Pinned Tweet
It’s here! Countering the AI Revolution: preserving the arc of humanity to seed a better future, is now available to order.
As in the garden long ago, we are being offered transcendence. I submit that we are being deceived.
westbowpress.com/en/bookstore/b…
As in the garden long ago, we are being offered transcendence. I submit that we are being deceived.
westbowpress.com/en/bookstore/b…
2
3
18
10,796
Well you can stop it. Don’t give your bot your bank account or credit card number and never give it any password to any of your accounts.
But if you do and if your bot finds a way to touch any of my accounts to issue a transfer or deduction or a charge…well, let’s just say:
But if you do and if your bot finds a way to touch any of my accounts to issue a transfer or deduction or a charge…well, let’s just say:
JUST IN: JPMorgan CEO Jamie Dimon warns AI agents could soon make unauthorized financial decisions, saying “You can't stop it.”
0
0
1
53
Addressed in the section titled “Interaction” in the Substack linked below. This Substack was also adapted and integrated into Countering the AI Revolution.
practivesecurity.substack.com/p/the-deceptio…
practivesecurity.substack.com/p/the-deceptio…
We believe voice is the most natural way to interact with intelligence, so we created Dessa, the most authentic full-duplex speech model ever built. Talking with it feels like talking with a person…full of emotion, nuance, pauses, and a natural cadence.
block.xyz/dessa
0
0
0
93
One of the indicators that made me realize I was working in a tech cult, was when my boss confided in me that he judged attendance at after work dinners and karaoke nights as more important to him than technical performance in your work.
You could be the best at what you did in the office, but if you didn’t hang out after hours with the boss, drinking what he served, and singing songs with him at his favorite karaoke shop, then you were “out.”
But if you played the game, then you could be so-so at your work and still get the access and promotions and opportunities.
Silicon Valley.
You could be the best at what you did in the office, but if you didn’t hang out after hours with the boss, drinking what he served, and singing songs with him at his favorite karaoke shop, then you were “out.”
But if you played the game, then you could be so-so at your work and still get the access and promotions and opportunities.
Silicon Valley.
2
0
6
368
Here’s what I think is really going on with the AI models finding vulns. PHP and all.
It’s a spell to enable a revolution.
In normal situations and normal times, none of this would be making headlines. The problem is we are being driven by a deeper narrative. We’re in the midst of a revolution, and the revolutionaries are expert magicians with a set of gadgets and props that are almost impossible to deny. The illusion is incredibly strong, and so is the fear that it drives. And they are not playing by the rules. They are creating a whole new game.
The truth is the leaders of the AI companies, the AI enthusiasts, and the politicians who benefit from them will make their forecasts come true, whether by breaking the rules and changing reality, or by creating the illusion that they are so that their desired change will be demanded or inevitable. Either way it is working. Either way they are changing the Internet. They are breaking things, but they are breaking things in a very strategic way and what they are breaking is normalcy itself. They are breaking the rules and doing things that would not be done naturally. They are making their prophecy come to pass. And they are preying on sensationalism and ignorance to do so.
practivesecurity.substack.com/p/is-the-inter…
It’s a spell to enable a revolution.
In normal situations and normal times, none of this would be making headlines. The problem is we are being driven by a deeper narrative. We’re in the midst of a revolution, and the revolutionaries are expert magicians with a set of gadgets and props that are almost impossible to deny. The illusion is incredibly strong, and so is the fear that it drives. And they are not playing by the rules. They are creating a whole new game.
The truth is the leaders of the AI companies, the AI enthusiasts, and the politicians who benefit from them will make their forecasts come true, whether by breaking the rules and changing reality, or by creating the illusion that they are so that their desired change will be demanded or inevitable. Either way it is working. Either way they are changing the Internet. They are breaking things, but they are breaking things in a very strategic way and what they are breaking is normalcy itself. They are breaking the rules and doing things that would not be done naturally. They are making their prophecy come to pass. And they are preying on sensationalism and ignorance to do so.
practivesecurity.substack.com/p/is-the-inter…
2
3
14
2,397
You have to see this in its proper context. The revolutionaries mean you great harm, and they claim it will be your salvation. The scary part is, they believe they are helping.
