In the age of "Clank The Planet" it has never been more important to preserve and promote community, the people who comprise it, and the culture that defines it 🧡 🧡 🧡 www.bugcrowd.com/blog/the-hac...

The Hacker Culture Manual | @Bugcrowd

About a year ago, I read Cult of the Dead Cow by Joseph Menn. It gives the history of the original hacking group. I was particularly struck by one of the founding members, Carrie Campbell. She never…

bugcrowd.com

HELLS YES... Bugtraq is back - Bugtraq - SecurityFocus Mailing Lists m.cje.io/4xmq5w7

Bugtraq is back - Bugtraq - SecurityFocus Mailing Lists

In 1993, Scott Chasin created Bugtraq as a place for full disclosure - a mailing list where security researchers could publish vulnerabilities openly, without gatekeepers, without politics. For over…

m.cje.io

For the Top 100 scoreboards we scored the Fortune 100, ASX 100, and FTSE 100 against the disclose.io maturity model by reading each company's published disclosure policy. The results are public: state.disclose.io/top-100

little reminder: if you're hustling at @BlackHatEvents @BSidesLV @defcon this year (job hunting, consulting, recruiting, etc) i made a tool creates a sexy looking linkedin QR code wallpaper, so you can share details without the fumble (*) qr.cje.io * = it's especially handy after 10pm or so 🙃

LinkedIn QR Wallpaper: Skip the app. Share your profile from your lock screen.

For those on the hustle: generate a lock screen wallpaper with your LinkedIn QR code. One click, zero apps. Free.

qr.cje.io

Apple AI Bug Cap Blocked Critical macOS Screen Sharing Flaw Before Submission m.cje.io/4yQPRul

Apple AI Bug Cap Blocked Critical macOS Screen Sharing Flaw Before Submission

Apple bug bounty AI reports face a new structural problem: the company’s submission cap — introduced to filter AI-generated vulnerability noise — blocked startup Bynario from reporting…

m.cje.io

"when demoing your app idea make sure that you're on the hotel or conference wifi, and that your app is bound to 0.0.0.0" #baddefconadvice

CISA says it will use World Cup security model to protect midterms & is reassigning staff to serve as election security advisors, a year after forcing out experts in the field. Election officials say fed support should've come far earlier in cycle: www.cnn.com/2026/07/31/p...

Trump admin tries to rebuild election security infrastructure it gutted as midterms near | CNN Politics

After dismantling the federal system designed to protect US elections, the Trump administration now says it has a plan to rebuild it — less than 100 days before Election Day and just weeks before ball...

cnn.com

"If you’re under the impression that these models are “glorified autocomplete” or that progress is slowing down, I need to urge you: stop thinking that." blog.cryptographyengineering.com/2026/07/29/s...

Some thoughts about Anthropic’s new cryptanalysis results

Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAW…

blog.cryptographyengineering.com

We built lookup.disclose.io to answer 'who do I report this to' with data instead of guesswork. Give it a domain, IP, repo, package, or app and it returns the organization responsible and their published security contact. API and MCP server included.

Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities | StateScoop statescoop.com/coordinated-...

Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities | StateScoop

A cyberattack of undetermined origin disrupted water treatment plants in at least 30 communities in Minnesota, according to the state's technology bureau.

statescoop.com

The [un]prompted CFP closes Thursday at midnight AEST. AI x security, Sydney, September 18-19. I'm on the program committee, and if you're doing real work at this intersection we want to hear about it. Have a go: sessionize.com/au-unprompted/

disclose.io has grown into a full toolbox over the years: a program directory, a security-contact lookup engine, safe-harbor terms, policy generators. Ahead of Vegas I'm walking through one property at a time. Start here: go.disclose.io

#hackersummercamp tip: The "LinkedIn QR code as lock-screen wallpaper" trick is one that I've used for years So yeah: #founders, #consultants, #jobhunters, #recruiters, #hackers, #marketers, #bizdev, etc... This is for you 🫶 Free, no data retained, etc... Enjoy! qr.cje.io

LinkedIn QR Wallpaper — Skip the app. Share your profile from your lock screen.

