Executive Director @Kawaakibi. Doing strategy @aeinstitution. Author of The Middle East Crisis Factory
Joined July 2011
- Tweets41.2K
- Following2.7K
- Followers6.5K
- Likes27.1K
This piece by an anonymous Saudi about public opinion and attitudes in the kingdom right now is well-worth a read. Pervasive fear, outpourings of nationalism, distrust of state narratives
newlinesmag.com/running-note…
I installed Omarchy on an old Chromebook, and it now performs better than my "serious" laptop - just blazingly fast. And so fun. Reminds me of modding android in the early 2010s.
Ahmed Gatnash retweeted
SITUATION DETECTED: CloudFlare CEO Matthew Prince says he is aware of additional severe vulnerabilities in other pieces of critical software, and said “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” per Reuters.
Expect the AI labs' next filings to show another big surge in revenue beginning right about now.
There will be no more AI holdouts in corporate America - burn tokens or perish.
Ahmed Gatnash retweeted
Amazing how quickly we went from "oh no LLMs are going to flood the Internet with insecure code" to "oh no LLMs have discovered the internet was already flooded with insecure code"
Ahmed Gatnash retweeted
AI IS AMAZING
I know it's hip to worry about the decline in book reading and how chatbots will impoverish our brains.
But TBH, this is not at all what I see. I wrote about how we're in this wild moment for intellectual flourishing and how all of us are the children of dancers.
Reservations with "It's actions would also almost certainly be undetectable", but a digital cold war almost certainly started earlier this year.
The TSO, or Technology Support Office, was established in April to 'covertly disrupt and sabotage foreign technology programs considered threats to American military superiority.'
In September the Washington Sun reported that the NSA told lawmakers in classified intelligence briefings that it estimates it has spent billions of dollars 'evaluating and testing' models this year already.
In the draft S-1 leaked by the WSJ yesterday, Anthropic said that one-fifth of its $16.3 billion in revenue in the first half of 2026 came from just two customers.
Motive, means, and opportunity. I think a lot of money is being spent by agencies through Project Glasswing or channels related to it, and they have probably covertly penetrated every nation on earth to look at anything even potentially considered a threat. There is no defense against the current internal version of Mythos unless you have access to it. No foreign intelligence agency on earth has anything even close. It's actions would also almost certainly be undetectable. Assume US agencies know much more about any technological progress in China than they are letting on; given Dario's openly stated position on China, this would almost certainly be done with his approval.
Thatcher's disastrous legacy
NEW
Britain’s missing sovereign wealth fund… Treasury officials have modelled that had the UK done what Norway did with North Sea revenues, there would be a £1 trillion fund…
As Chancellor sets up Energy Wealth Fund, a look at the long historical argument about where the oil windfall went, including from interviews with those who have run Norways $2.4 trillion fund, now the biggest in the world, filled from the proceeds of the same North Sea.
bbc.co.uk/news/articles/cm4g…
Ahmed Gatnash retweeted
Important, and I'm glad this is finally public. Google DeepMind researchers are under in perpetuity non-disparagement clauses forbidding them from ever speaking critically of the company. I'd already confirmed this with multiple people.
Yes, some ex-employees have spoken out nonetheless. But it has also discouraged others from doing so. And yes, it most certainly has a chilling effect with regards to discussions on safety and risk.
Others have written compellingly about how important the ability to speak freely and critically is, especially on topics like safety and risk. And what a testament to the research employee community's coordination and hard-won bargaining power it has been to get there at other companies.
GDM burn that commons by having this. And everyone who signs burns that commons too. Let's get it changed.
Congrats to Sofia for having the courage to resign and speak out!
This is also very important:
Staff are scared to speak out about AI safety and its uses in warfare because their employment contracts prohibit them from publicly criticising the company.
bbc.co.uk/news/articles/cmre…
Ahmed Gatnash retweeted
Just going to preregister here that I believe the computer security overhang is not a few dozen bugs that get patched and then we're good, there are 100,000s of vulns that are extremely discoverable with infinite free tokens and we're probably going to have to move away from systems that presuppose that perfection is possible.
Ahmed Gatnash retweeted
A quick explainer for everyone else.
>half the internet runs on PHP
>a big security bug dropped today
>basically hackers can take over websites just by sending one special request (crazy!)