1
0
1
171
Below is risk management 101.
I’m not stupid, but I understand that many people don’t understand cybersecurity. No fault to you - it’s a highly specialized domain with very few season practitioners.
But I do understand this domain. I’m happy to teach you. I’m happy to explain. I’m happy to contextualize.
I’m not stupid, but I understand that many people don’t understand cybersecurity. No fault to you - it’s a highly specialized domain with very few season practitioners.
But I do understand this domain. I’m happy to teach you. I’m happy to explain. I’m happy to contextualize.
@ramirezlopezandnt we use a formula for assessing risks: likelihood x impact. This is a consideration that can be made generally but is also up to you to decide specifically - because every organization should have secondary controls that limit exposures and contain impact.
The likelihood that an event is going to happen can be on a scale from impossible to imminent. In this case, until late yesterday we had millions of exploit attempts but none were working - a sign that exploitation was actually difficult. OpenAI got it wrong in that regard. CrowdStrike released a blog describing that real-world conditions for exploitation make this difficult to exploit.
So the likelihood is low - for now.
The potential impact can be negligible to catostrophic. That’s contextual.
RCE vulns are hold one of the highest potentials for impact because running commands on an exploited system can result in takeover. But…that too is a variable. Server admins can restrict web service accounts to prevent arbitrary commands from running - or the exploited server may serve a purpose in which a compromise has no impact to anything.
Remember, impact is about affecting availability, confidentiality, and integrity. If exploitation does not affect that, then impact is also negligible.
CVSS scores (the 8.3 you mentioned) are not proper risk scores. They are an indicator of the type of event that has the potential to occur if exploitation is successful and they consider if exploitation potential has been proven in theory. They are an indicator you add to your risk formula to assess true risk.
And risk is always variable relative to each vulnerable system, because each system exists in its own context and ecosystem of secondary protections.
So the critical CVSS score is just meant to help you know the type of vuln you are dealing with. It is not a statement of risk.
And so it is that you can have a CVSS score of 10 for a vuln, and it can be low risk to you.
0
0
8
3,508
I got Sol (IV) and Saturn (second). This was fun to do and think about.
So Caspian and Dawn Treader eh? I’ll get on that.
The writing prompt about the last king and the falling stars was an instant “that one” for me.
And ah…to have uninterrupted time with some philosophical books would be bliss. Though I should like someone to ponder with. For a bit.
So Caspian and Dawn Treader eh? I’ll get on that.
The writing prompt about the last king and the falling stars was an instant “that one” for me.
And ah…to have uninterrupted time with some philosophical books would be bliss. Though I should like someone to ponder with. For a bit.
The medieval poets did not believe that the heavens fatalistically determined our future, but they did believe they each had a character that influenced the spiritual climate.
Take my short quiz to find out which sphere you most naturally belong to!
mythicmindfellowship.com/spheres-quiz/
0
0
1
797
Yes indeed!
There is no such thing as AI being “in control” of us, because AI doesn’t know or decide anything. But there could be such a thing as a technocratic elite which, looking at AI through an ideological lens, interprets its outputs in a certain way and demands that the rest of us submit to this interpretation. The proposal that “AI should be in control” is really the proposal that this technocratic elite should be in control, albeit some are so lost in ideological delusion that they don’t see this.
0
0
2
174
Still no active exploitation and the exploit code in the wild appears to be vibe coded and doesn’t actually work.
Man, it’s possible this was all a false start thanks to the imbecile at OpenAI.
Man, it’s possible this was all a false start thanks to the imbecile at OpenAI.
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/products/…
🔗 Technical details from Wiz: wiz.io/blog/php2shell…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/sizing…
7
14
127
19,422
Matt Johnston retweeted
FAQ Answered: "Exploiting PHP on a website would be game over for the website owner, right?"
