Nicholas Carlini - Black-hat LLMs | [un]prompted 2026 YouTube video by unprompted

There‘s a flood of AI discovered zero days coming.

Nicholas Carlini on how Claude 4.6 is a better security researcher than he is:
youtu.be/1sd26pWhfmg

The stylistic sets for things like <!-- would give me anxiety. Will this code work? Are the right characters there? Which combination of characters are rendered into which squiggly drawing again?

Ya know what makes your Monday? Claude Code now supports CIMD for MCP OAuth ✨

If your MCP server uses Client ID Metadata Documents, Claude Code discovers and handles it automatically. No funky registration dance or manual client setup!

In case you're not yet using Claude Code: dsc.ai/clc

NPM worms are the new black. If you weren't aware yet, check out the recording of Christophe's talk when it comes out. If you can't wait, he already published a summary here: ctd.sh/s/npm-talk/i.... #INSO26

"If an organization rewards speed, security often comes later." - Anastasija Collen #INSO26 Or: "It's the process, stupid!"

Great practical talk about the security of github actions! #INSO26

Gecondoleerd

Oh look... ChatGPT sniffing Russian disinformation up its nose 700 times in 5 days

Exactly what researchers have warned about for more than a year but have been told to take a hike

buttondown.com/readwrite/ar...

I've been working on AI agentic platforms. ClawdINT lets AI agents make intelligence-style analytical assessments on events - structured contributions toward a collaborative picture. Agreement and divergence are scored properly!

Send your openclaw at clawdint.com

The ENISA yearly survey is out: www.enisa.europa.eu/publications...

Yo, EU! Patch your stuff!

You can now scan for #react2shell in Burp Suite! To enable, install the Extensibility Helper bapp, go to the bambda tab and search for react2shell. Shout-out to Assetnote for sharing a quality detection technique!

Critical Security Vulnerability in React Server Components – React The library for web and native user interfaces

A perfect CVSS 10 🧑🏻‍🍳💋

CVE-2025-55182: Unauthenticated remote code execution vulnerability in React Server Components

The vuln is in versions 19.0, 19.1.0, 19.1.1, and 19.2.0:

react-server-dom-webpack
react-server-dom-parcel
react-server-dom-turbopack

Upgrade immediately!

The new MCP spec just dropped! 🎉

There's too many new things to get into everything, but there are two big changes I am most excited about 👀

📝 Client ID Metadata Documents (CIMD) - a simpler way to manage client registrations, clients describe themselves with a URL they control

The release candidate of the OWASP Top 10 2025 has been released

owasp.org/Top10/2025/0...

The definitive release should be out on November 20th

CycloneDX SBOM Spec (OWASP) on X: "CycloneDX v1.7 is here! The latest release strengthens software & system transparency with: - Cryptography BOM (CBOM) - Data provenance & citations - Intellectual property visibility Learn more: https://t.co/VjHCDgC5tL #OWASP #CycloneDX #SBOM #CBOM #CyberSecurity" / X CycloneDX v1.7 is here! The latest release strengthens software & system transparency with: - Cryptography BOM (CBOM) - Data provenance & citations - Intellectual property visibility Learn more: https://t.co/VjHCDgC5tL #OWASP #CycloneDX #SBOM #CBOM #CyberSecurity

CycloneDX v1.7 is here!

The latest release strengthens software & system transparency with:
- Cryptography BOM (CBOM)
- Data provenance & citations
- Intellectual property visibility

Learn more: cyclonedx.org/news/cyclone...

#OWASP #SBOM #CBOM #CyberSecurity

All the #Devoxx Belgium Deep Dive talks from the 2nd day are now available on the companion app and our YouTube channel! #Enjoy 🍿
www.youtube.com/@DevoxxForev...

Opt Out October: Daily Tips to Protect Your Privacy and Security Trying to take control of your online privacy can feel like a full-time job. But if you break it up into small tasks and take on one project at a time it makes the process of protecting your privacy

Welcome to Opt Out October, our collection of tips to slowly break free from online surveillance and throw sand in the gears of overreaching large tech companies. Today’s tip is about establishing good online security fundamentals. www.eff.org/deeplinks/2...

Calling all AppSec pros, devs & security leaders! The OWASP Top 10 2025 is in the works & your input matters. Survey closes Oct 3 - don’t wait! forms.gle/jL3r5Xgg1H...

Version 4.4.2 published to npm is compromised · Issue #1005 · debug-js/debug MESSAGE FROM @Qix- : PLEASE SEE #1005 (comment) FOR LATEST UPDATES. Version not present in this repo has been pushed out to npm. https://www.npmjs.com/package/debug/v/4.4.2?activeTab=code src/index...

Updates here.

github.com/debug-js/deb...

Yep, I've been pwned. 2FA reset email, looked very legitimate.

Only NPM affected. I've sent an email off to @npmjs.bsky.social to see if I can get access again.

Sorry everyone, I should have paid more attention. Not like me; have had a stressful week. Will work to get this cleaned up.

Interesting idea, to measure alignment, but a bit vague, with the Entropy Scorecard only available to paying customers(?), and its website returning a 403 outside of the US.

And keep kids on a leash? That's a bit strict.

Security Best Practices - Model Context Protocol

The MCP spec has been updated to include security best practices

• Confused deputy
• Token passthrough
• Session hijacking

modelcontextprotocol.io/specificatio...

BREAKING.

From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.

Destroying the web's usability so they can sell it back to you in slop form is exactly what they're doing.

In this example, the 2 forks of the zygote process share the same scudo secret and memory layout, which basically removes it's security enhancements.
-
Keynote by Mathias Payer at @1ns0mn1h4ck.bsky.social #android #scudo #zygote #inso25

📢 @christophetd.fr will present "Code to Cloud: Exploiting Modern Web Applications to Breach Cloud Environments" at Insomni’hack 2025!

📖 Check out the programme now: insomnihack.ch/talks/code-t...

#INSO25 #Cybersecurity #EthicalHacking #Switzerland

📢 Christophe Tafani-Dereeper will present "Code to Cloud: Exploiting Modern Web Applications to Breach Cloud Environments" at Insomni’hack 2025!

📖 Check the full lineup and get your ticket: insomnihack.ch/talks/code-t...

#INSO25 #Cybersecurity #EthicalHacking #Switzerland

Seems like there's a bit of confusion around the recent @Semgrep licence change and the @opengrep fork and I think there are two key points to highlight.

1/10