Given enough AIs, all bugs are shallow
Joined February 2010
- Tweets7.7K
- Following1.1K
- Followers16.6K
- Likes6.1K
Pinned Tweet
23 years ago, almost to the day, I bought the CNA Study Guide by Sybex from this bookstore that enabled me to pass the exam (by 1 point!!!) making me a Certified Novell Administrator (never having actually touched Netware) that landed me my first job in computers...
As I understand it’s not a new vulnerability but an update to distrust the eMudhra certs. It’s likely marked cvss 9.1 because things like JMXRMI that require a cert can now be accessed.
🚨 BREAKING: NOW JAVA IS FACING A CRITICAL SECURITY EMERGENCY.
Oracle has issued an OUT-OF-BAND security alert for a dangerous 9.1/10 vulnerability affecting Java and GraalVM.
And the most alarming part? Hackers could exploit vulnerable applications REMOTELY, without a password or ANY user interaction.
Here's what's happening:
→ CRITICAL 9.1/10 FLAW: CVE-2026-91403 affects Java's JSSE security component.
→ NO LOGIN REQUIRED: Attackers could potentially exploit vulnerable applications remotely without authentication.
→ SENSITIVE DATA AT RISK: Successful attacks could expose, modify, or delete critical application data.
→ MULTIPLE JAVA VERSIONS AFFECTED: Oracle lists affected releases across Java 8, 11, 17, 21, 25, and 27.
→ GRAALVM ALSO AFFECTED: Oracle confirms the vulnerability impacts multiple GraalVM releases.
→ EMERGENCY PATCH ALERT: Oracle released an urgent security update rather than waiting for its next scheduled patch cycle.
The list of critical vulnerabilities just keeps growing.
If you operate Java applications or servers, CHECK YOUR SECURITY UPDATES NOW.
Readers added context they thought people might want to know
CVE-2026-91403 is a JSSE certificate trust issue with eight compromised eMudhra intermediates having weak keys, enabling potential MITM on TLS if attacker intercepts traffic—not a direct remote exploit of Java apps or servers.
oracle.com/security-alert…
openjdk.org/groups/vulnera…
bnowakowski.pl/psa-java-cve-2…
David Litchfield retweeted
Omg I found a copy of the original memory_limit advisory. marc.info/?l=bugtraq&m=10898…
Flying between Winnipeg and Vancouver I spotted this on the map. What do we think, peeps? Impact crater? #impactcrater #crater
I don’t know who needs to hear this right now but water can cut through steel if it’s moving fast enough 🙄
Am I the only one worried about unintended consequences here? Like, it seems to me if you force rain to fall in a place or time it wasn’t meant to you’re taking it away from where or when it was meant to fall?
Rainmaker just produced ~19M gallons of water in Alaska via next-gen cloud seeding over 3 hours of operations.
We are the first company to provably produce precipitation in Alaska. As promised, we’ve linked our white paper and relevant data.
In the future, Rainmaker will protect and restore glaciers with man-made snowfall.
Immediately, this demonstration shows how Rainmaker will add new water to the Colorado River and Great Salt Lake in the coming months.
We turned around this analysis and white paper just a couple days after operating. There are many data sources I want to deepen our understanding of the atmosphere and increase our provable production; we’re building the instruments to collect that data in subsequent operations. But at Rainmaker, we won’t tout LOIs, simulations, or lab tests. What matters is physically measuring that you’ve affected the atmosphere; proving that we’ve produced water. We prefer sharing only the tech that has proven to make more water for farms, industries, and ecosystems in need.
Expect a regular cadence of these from us as we build the best atmospheric science lab in the world. Feedback is welcome in the interim.
Rainmaker Century.
rainmaker.com/blog/alaska-va…
David Litchfield retweeted
Homebrew tightens tap security, begins work on its interface
Interviewed by Anamarija Pogorelec on Help Net Security.
“It’s probably aimed a little more at newcomers than experienced
Homebrew users.”
helpnetsecurity.com/2026/06/…
David Litchfield retweeted
Today, I’m proud to announce Homebrew 6.0.0.
Since 5.1.0: secure tap trusting, faster JSON API, Linux sandboxing, better defaults, brew bundle improvements, improved performance, initial macOS Golden Gate support.
brew.sh/2026/06/11/homebrew-…
I set a new British record in the bench press. Quite chuffed with that :)
instagram.com/reel/DZWuWtyOS…
Not long after the 9/11 terrorist attacks MSRC published “It’s time to end information anarchy”. It was one step short of labeling security researchers terrorists. The essay was not well received by industry _at all_ and triggered a sea change at MS, ushering in a new era. 1/2
Not long after there was a change of leadership and co-operation was the key word. And things went well for a very long time but it seems what was old is now new again, and the researchers are the ones to publicly blame, again. 2/3
Ironically, in using frontier models, I’ve literally had to dust off some books and revise ARM64 assembly and exploit techniques I’ve not used in years, just so I can properly participate and not be a passenger. I’m actually rediscovering my love of bug hunting.
With the rise of competent AI models, I do think useful vulnerabilities will be hunted to near extinction; this will drive up the cost of those left remaining, perhaps significantly.
‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots.
Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy.
▪️ AI surfaces a massive wave of 0-day RCEs.
▪️ Submissions overwhelm ZDI past max capacity.
▪️ Slots run out. Researchers with working chains get rejected.
▪️ "Revenge disclosures" begin. ← we are here.
Confirmed casualties so far:
▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land.
▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla.
▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere.
▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel.
▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected.
▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected.
Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in.
ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.
Remember the days when NGS and eEye were pumping out so many criticals? I don’t anticipate things getting much worse than that, tbh. Indeed, critical undiscovered flaws are finite, and software is soooo much better than it was in the early 2000s.