No. Well, it depends. Take some time to read about the Cyber attack lifecycle, also known as the cyber kill chain.
The vulnerability exploitation stage of an attack is just the start. Once exploited, the attacker needs to be able to do something with the asset (server, service, application, account etc.) that they have compromised. The entire attack lifecycle involves:
Preparation
Staging
Weaponization
Target discovery
Delivery
Initial exploit
Establishing a foothold
Moving laterally / establishing persistence
Discovery
More lateral movement
Final objective
And there are sub-stages within that cycle and sometimes the cycle starts over and repeats inside of itself.
Many cyber attacks can only get so far before they are blocked or ended for other reasons. With the PHP vulnerability, we're talking about one part of a very long process.
It's possible that all of the above can be condensed and automated so that it happens very quickly and only at that initial layer of exploitation. But that is subject to what the adversary is actually able to do on that particular system they have exploited.
No. Well, it depends. Take some time to read about the Cyber attack lifecycle, also known as the cyber kill chain.
The vulnerability exploitation stage of an attack is just the start. Once exploited, the attacker needs to be able to do something with the asset (server, service, application, account etc.) that they have compromised. The entire attack lifecycle involves:
Preparation
Staging
Weaponization
Target discovery
Delivery
Initial exploit
Establishing a foothold
Moving laterally / establishing persistence
Discovery
More lateral movement
Final objective
And there are sub-stages within that cycle and sometimes the cycle starts over and repeats inside of itself.
Many cyber attacks can only get so far before they are blocked or ended for other reasons. With the PHP vulnerability, we're talking about one part of a very long process.
It's possible that all of the above can be condensed and automated so that it happens very quickly and only at that initial layer of exploitation. But that is subject to what the adversary is actually able to do on that particular system they have exploited.
0
1
1
100
Matt Johnston retweeted
FAQ Answered: "Doesn't an attacker with AI have the advantage over defenders?"
No. See answer to "should we use AI to defend ourselves." Also, the truth is, defenders always have the advantage. We choose what we deploy and make accessible and on what terms, to what outcomes, on what conditions, and to whom. Cyber attacks can only take advantage of what we expose and only if our exposures create conditions that can be exploitable to any significant gain or harm.
Right now, the most sophisticated AI models are simply doing what humans already know how to do (both attack and defense), but they are doing them at a larger scale. That is not an escalation in capability that we cannot overcome, because we already know how to defend against the attacks and combinations of attacks that AI is demonstrating.
No. See answer to "should we use AI to defend ourselves." Also, the truth is, defenders always have the advantage. We choose what we deploy and make accessible and on what terms, to what outcomes, on what conditions, and to whom. Cyber attacks can only take advantage of what we expose and only if our exposures create conditions that can be exploitable to any significant gain or harm.
Right now, the most sophisticated AI models are simply doing what humans already know how to do (both attack and defense), but they are doing them at a larger scale. That is not an escalation in capability that we cannot overcome, because we already know how to defend against the attacks and combinations of attacks that AI is demonstrating.
0
1
1
109
Matt Johnston retweeted
FAQ Answered: "If bad guys can use AI to attack us, doesn't that mean we should use AI to defend ourselves?"
No. Cybersecurity is won or lost at the strategic level and our existing strategies still work even against the most sophisticated attacks we have seen from AI so far.
When most people talk about or promote using AI in cybersecurity, they mean for you to do so for real-time analysis of cyber attacks and to automate actions or countermeasures to reveal and thwart malicious actions as they are happening. That's a tactical approach to solving a strategic problem.
People imagine cyber attacks as something like a race between good guys and bad guys. It's not. This is total fantasy and a false narrative often used to sell unnecessary products and services. Some companies promote the idea of "time to detect" or "breakout time," as if the challenge in cybersecurity is analyzing data fast enough to get ahead of an attack as it's happening.
That's foolish. Many cyber attacks are automated. By the time you know, it's done. And those are easy to prevent anyway. The difficult ones actually play out over long periods of time - weeks and months - so there is time to spare.
