Marcus Eagan

Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure. foxio.io/blog/choose-your-ba…

Not at all. 4 years is very short. Social media glorifies shipping speed but real, durable ideas all take a decade or more. Very few quick wins that aren't just flash in the pan. Dig in deep and expect the good ideas to be full time work for a long, long time.

SF’s dating pool was once, as an Egyptian founder put it to us, “drier than the desert in my homeland.” Now, gorgeous women are flocking to the city. Why? As AI gets cheaper to build, companies flush with venture cash are hiring beautiful women to charm investors and clients. Enjoy it while it lasts, gentlemen. As @nicolewizman1 writes: paying hotties 6 figures to get drunk with your business prospects feels like a pretty good sign we’re in a bubble. 👇

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

‼️ BREAKING: Go has issued an URGENT security update blocking 8 certificate authority keys over undisclosed security concerns. It will reject certificate chains using these keys, potentially breaking connections for rebuilt applications. The filter cannot be disabled. Here's what we know: thehackernews.com/2026/10/go…

JUST IN: New AI tool called "GatGPT" reportedly allows users with little firearms knowledge to design & manufacture 3D-printed guns.

interpretability might be the most important scientific problem in the world right now, as I don't think we can solve alignment if we don't know what we're building. I think I have good news about it. I co-authored early work in mechanistic interpretability at OpenAI and came away pessimistic, because neural networks appeared to fold into arbitrary tangled knots. years later, I started openai's first large-scale automated interpretability project, finding about 2% of neurons legible with the primitive tools we had with modern agentic tools and a much closer look, the picture looks totally different. the vast majority in models up to trillions of parameters are legible, and their circuits beautiful. many famous examples of tangled neurons turned out to be misunderstood. The roadblocks I expected mostly aren't there. I now think ambitious interpretability will be solved by the time we need it most, and possibly quite soon, as automated scientists keep improving. it may be a bitter lesson for interpretability: the simple thing, at absurd scale, works already-clean.goodfire.com/