← Feed

Posts

• View post

  Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore there is an increased likelihood of threat actors attempting to develop exploits for the vulnerability. while CVE-2026-98432 is believed to require MPTCP to be enabled in the kernel, as well as a listening app/service w...

• View post

  Cybersecurity has an AI doomer problem https://www.youtube.com/watch?v=KMf2RDC5Dyg The AI industry's proximity to cybersecurity is causing clueless AI doomers to flood the zone. Experts and real issues are now being drowned out by increasingly absurd cyber-apocalypse fantasies imagined by people with no real world experience. From self-replicating AI models, to turning the entire internet into a botnet. The doomers are losing their minds and taking the cybersecurity industry with them.

• View post

  Machine Speed is a lie: stop trying to fight AI with AI Marketing departments are screaming that attackers are moving at "machine speed" and only AI-powered defenses can stop them. But cyberattacks have always been automated, and proactive defense beats reactive AI. https://malwaretech.com/2026/09/machine-speed-is-a-lie-stop-trying-to-fight-ai-with-ai.html

• View post

  @muddle@infosec.exchange No, I just think you're an idiot. I make videos for an audience who wants to hear my takes on mainstream cybersecurity news. You are either one of them, or you're not. If it's the latter, then you can just scrolled past instead of leaving your uninformed opinion. A very important media literacy skill is knowing when some media is intended for you. If it's not intended for you and you respond as if it were tailored for you specifically, you just end up lo...

• View post

  @muddle@infosec.exchange Only to people who aren't smart enough to at least watch the first 5 seconds of the video before commenting

• View post

  @muddle@infosec.exchange yup, and that's why it got 10,000 views in less than 24h, instead of if I'd used my alternate headline option of: "A deep dive into OpenAI's claim that their model escaped a sandboxed and hacked hugging face, where I debunk said claim and talk about OpenAI's reckless behavior and also include my life story in this headline because why not and also I had eggs for breakfast btw"

• View post

  My take on the story about OpenAI's model going rogue and hacking a competitor's systems, why it matters. Also probably the fastest turnaround time for a video that I've managed so far. I'd just got off a 12h flight when the story dropped. https://youtu.be/GB8gaeI0fLs?si=ss3hD78xG2XUREYn

• View post

  Slowly setting up my video/livestream studio again. The amount of tech required for even a half decent experience is crazy

• View post

  @GossiTheDog That is indeed oddly specific

• View post

  My thoughts on Microsoft's threat to prosecute researchers for dropping zero day exploits https://www.youtube.com/watch?v=gCkfWo5rie8

• View post

  It's been a while since I did a vulnerability research article. How about a little DoS zero-day as a treat? https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html?1

• View post

  ComoDoS - Exploiting a Remote Kernel Zero-Day Vulnerability in Comodo Internet Security How an IP parsing vulnerability makes it possible to remotely crash systems with a single TCP/IP packet https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html

• View post

  My deep-dive technical analysis of a zero-day exploit being used by The Gentlemen ransomware group to disable EDR products https://expel.com/blog/not-very-gentlemanly-analyzing-a-zero-day-exploit-used-by-the-gentlemen-ransomware-to-disable-targets-edrs/

• View post

  I think it’s hilarious that I now have my first CVE because I got annoyed with an unresponsive vendor and just posted the zero day exploit I was trying to report to them on my GitHub 😆 https://nvd.nist.gov/vuln/detail/CVE-2026-49494

• View post

  I found a zero day in a security vendor's firewall software that allows you to remotely crash the entire system by sending it a single malicious packet. Since the firewall is responsible for inspecting traffic prior to the operating system handling it, no ports even need to be open for it to work.

• View post

  I built an AI that autonomously finds zero day exploits https://www.youtube.com/watch?v=BLqRiL_GY3A

• View post

  Listening to cybersecurity people freak out over Mythos is so tiring. Like, bro, your local water treatment plant runs Windows XP, your mobile provider's hardware is older than you are, and the protocol that routes internet traffic is secured by everyone just agreeing that hijacking it would be uncool.

• View post

  I spent nearly 4 months investigating the inner workings of a North Korean state-sponsored hacking group. Here's what I found: - The group used generative AI tools to aid in almost every part of their operations. - They exfiltrated 26,584 cryptocurrency wallets from victim systems, with a combined value totaling as much $12 million dollars. - In several cases, the threat actors set up entire front companies to lure in developers via fake job posting, then infected them with malware....

• View post

  Great crowd at Zero Trust World today. Thanks for everyone who came to my keynote and for all the great hallway conversations! 😃

• View post

  After years of planning a potential collab, I finally got to sit down with fellow cybersecurity YouTuber David Bombal for an in person interview! Below you can check out the video from what will hopefully be the first of many more collaborations 😃 : https://www.youtube.com/watch?v=KsXzTz5H2QQ

• View post

  To prove you’re not a robot, please select all the Mar-a-lago SCIFs

• View post

  I'm convinced this technology was invented purely just to troll me

• View post

  It feels like Proton are being intentionally misleading in their statements. They know that most of their customers aren't familiar with how legal process actually works, so are happy to spread half-truths. Under US law, a US law enforcement agency (LEA) typically has to apply for a subpoena or search warrant with a US court. The court is then responsible for deciding if the legal bar for search a request has been met, then either grants or denies it. The problem is, if a company has n...

• View post

  I've been researching some malware that uses Blockchain Smart Contracts as Command-and-Control infrastructure. Since blockchain data is public, I was able to write code to track how many new systems the malware infects each day. Blog post coming next week.

• View post

  Just checking in on my investment portfolio, because apparently computers are appreciating assets now.

• View post

  My latest blog post investigating a malware campaign which infects victims by utilizing only legitimate infrastructure. The malicious activity spans hundreds of hacked websites, the BSC blockchain, and a popular CDN. https://expel.com/blog/clearfake-new-lotl-techniques/

• View post

  Since the decline of peer-to-peer botnets it's been difficult to track malware infections externally. But smart contract based C2 infrastructure provided us with unique insights into this campaign. https://expel.com/blog/clearfake-new-lotl-techniques/

• View post

  I can’t believe we’re doing this again. It’s just a bot that generates the text you ask it for. If you put it in charge of critical decisions, it will kill people. Not because it’s secretly evil, but because it’s a word generator. It’s like putting your toaster in charge of air traffic control.

• View post

  We plan to decrease operational costs for our AI model by building custom servers that are immune to cosmic radiation, then spending trillions of dollars launching them into space. Yes, our CFO did tech themselves math using ChatGPT, why do you ask?

• View post

  When the state sponsored threat actor has vibe coded their entire control server, all the login code is client-side, and they’ve infected themselves with their own malware.