LLMs, machine learning, and data analytics platforms do have value in cybersecurity, but they are as sufficient in their mission today as they were 20 years ago.
You can use AI operationally - for discovery, code scanning, exposure discovery etc. but we have existing tools and people who can do that already...without the complications, headaches, and unforeseen problems that come with AI.
No. Cybersecurity is won or lost at the strategic level and our existing strategies still work even against the most sophisticated attacks we have seen from AI so far.
When most people talk about or promote using AI in cybersecurity, they mean for you to do so for real-time analysis of cyber attacks and to automate actions or countermeasures to reveal and thwart malicious actions as they are happening. That's a tactical approach to solving a strategic problem.
People imagine cyber attacks as something like a race between good guys and bad guys. It's not. This is total fantasy and a false narrative often used to sell unnecessary products and services. Some companies promote the idea of "time to detect" or "breakout time," as if the challenge in cybersecurity is analyzing data fast enough to get ahead of an attack as it's happening.
That's foolish. Many cyber attacks are automated. By the time you know, it's done. And those are easy to prevent anyway. The difficult ones actually play out over long periods of time - weeks and months - so there is time to spare.
LLMs, machine learning, and data analytics platforms do have value in cybersecurity, but they are as sufficient in their mission today as they were 20 years ago.
You can use AI operationally - for discovery, code scanning, exposure discovery etc. but we have existing tools and people who can do that already...without the complications, headaches, and unforeseen problems that come with AI.
0
1
1
118
Matt Johnston retweeted
FAQ Answered: "If AI can hack something, doesn't that mean it is in imminent danger of being hacked by someone else with AI? Aren't these AI companies doing us a favor by getting there first?"
No. Cyber attacks are complicated. They don't just happen. They are conducted by people who have motives, capabilities, opportunity, specific targets, and risk/reward calculations. Cyber adversaries (hackers, fraudsters, scammers etc) do not have infinite capabilities or resources or time.
And Cyber attacks play out over time and often require numerous attack cycles within what we call a "campaign" in order to achieve the final mission. Just because something is exploitable on the surface (which is what AI is finding), doesn't mean it can be exploited to achieve the final objectives of any adversary who has the intent to carry out an attack against that vulnerable target.
And the targets matter. If a cyber adversary who is financially motivated and operates extortion campaigns by stealing and selling credit card numbers comes across a website they can exploit that doesn't collect credit card numbers...then they won't waste their time. So it is with all scenarios.
The AI companies are instead creating chaos that need not be but serves their deeper agenda of total transformation of the world.
No. Cyber attacks are complicated. They don't just happen. They are conducted by people who have motives, capabilities, opportunity, specific targets, and risk/reward calculations. Cyber adversaries (hackers, fraudsters, scammers etc) do not have infinite capabilities or resources or time.
And Cyber attacks play out over time and often require numerous attack cycles within what we call a "campaign" in order to achieve the final mission. Just because something is exploitable on the surface (which is what AI is finding), doesn't mean it can be exploited to achieve the final objectives of any adversary who has the intent to carry out an attack against that vulnerable target.
And the targets matter. If a cyber adversary who is financially motivated and operates extortion campaigns by stealing and selling credit card numbers comes across a website they can exploit that doesn't collect credit card numbers...then they won't waste their time. So it is with all scenarios.
The AI companies are instead creating chaos that need not be but serves their deeper agenda of total transformation of the world.
0
1
1
129
Matt Johnston retweeted
FAQ Answered: "What is actually happening with all this AI hacking?"
Tactically, the AI companies are training their models on how to understand and evaluate software, and they are being trained on known tools, techniques, and procedures for attacking software. Then they are being directed to pursue evaluating and testing popular software and Internet services.
From that training they are finding "bugs" in software that if interacted with in a specific way can cause the software to do unexpected things.