For those on the hustle: generate a lock screen wallpaper with your LinkedIn QR code. One click, zero apps. Free.

qr.cje.io

2 Million Cars with Anti-Theft Systems Installed by Dealers are at Higher Risk of Theft

2 Million Cars with Anti-Theft Systems Installed by Dealers are at Higher Risk of Theft

At least 2.2 million cars on the road today are vulnerable to an attack that allows thieves to lock and unlock doors and immobilize vehicle engines remotely via a Bluetooth connection, computer…

today.ucsd.edu

one of my favorite humans to sit down and jam with... the inimitable @haroonmeer 💚 Sponsored: Thinkst on building companies that don’t suck - Risky Business Media risky.biz/RBNEWSSI136/

Sponsored: Thinkst on building companies that don’t suck - Risky Business Media

In this Risky Business sponsor interview Casey Ellis chats with Haroon Meer from Thinkst about building companies customers don’t hate. Ha [Read More]

risky.biz

@whereis.co San Francisco Bay, CA whereis.co/cje.io #whereis

@cje.io is in back in the San Francisco Bay! · WhereIs.co

Self-declared by @cje.io on Bluesky: back in the San Francisco Bay!.

whereis.co

it blows my mind how folks have failed to see that this has been the game the whole time… the easiest way to rig an election is to convince voters that voting is futile.

Tom Nichols@radiofreetom.bsky.social · 3w ago

The documents Trump cited don't even make his case - and actually refute much of it. But that didn'tg matter. No foreign regime, no spies, no saboteurs have yet matched the damage that America’s own president just did tonight to faith in U.S. elections. www.theatlantic.com/ideas/2026/0...

The White House just launched GOLD EAGLE: an AI-powered federal clearinghouse for vulnerability coordination (EO 14409). CVD is national infrastructure now. The open toolkit for doing it well: go.disclose.io

In honor of the great @cje.io: PATCH YO SHIT PEOPLE

If you’re a Democrat and plan to vote this fall, please acquaint yourself now with what looks to me to be a highly skilled extrapolation of where that’s headed. Which is by definition not merely a best guess.

Rick Wilson@therickwilson.bsky.social · 4w ago

The MAGA Election Heist Is Coming open.substack.com/pub/therickw...

@whereis.co sydney, australia

ok, the correct caption here is “marketing the existing of tao is back”

Martin Matishak@martinmatishak.bsky.social · 4w ago

The National Security Agency has rebranded its elite hacking division, though the new name will be familiar to anyone who has followed the spy agency's history of offensive cyber operations. Tailored Access Operations is back. therecord.media/nsa-revives-...

New #Boston conference just dropped

MinuteCon@minutecon.org · last mo.

Save the date.Ÿ“Œ @MinuteCon is coming to Boston: an independent hacker conference on April 30 to May 1, 2027. Two days, two tracks, real research, live demos. Sign up for updates: minutecon.org

super cool idea to look up your own org, and then do what is needed to make your security contact easier to find!

cje@cje.io · last mo.

lookup.disclose.io finds the security contact for any asset (domain, ip, package, repo, container, extension) and now plugs into recon: dio-lookup cli, caido + burp plugins, json api, and mcp server. plus directory.disclose.io grades programs against our maturity model.

lookup.disclose.io finds the security contact for any asset (domain, ip, package, repo, container, extension) and now plugs into recon: dio-lookup cli, caido + burp plugins, json api, and mcp server. plus directory.disclose.io grades programs against our maturity model.

Very cool tool!

lookup.disclose.io finds the security contact for any asset (domain, ip, package, repo, container, extension) and now plugs into recon: dio-lookup cli, caido + burp plugins, json api, and mcp server. plus directory.disclose.io grades programs against our maturity model.