🫠

Minnesota beat Michigan earlier today, and this might the best postgame locker room video I've ever seen 😲😲

BREAKING: ShinyHunters hacker “Rey” has reportedly been detained in Jordan & is walking investigators through his devices & messages to help the FBI locate his fellow hackers.

‼️ BREAKING: A security researcher says he has a full VM escape zero-day: guest-to-host root in "industry standard hypervisors." Vercel awarded him its maximum $50,000 bounty, a screenshot he posted shows. Vercel's message puts the bug in its Critical class: microVM-to-EC2 host escape and cross-tenant access.

New NetScaler zero-day hits PATCHED appliances via SAML. Citrix released a new responder policy today: get it from Citrix Support. Checker v1.11: SAML status, attempts since 2 Oct flagged "may have run", 95 IPs. Ran v1.10? Run again. github.com/ThomasPoppelgaard… #NetScaler #

That escalated quickly cyberplace.social/@GossiTheD… community.citrix.com/techzon…

The @unpromptedconf II agenda: 101 speakers. 81 sessions, workshops, villages, and more. A first look at ten [un]prompted talks: Bruce Schneier (Harvard Kennedy School; University of Toronto): “Integrous AI Systems Design” @sounilyu (Knostic): “Giving AI Religion” Taesoo Kim (Microsoft): “From DARPA AIxCC to Microsoft FORGE Lab: Lessons Building Hyperscale AI Code Scanning Tools” Matt Suiche @msuiche (Tolmo): “Weightless: Abliteration Without the Weights” Daniel Cuthbert @dcuthbert (Santander Group): “Your sandbox degrades gracefully, what's the wurst that could happen?” @chenxiwang (Rain Capital) and Jasmine Jaksic (NVIDIA): “Agentic AI in the Wild: What Real Deployments Teach Us About Governance and Scale” Tal Waitzenberg and 🛡 Erez Harush (Wiz): “Same Threat, Two Verdicts: Shadow Testing Our SOC Agent” Adrian Wood (Dropbox) and Ads Dawson (Dreadnode): “StealthBench: Can Autonomous Security Agents Do OPSEC Like An Experienced Operator?” Markku-Juhani O. Saarinen (Tampere University): “Math ability has consequences -- AI Cryptanalysis” Kat Traxler @NightmareJS (Vectra AI): “Your Harness Needs a Security Constitution” We’re 26 days out from [un]prompted II, the AI Security Practitioner Conference, where the security community convenes to share what they’ve built, tested, deployed, and what failed.  Please share this lineup with your peers! Stay tuned for more details on the agenda for October 27–29, in San Francisco or online. Register: unpromptedcon.org Thank you to our Sponsors: Knostic, TachTech, Censys @censysio, Ent @Ent_Security, WorkOS @WorkOS, Decibel Partners, Whiterabbit, Zenity @zenitysec, RunSybil @runsybil, AISLE™. Thank you to our Community Partners: SANS Institute @SANSInstitute, Cloud Security Alliance @cloudsa, RSAC @OneRSAC, FIRST @FIRSTdotOrg.

Do I know anyone at @Reddit ?

We are expanding access to Cloudforce One's Threat Events Platform to every Cloudflare account and introducing Threat Signals. Threat Signals automatically parses open-source threat reporting, extracts structured indicators, and connects threat context directly to your WAF rules. cfl.re/4hkBxU8 #BirthdayWeek

🚨 #BREAKING: American man "kidnaps" Flock camera, subjecting it against its will to 23,040 license plates per second.

How pwn agents escaped the hardest-known sandbox setup: Google’s KVM (kvmCTF). pwn.ai/blog/kvmescape To celebrate 10K followers 🥳, we’re launching Stories from Inside the Sandbox, our new sandbox escape series.

ShinyHunters has told 404 Media that they don't intend on publishing the FBI data... 404media.co/fbi-hackers-say-…

BREAKING: Anthropic has filed for an IPO, per Reuters

JadePuffer is using AI-driven attacks to target Microsoft Azure, stealing credentials and destroying cloud resources. In observed attacks, the group deleted over 100 storage accounts. via @BleepinComputer bleepingcomputer.com/news/se…

If you know you know

Attacker vs. Defender AI Advantage danielmiessler.com/blog/atta…

AI agents steal 600,000 credit cards in attacks on online retailers cyberinsider.com/ai-agents-s…

Love this 💕 “XML signature validation is deeply cursed”