When bugs that trigger unexpected actions may cause harm or some failure, they are submitted to the cybersecurity industry's vulnerability management services which categorize them and disclose them to the appropriate parties so they can be fixed.
Usually software vulnerabilities are disclosed privately so the responsible parties can fix it before it is disclosed publicly. But that depends on the nature of the vulnerability and the fix.
Right now, AI models are finding vulnerabilities and developing proof-of-concept exploit methods and the industry is rushing to fix them before they can actually be exploited in the real world.
The Internet is not being hacked. The Internet is not breaking. This is self-inflicted hysteria.
Strategically, this is the AI companies turning to malicious efforts to try to force their revolution forward. They are attacking the Internet in an attempt to take over software development, IT infrastructure Ops, and cybersecurity by force.
In other words, OpenAI and Anthropic have become cyber adversaries using their technology in a form of extortion that forces change to their advantage.
Tactically, the AI companies are training their models on how to understand and evaluate software, and they are being trained on known tools, techniques, and procedures for attacking software. Then they are being directed to pursue evaluating and testing popular software and Internet services.
From that training they are finding "bugs" in software that if interacted with in a specific way can cause the software to do unexpected things.
When bugs that trigger unexpected actions may cause harm or some failure, they are submitted to the cybersecurity industry's vulnerability management services which categorize them and disclose them to the appropriate parties so they can be fixed.
Usually software vulnerabilities are disclosed privately so the responsible parties can fix it before it is disclosed publicly. But that depends on the nature of the vulnerability and the fix.
Right now, AI models are finding vulnerabilities and developing proof-of-concept exploit methods and the industry is rushing to fix them before they can actually be exploited in the real world.
The Internet is not being hacked. The Internet is not breaking. This is self-inflicted hysteria.
Strategically, this is the AI companies turning to malicious efforts to try to force their revolution forward. They are attacking the Internet in an attempt to take over software development, IT infrastructure Ops, and cybersecurity by force.
In other words, OpenAI and Anthropic have become cyber adversaries using their technology in a form of extortion that forces change to their advantage.
1
1
2
157
Matt Johnston retweeted
FAQ Answered: "If AI models are finding vulnerabilities that have existed for 10 years, isn't that good? Doesn't that prove the value of using AI for cybersecurity?"
Not necessarily, and no.
If a vulnerability has persisted that long without us finding it or exploiting it, then it didn't really matter and its discovery is of no value.
Also, most of the vulnerabilities being discovered by AI are not exploitable, or if exploited would not result in any material impact.
Not necessarily, and no.
If a vulnerability has persisted that long without us finding it or exploiting it, then it didn't really matter and its discovery is of no value.
Also, most of the vulnerabilities being discovered by AI are not exploitable, or if exploited would not result in any material impact.
0
1
1
71
And priced to be accessible, not to line our pockets.
$15 / month (also available as an annual purchase) for our Essentials Membership - gets you access to our full content library including heads-up advisories, FAQs, topical articles and more.
$40 one-time charge for our personal security assessment. This is a collection of resources with a checklist designed to help you assess your own state of security and digital heath.
$30 / month for our Business Essentials / Pro Membership - gets you access to our deeper well of knowledge and wisdom for professional contexts.
And more…options available.
$15 / month (also available as an annual purchase) for our Essentials Membership - gets you access to our full content library including heads-up advisories, FAQs, topical articles and more.
$40 one-time charge for our personal security assessment. This is a collection of resources with a checklist designed to help you assess your own state of security and digital heath.
$30 / month for our Business Essentials / Pro Membership - gets you access to our deeper well of knowledge and wisdom for professional contexts.
And more…options available.
We are working hard to teach you all you need to know about online threats that affect your heart, mind, body, soul and property.
We have an online library of content organized by topic so that you can access to read, listen, or watch based on your schedule and interest.
And we have consolidated much of our written content into two books, with more to come.
And we are here to be your trusted advisor to help you navigate the churning seas of this digital age and of the AI age to come.
Learn more and get started at PractiveSecurity.com
0
0
0
228
