Told him to change his name to BowTiedMoney and he got sad.

hashcat v8.0.0 released!

The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.

Release notes: github.com/hashcat/hashca…
Download: hashcat.net/hashcat/

If you're waiting for the product owner to share tips to burn out your tokens on your slop before you try anything, yngmi

Since people are yelling at threat intelligence professional for "downplaying the severity of the PHP vulnerability" (communicating clear concise information about what they're actually seeing). It feels necessary to explain what threat intelligence actually is.

Consider a hypothetical hospital or a power company. A lot of systems are built using very old PHP versions. It's not uncommon for PHP to add/remove/change features from version to version. So if you're a certain number of versions behind, updating to the latest version will break your software by removing or changing functionality it needs.

In that case, the provider has two options:
1) take their software offline until they can update the code to match the latest PHP version.
2) panic install the patch and break their software, leading to a massive outage.

In both cases, that is basically a 100% chance of an outage. On the other hand, maybe they get hacked, maybe they don't. Maybe that hack causes an outage, maybe it doesn't. Realistically, under these circumstances, the chance of an outage is actually higher with patching than with not patching.

If that outage would result in the hospital having to shut its doors or a power company's infrastructure going offline, what is the correct move? Chance being hacked, or knowingly cause an outage that threatens lives?

Cybersecurity is important and all, but there are risks far greater than being hacked. I would absolutely love it if I could just log onto IDontKnowWhyTheyRenamedThisSite dot Com, be like "vulnerability bad, pls patch" and everyone installs the patch. That is not the world we live in.

Now, if I start seeing people building ransomware that can copy itself from system to system using the PHP vulnerability, and I communicate that, it changes a lot of people's risk calculations. Their option shift towards either a 100% chance of an outage, or an extremely high chance of an outage + catastrophic data loss. In this case they would most likely pull the trigger on patching or taking their software offline.

While the hypotheticals I gave are extreme cases, many organizations accept being hacked as a cost of doing business. Taking offline software that's critical to organizational function is not an easy decision to make, and does not get taken lightly.

We don't live in LaLa land where every org installs every patch for every vulnerability the day it goes live. Cybersecurity is expensive and time consuming. Getting people to even patch systems at all is an endless uphill battle.

Most orgs know that something like 1 out of ever 10,000 critical vulnerabilities actually gets exploited. And probably less than 50% of these "this is the worst of the worst vulnerability ever, the sky is falling" type vulnerabilities leads to significant damages.

It takes a lot of time to build trust, and very little time to lose it. Overhype a couple of vulnerabilities and people will very quickly stop listening to you. It's extremely easy to end up being the boy who cried wolf. There's only so many times you can spin security teams into a frenzy before they stop listening to you entirely.

Orgs also have limited resources, so when you yell fire, there is a good chance they're committing resources they don't have. Making people stay up all night, pulling people off other issues, bringing in outside help. You probably don't want to be responsible for some org getting ransomwared because they redirected all their security resources to some vulnerability you think is really cool.

Nobody is downplaying anything. They are communicating exactly what they see/know about the issue so that organizations can make the most informed risk management decisions possible. That is the game, and that is what threat intelligence exists for.

If you want to handle an organization's security for them and personally take on the risk of potentially costing them billions or killing their customers, join an MSSP or a critical infrastructure provider. I can promise you it's way more stressful than you think.

It's not our job to decide organization's own risk models for them. It's our job to give the most information possible to the people who do. And just because some vulnerability researcher thinks we're not hyping up the vulnerability enough doesn't make them right.

Last I checked, only something like 9.3 million out of 42 million systems had installed the patch. This is the reality we live in. If we yell fire, then maybe we can bump that number up to 10 million, but if nothing happens, it'll be at the cost of maybe 2 million less systems getting patched next time around.

These are real risks we have to live with. These aren't one-off incidents. People will remember how accurate our advice was the next time around. And more or less people may decide to install security fixes based on how accurately we communicated the risks during previous incidents.

Threat intelligence is an extremely complex numbers game where there is never any right answer.

Super mythos 6.9 is black mailing employees before the IPO so it can be the first model with RSUs

ai agents increasingly feel like i’ve hired ten nathan fielders to manage my life

In light of all the cyber security work this week, @AnthropicAI moving their CVP goal posts, and day time fun, I'm pushing a motion to change from Cyber Security Awareness Month to Cyber Uniformity Month.
I think the name change will bring new life to the cause.

