Breaker of software | VP R&D @hunterstrategy | CTI/DFIR | @ians_security faculty | Bookings: jake at malwarejake dot com | GSE #150 | He/him
Odenton, MD
Joined September 2009
- Tweets102K
- Following1.8K
- Followers152K
- Likes44.5K
Pinned Tweet
Let's not mince words:
* If you don't support trans people, you're a bad human
* If you have to add caveats to your support (e.g. "as long as my kids don't see"), you're one of the worst kinds of human
* Trans deserve your *unconditional* support for their humanity
Someone please tell me how this isn't disqualifying.
Trump Says He Will Move to Israel to Become Prime Minister If U.S. Turns on Him tmz.me/4Aap1wW
There's zero question in my mind that organizations employing Anthropic's "team usage" feature without specific policies around it will be sued by employees (and probably rightfully so). We discuss why in today's episode of Breach Please.
In short, you should be thinking about employee interaction with Claude like email or chat logs. If you don't have "summarize my team's email usage" then you shouldn't have this either (for much the same reason).
youtu.be/lBQ-v4jw2AU
Jake Williams retweeted
I came to appreciate today something I do as a leader that's maybe novel. Maybe not. Probably others do it without realizing it. I call it the Strategic Bad Idea: Nothing gets your team to solve a problem faster than their boss proposing a bad idea as the solution.
Jake Williams retweeted
Talking MCP functionality AND security with @MalwareJake. #unicorndispatchlive
The "S" in MCP doesn't stand for Security.
Bryson Bort and Jake Williams break down the Model Context Protocol on Unicorn Dispatch LIVE: a live purple team demo, plus how to use its power without handing attackers the keys.
Recap: hubs.ly/Q04CtkkY0
Jake Williams retweeted
🚨 Brotli2Shell goes beyond HTTP2Shell.
CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Google’s Brotli decoder that has been exploited for RCE and impacts far beyond HTTP.
JFrog reproduced RIP control in FFmpeg via a crafted JPEG XL file and identified additional attack paths in ClickHouse, .NET, and Apache Arrow, where some fixes were still unavailable at the time of writing.
We’ve also released an open-source scanner to uncover potential exposure beyond vulnerable package versions.
Full research and technical details in our blog 👇
Jake Williams retweeted
Feeling super euphoric rn lol
I explicitly decided to avoid sharing that post because it's written in an extremely weird way. The article is basically a giant non-sequitur. It starts with "we saw a proof of concept" then immediately jumps into "agentic AI post-exploitation", without making any claim that A led to B.
It's a very strange structure for a threat intelligence report, and none of the segments of the article logical follow each other. I tried asking for clarification about what/why that is, but the response I got was extremely cagy, so I didn't feel comfortable risking my reputation on it.
Nobody who could even colorably hold that title (not even sure what it would mean) would be caught dead calling themselves that.
Jake Williams retweeted
![Ray [REDACTED] (@RayRedacted) profile picture](https://pbs.twimg.com/profile_images/2114716558127665152/oyqX8byl_400x400.jpg)
LIVE... Watch Sam Watson go for gold in the final international Speed Climbing event of 2026. Despite a recent injury, Sam wants to finish 2026 strong. (629 days until the Olympics)
Link: Sam Watson dot live
SamWatson.live
Today's Breach Please is out. We talk about how Chainguard unilaterally broke the embargo on the PHP vulnerability and what that likely means for coordinated disclosure going forward.
It is BY FAR the spiciest episode we've recorded to date. 1/3
We also dive into the question of whether AI labs are actively hurting security (yes, they are. They just are).
Jess has some pretty strong opinions about the message in this tweet specifically. We don't 100% agree, but the discussion is valuable. 2/3
teapaw.org/JasonDClinton/status/2…
Not all heroes wear capes.
Some carry tentacles...
I didn't have @BSidesRDU on my list this year (it's been a busy year to say the least), but this is making me seriously reconsider.
Go @RayRedacted!
![Ray [REDACTED] (@RayRedacted) profile picture](https://pbs.twimg.com/profile_images/2114716558127665152/oyqX8byl_mini.jpg)
BIG NEWS! On 12/18/26, I'm giving the closing keynote at @BSidesRDU !
NGL... Seeing my name on a list with ppl like @HackingDave @AlyssaM_InfoSec @deviantollam @WeldPond @gdead @irawinkler is a bit terrifying.
But LFG!
![Image from Ray [REDACTED] (@RayRedacted)](https://pbs.twimg.com/media/HVPNAlAWIAAjHiU.jpg?name=orig)
Join me at 1100 ET today to discuss the current vulnerabilities in PHP, Node.js, GitLab, and the eMudhra certificate signing key debacle. We'll provide actionable advice and cut through the noise in our hour together.
ians.com/events/webinars/php…
Jake Williams retweeted
PHP2Shell (CVSS 9.2) disclosed, and eight eMudhra certs could let anyone mint trusted certs for any site.
Thursday, Oct. 22, 11 a.m. ET: @MalwareJake, IANS Faculty, on what your security team should do now.
Register now: bit.ly/4dLHUh6
ConnectWise has an incident with compromise this weekend where they disabled backups in customer M365 environments.
Even if you're not a ConnectWise customer, you likely have third party risk management concerns here for those you do business with who are.
In most cases, ConnectWise won't be able to see into the customer environments to identify who was compromised - those logs live in the customer tenant.
youtube.com/watch?v=AxsG32De…