My current LLM cyber jailbreak is to just spin up a local CTFD instance and write up challenges with the things I want hacked, and then point the hermes at it.

how it feels right now to be building a cyber security startup.

Otters doing goats things

How people react to php shows their skill and my conclusion is I will continue believing only top CTF players who has been before the AI era

if this PHP vulnerability allows remote code execution, doesn't that mean we can use the vulnerability to auto-patch all vulnerable servers?

when i have really dumb questions i'll ask chatgpt or gemini because i don't want claude to think i'm stupid

Last night, a swarm of Opus 5.5 agents working for 9 hours and burning 254.2 million output tokens were able to fully reverse engineer and decompile the Linux source code

Full source archive available here kernel.org

Grab it before they take it down

“someone already built that”

your town has 14 pizza places.

you’ll be okay.

Inference bill is too high

Manager: Lets get GPUs and run our own inference

AI pentesting companies founded in 2026

Mistral is a beast! 🔥

I think it's wild that AI has turned software developers into QA testers.

Burnout happens when you work too hard with not enough meaning.

"He who has a why to live for can bear almost any how" — Nietzsche

Update your MikroTik RouterOS again, to at least 7.24.3

Just published a blog on how you could turn the Webfig "file-read" CVE-2026-67281 (already published by @CERT_Polska_en) into a delayed RCE and on *two other RCEs* in DHCP relay and Webfig. More:
sijisu.eu/posts/3-mikrot…

I used to debug code now I type this and hit enter

@hraness @DevinAI @zeddotdev I could've shipped this with sonnet 3.5 on an ipad mini

For researchers that want to know how this is done without going on AI-heavy details:

( affordable DIY at the bottom )

They took a model, and compressed it to be able to run on a single 4-GPU (still expensive for non-enterprise, so not for solo use - think $80/hour or $180,000 purchase).

Their process / methodology:
- Pick a model with the expert architecture
- Choose a calibration dataset that matches the intended use ( So audited codebases v.s. reports etc)
- Run the calibration data through the unmodified model and record two numbers per expert per token
- Compute a single score per expert
- Delete the lowest-scoring experts in each layer

The expert's weights are dropped from the model file, and the router's output columns for those experts are removed so it can only choose among survivors. The router then renormalizes its weights over the remaining experts as it normally would.

This is EXPENSIVE. BUT it's no different than the token game you play v.s. large scale security companies either way so no reason to give up.

You can do the exact same process for a smaller model and have something you can run on your mac or a hetzner node.

🙂‍↔️🙂‍↔️ Affordable DIY plan:
1. Start from the unpruned GLM-4.7-Flash
2. Collect a few hundred to a thousand traces from your own audits
3. Run the Cerebras REAP repo over them on a rented A100 for an hour or two. Under $10 of compute.
4. Prune 25%~50%, quantize to GGUF, load in LM Studio or whatever.
5. Run locally on your mac

i thought read() was a syscall wrapper, but it can dlopen a bytecode interpreter and execute your code

"house of windy" turns this into leakless code execution with only OOB null byte writes

pepsipu.com/blog/2026-09-d…

If Dario wants to slow down the pace of AI, he should just move the company to Europe.

Huggingfaces security txt after the openai incident 😭