>no password needed
>patches are out
>lots of sites are going down for emergency updates
>if you have a website, tell your host to update PHP right now
>if you don’t, just enjoy the random maintenance pages for now
Ahmed Gatnash retweeted
Regarding the PHP vulnerability, I have seen some security researchers recommending people limit web browsing for a few days (due to the potential for common websites to be compromised via this vuln).
There is exploit code available for this vuln, though it is not known to exist “in the wild.” But with the weaponization of AI, it’s possible that the discovery and broad distribution of exploit code could happen fast - possibly reverse engineered after the patches are released.
I expect cyber security providers of web application firewalls and exploit prevention services will have protections deployed quickly today, and IT teams will be busy patching and upgrading.
And I think it may be wise to lay low on the Internet today. Do what you need to, but probably skip frivolous browsing.
Also:
Make sure you are running full service anti-virus / anti-malware on every device (including phones). I recommend BitDefender for home/personal use.
Update your browser apps and only use Safari, FireFox, or DuckDuckGo. No opinion about Brave (people keep asking). Make sure ad blocking is turned on and auto play of active content is turned off.
Be very cautious of links you receive in SMS messages, message apps, and email. Check and verify the source first and check the URL to make sure the website domain is as expected.
Keep your operating system and all applications up to date, and watch for new updates over the coming days. Regarding iOS, I do not recommend upgrading to 27. Stay on 26 and update as possible.
Make sure you have MFA turned on for all websites or online accounts. True MFA. Passkey has a major design weakness so I do not recommend it.
This is all to protect your devices and your accounts in case a website you visit is explored and does attempt to steal your credentials, information, or deliver exploit code to your device.
@PractiveSec will be following this today. Advisory coming for customers.
Ahmed Gatnash retweeted
🚨 10:00 AM ET: A 15-MINUTE BATTLE FOR THE ENTIRE INTERNET BEGINS.
Today, a critical zero-day vulnerability (CVSS 9.2) in PHP—the backbone running nearly 80% of the web—goes public at 10:00 AM ET / 7:00 AM PT.
Forget the technical jargon. Here is what actually happens:
The second the patch drops, hackers will use AI to reverse-engineer the fix in seconds and unleash automated exploits worldwide within 15 minutes.
This is not just a problem for developers.
When e-commerce sites, apps, and platforms collapse, your leaked home address, passwords, and credit card numbers flood the dark web.
⚔️ The brutal reality today:
Engineering teams deploying patches in minutes vs. Oblivious companies gutted before lunchtime.
🛡 3 things you must do to protect yourself right now:
1. Turn on Two-Factor Authentication (2FA) across all critical accounts.
2. Stop password reuse immediately.
3. Beware of fake "emergency password reset" phishing emails flooding inboxes today.
Cyber warfare changes forever this morning.
Bookmark and share this to keep your team and family safe.
Ahmed Gatnash retweeted
Regarding the root certificate issue, yeah, this could be really bad.
Only use FireFox, Safari, or DuckDuckGo as your browser (by default, always). Check for updates for your browser and all apps today through the weekend, and install them.
Be extra careful about clicking links you receive in messages, email, and posts.
With a root certificate, an attacker can spoof a legitimate website and trick your browser or apps into thinking it is real, act as a relay between you and the real service provider, and decrypt any communications you send to the legitimate service they are spoofing. Think wire tap between you and the legitimate service you are using.
This could be used to collect passwords, read email, read messages, intercept and manipulate communications from your apps/browser to your service provider.
It all depends on if this becomes weaponized, who uses it, and what they use it for.
Update your apps and software, and be extra careful about clicking links sent to you.
Ahmed Gatnash retweeted
the emudhra thing is insane when you actually think about it
a private key is supposed to be a number so big no computer on earth can guess it. 116 digits.
emudhra's was 4
not 4 digits. four.
this is india's biggest certificate authority. govt sites, PSUs, banks all run on their trust. and for a year and a half anyone who looked could've forged certs for any website on the planet
a random guy found it on a saturday and had the keys in milliseconds
no hack. no leak. they just never checked their own output
Ahmed Gatnash retweeted
wake up babe, every version of PHP for the past 17 years has two critical bugs and now 74.5% of the internet is broken lol. there's a patch coming out tomorrow but until then most of the internet has open backdoors that allow unauthorized remote code execution
Ahmed Gatnash retweeted
Update everything today: browsers, OS security patches, etc. today is not the day to ignore the "Your connection is not private" page
emudhra.we-have-a-problem.co…