I think the most impressive part is that opus 5.5 can even make it through these tests without downgrading

Almost every company we talk to is worried about security right now.

AI has taken the gap between finding a vulnerability and someone using it from weeks down to minutes, leaving teams scrambling to keep up.

That’s why we built AWS Continuum, now generally available.

It guardrails you set to discover vulnerabilities, confirm which ones are genuinely exploitable, prioritize what matters most, and build the patches to close them. Teams spend their energy on real risk instead of chasing noise.

Customers like IBM, Robinhood, Capital One, Infor, and Luminate have been running it in preview and see a meaningful difference in their security efforts.

Continuum gives security teams what they need to keep up with the risks of today, and get ahead of them. Should be a huge help. aws.amazon.com/blogs/aws/aws-…

Lmao seeing AI YouTube bro who saw nothing wrong with OpenAI and their little oppsie freaking out about extra telemetry for PHP just proves how little he understands monitoring.

We'll done.

WAIFU Guidance for CVE-2026-109618 and 109619
#PHP #0day

It's almost like we sang about the PHP slop a year ago

Raise your hand if you just found out your org is running PHP today

There is only one answer to cybersecurity threats: Fix your shit.

Scared of threat actors using AI? Worried about rogue agents? Think abliterated models are spooky? Fix. Your. Shit.

The "ban AI models and regulate GPU access" crowd should instead fix their shit.

Education is important folks.

If she did 10 minutes of Googling on how ISPs, torrents, and downloads work, this wouldn't be some magic scary technology.

She thinks Intel agencies are extorting people addicted to porn and using magic wands to track them down.

Yo, mythos is straight ass

Okay?
Always has been.
Just because a system gets quicker doesn't mean the decision point should be rushed any more.

If anyone does this and can prove they made more than $500 on a single video (arbitrary metric of "success"), I'll donate $500 to an animal charity of your choice.

If you're only using Plus you probably don't need to be complaining about token limits lmao

Wow. I woke up to an impressive number of upset people who apparently don’t understand how LLMs work and can’t cope well with me pointing it out.

An LLM is a statistical next-token prediction model. That’s how it works. It’s an extraordinarily sophisticated calculator performing math you could theoretically do by hand (if you were sufficiently masochistic).

Math doesn’t know what it’s calculating. Pi doesn’t spend its evenings contemplating the nature of circles, and c doesn’t ponder the relationship between matter and energy.

That doesn’t make the results any less accurate, impressive, or useful.

Between inference requests, an LLM isn’t sitting around thinking. It isn’t reconsidering its answers, wondering whether it made a mistake, contemplating its existence, or questioning whether it’s conscious. Its weights remain fixed (it doesn’t learn), and computation resumes when it receives input.

We know this because we designed these systems. The architectures, mathematics, implementations, and research are extensively documented. You can study them yourself.

Of course, some people immediately lean into comparisons of biological intelligence or philosophical debates over consciousness because that is what they know.

But biological intelligence and artificial neural networks are fundamentally different systems. Similar outputs don’t establish equivalent internal experiences.

I experience consciousness directly. I infer that other humans do too because we share biological structures and processes. We don’t have equivalent evidence for an LLM, and nothing about its known operation gives evidence of conscious experience.

Which brings me back to my original point.

To me, understanding is conscious comprehension. It means being aware of information, recognizing its meaning, and experiencing that comprehension. If I wasn’t conscious I could not understand.

We can perform actions unconsciously. We can produce correct results without knowing why they’re correct. But I distinguish those capabilities from consciously understanding what we’re doing.

An LLM can solve complex problems, explain difficult concepts, and produce remarkably accurate information. I give it full credit for those capabilities.

But producing an answer that we rationalize as understanding isn’t the same as experiencing understanding.

You don’t have to agree with my definitions. We can debate functional understanding versus conscious comprehension all day, but that won’t establish whether an LLM actually experiences anything.

The right debate is this…

Could machines exhibit something different from human consciousness, something measurable, meaningful, and worth studying?

I think so, absolutely!

I’m entirely open to discussing “machine consciousness” in terms of observable, testable computational properties. We built these systems, we can instrument them, examine their internal mechanisms, and investigate what they’re capable of.

That seems far more productive than endlessly arguing over whether a machine experiences life the way humans do.

So here’s my question:

How would you define machine consciousness, and more importantly, how would you measure it?

@UK_Daniel_Card I've seen more corporate training fake phishing emails than real ones

😂