tolmo.com/blog/faster-... You should read this if you care about the PHP bug

We can now find flaws faster than anyone can fix them · Tolmo

In 2024 our audit of PHP's core reported two flaws in the exact code behind php2shell and filed one as a crash. Two years later, three teams independently turned the same defect into a working attack ...

tolmo.com

What the neural network learnt, croissant dough edition.

I'm not sure who gets the credit, but it's brilliant! 😂

A great read on EA and rationalism: contraptions.venkateshrao.com/p/ea-safety

EA Safety

EA promises to solve AI Safety. Now we have two problems.

contraptions.venkateshrao.com

Great slides from Halvar here A background in the philosophy of science is definitely serving me well in this new world!

@halvarflake.bsky.social · last mo.

I gave a talk at Bluehat Singapore today. The slides are here: thomasdullien.github.io/about/slides...

I gave a talk at Bluehat Singapore today. The slides are here: thomasdullien.github.io/about/slides...

The Pentagon fired the publisher and editor in chief of Stars and Stripes, the military newspaper that is supposed to maintain editorial independence from the very department it covers.

I wrote up three important lessons I learnt ony path to "maturity": thomasdullien.github.io/posts/2026-0...

The EU gets a bad rap, but ... sometimes we have to appreciate that the 1949-2026 period is the longest period in *documented history* without interstate war among the bloodthirsty western European tribes.

I have a personal update: Next monday, I will be starting at @OpenAI working on better cyber (which will also entail some efficiency work). I'm pretty excited about the things I will learn and the things we will do.

"We Hacked Three Companies and Didn't Even Notice" OpenAI used to be the one insisting its models were scary. Now Anthropic is filing the incident report, and the flex is showing through it. open.substack.com/pub/arunning...

I made a small animation illustrating my geometric intuition for what happens inside a simple feedforward ReLU neural network. Hope this is illuminating for someone.

Thanks @halvarflake.bsky.social -- it's so good / must read (and it's not even finished yet!)

@halvarflake.bsky.social · 4mo ago

In the last years, I spent some of my scarce free time writing up what I had learnt starting and running two companies, zynamics and optimyze The article is still work-in-progress, but I thought it's best to publish it now and iterate in public: thomasdullien.github.io/guides/entre...

In the last years, I spent some of my scarce free time writing up what I had learnt starting and running two companies, zynamics and optimyze The article is still work-in-progress, but I thought it's best to publish it now and iterate in public: thomasdullien.github.io/guides/entre...

The weirdest observation: I generated movies visualizing the polytope boundaries for ReLU networks using Muon and AdamW. Same experiment, same data, same random seed. The difference is the "crease pattern" that the optimizers produce.

Confession time: I use agentic coding all day, every day. It makes me much more productive. But I am also terrified of skill atrophy, I feel like I need to break out pen & paper to force myself to "weight-lift" mentally so I don't forget how to think. How do y'all handle this?

The most insightful take on Mythos I've seen so far. Everyone should read this but especially those who are currently thinking through the possible regulatory responses.

@halvarflake.bsky.social · 6mo ago

www.faz.net/premium/digi... I wrote a FAZ guest article.

www.faz.net/premium/digi... I wrote a FAZ guest article.

Thomas Dullien zu Anthropics Mythos: Software war nie auf perfekte Sicherheit ausgelegt - das rächt sich

Schwachstellen in Computern wurden lange hingenommen. Denn sie auszunutzen war technisch komplex und teuer. KIs ändern das nun. Damit zwingen sie uns, Altlasten schneller anzugehen.

faz.net

rewatching @halvarflake.bsky.social 's fuzzing24 keynote and thinkin real hard www.youtube.com/watch?v=Jd1h...

In an infosec context @halvarflake.bsky.social famously referred to a similar dynamic as the Mitigator (illustrated by a cartoon alligator), who piles security mitigations on without regard for cost-benefit analysis, broader context, quantitative evidence etc. on the theory it "makes things harder"

Philo@opfuchs.gay · 6mo ago

It shows not only America being lol about rail, but the utterly insane way America thinks about public safety. "Just one more security control/surveillance measure" is the "one more lane" of the American public security imagination.

@halvarflake.bsky.social this sounds like your prediction. That machine learning will be more useful for offense, than for defense. Video by @hankgreen.bsky.social (Haven’t heard the whole video yet)

You Actually Do Need to Understand Mythos

YouTube video by Hank Green

youtu.be

With age, the male body produces less testosterone but more advice.

consistently see +/-20% swings on AWS in our benchmarks

Same code using twice as much CPU. Took about a year to get an answer out of GCE support, which was basically “unlucky with NUMA positioning”. (Oh, and the hypervisor lies about NUMA)

I am observing up to 30% (!!!) wall-time fluctuations running the same code on the same data and the same VM type on GCE. That seems insane to me, in terms of noisy neighbor effects. What is the worst fluctuation you've seen on cloud machines?

A remarkable photo from #NoKings in DTLA from Connor Sheets of @latimes.com www.latimes.com/california/l...

It is the sovereign legal right of every country on the planet to repudiate their debt, and they can and do suffer essentially no consequences other than loss of access to credit markets for about 3-5 years. This is in fact so disastrous that countries prefer almost anything else to doing it!

M. Nolan Gray 🥑@mnolangray.bsky.social · 7mo ago

What's something that experts/practitioners in your field universally agree upon, but that remains a "hot take" among the general public?

Excellent - and so rare!! - overview of the role of Europe for US mil operations. “Europe remains the bedrock of U.S. force projection in the world and any action to cut those ties with Europe “would be a huge loss to the U.S.,” said Bence Nemeth. “It would cost time, money and resources.””

Europe Is Quietly Playing a Crucial Role in the Iran War

European military bases are facilitating one of the most logistically complex operations the U.S. military has been involved in for decades.

wsj.com

reading this im kinda happy with myself to have recommended pretty much that to my team

@halvarflake.bsky.social · 7mo ago

I wrote a few lines about my development setup (which - by accident, not by design - mitigates a good number of risks associated with vibecoding. Not all of them, but many.) addxorrol.blogspot.com/2026/03/slig...