derived severity inputs. Although these adjustments provide limited improvements, SARIMAX remains poorly suited to sparse, short, and bursty vulnerability data. In practice, forecasts often produce overly wide confidence intervals and sometimes unrealistic negative values. To better capture the discrete and event-driven nature of

ALT Understanding and anticipating vulnerability-related activity is a major challenge in cyber threat intelligence. This work investigates whether vulnerability sightings, such as proof-of-concept releases, detection templates, or online discussions, can be forecast over time. Building on our earlier work on VLAI, a transformer-based model that predicts vulnerability severity from textual descriptions, we examine whether severity scores can improve time-series forecasting as exogenous variables. We evaluate several approaches for short-term forecasting of sightings per vulnerability. First, we test SARIMAX models with and without log(x+1) transformations and VLAI-derived severity inputs. Although these adjustments provide limited improvements, SARIMAX remains poorly suited to sparse, short, and bursty vulnerability data. In practice, forecasts often produce overly wide confidence intervals and sometimes unrealistic negative values. To better capture the discrete and event-driven nature of

1
4
187
Call for papers is now open for hack.lu 2026 (the 20th edition!) 2026.hack.lu/blog/hack.lu-20… #cybersecurity #conference #hacklu #cfp #europe #luxembourg
6
8
551
db.gcve.eu updated with Vulnerability-Lookup 4.0: Enabling Federated Vulnerability Intelligence #gcve #cve #openstandard gcve.eu/2026/02/17/db-gcve-e…
3
9
850
GCVE.eu — Six Weeks of Progress: Standards, Implementations, and a Growing Ecosystem gcve.eu/2026/02/15/what-s-ne… #vulnerability #cybersecurity #gcve #cve #openstandard

GCVE initiative - Global CVE Allocation System

Decentralized vulnerability identifiers Global CVE Allocation GCVE is a fresh, open approach to vulnerability identification and numbering: compatible with CVE, designed for distributed publication,...

gcve.eu
5
443
Acknowledging Reality in Vulnerability Disclosure #cve #gcve #vulnerability #CyberSecurity foo.be/2026/02/Acknowledging…
3
9
1,241
Vulnerability-Lookup 3.0.0 released including GCVE BCP-07 - Many organisation can now have their own KEV. #gcve #cybersecurity #kev vulnerability-lookup.org/202… gcve.eu/2026/02/02/gcve-bcp-… gcve.eu/bcp/gcve-bcp-07/

Vulnerability-Lookup 3.0.0 released

We are glad to announce Vulnerability-Lookup 3.0.0. Our second release of 2026 is a major milestone, featuring GCVE-BCP-07 support. Now, every Vulnerability-Lookup instance can publish its own KEV...

vulnerability-lookup.org
1
5
5
876
At #GCVE we worked on improved the KEV format gcve.eu/bcp/gcve-bcp-07/ and will be implemented in the next version of vulnerability-lookup. #cybersecurity #Vulnerability

GCVE-BCP-07 - Known Exploited Vulnerability (KEV) Assertion and No Known Exploitable Vulnerability...

Known Exploited Vulnerability (KEV) Assertion and No Known Exploitable Vulnerability (NKEV) Assessment Format Version: 3.1 Status: Published Date: 2026-10-06 Authors: GCVE Working Group BCP ID:...

gcve.eu
1
336
‼️At the end of last year, there was a series of coordinated attacks in Polish cyberspace. 📌Today, our team is publishing a report describing the technical analysis of these events. We show the scheme of operation and the tools used by the attackers. ➡️cert.pl/uploads/docs/CERT_Po…
12
146
19
300
75,440
The Art of Pivoting - Techniques for Intelligence Analysts to Discover New Relationships in a Complex World. PDF - raw.githubusercontent.com/ad… GitHub - github.com/adulau/the-art-of… #pivoting #opensource #cti #threatintelligence #misp
1
10
1
24
1,833
Load more