Nicolas Henneaux

@nicolas.henneaux.io

I'm seeing folks draw the wrong conclusion (in good faith or not) from the HAWK attack. HAWK is a scheme that 1. cryptographers were suspicious of and 2. was still in the assessment process. A break is GOOD. It means the process is useful, and it INCREASES confidence in the selected algorithms.

There we go. US Gov tightens post-quantum cryptography transition deadlines for high-value systems to 2030 for key exchange and 2031 for signatures. Also, speeding up the CMVP (FIPS 140 validation) processes. That’s how you know the rush is real. The quantum computers are (potentially) coming.

Securing the Nation Against Advanced Cryptographic Attacks

By the authority vested in me as President by the Constitution and the laws of the United States of America, it is hereby ordered: Section 1.  Background

whitehouse.gov

… are fucking kidding me. A github.com cross-account RCE due to the most pedestrian of injection attacks along the obvious exposed surface… and they actually have a globally shared “git” UNIX user!! This is not what taking the role of supply chain stewards seriously looks like.

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog

A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.

wiz.io

This is an interesting case study of our adversaries observing, learning & adapting around preferred western ways of war. The authoritarian learning & adaptation bloc is almost certainly sharing these ideas among themselves. www.justsecurity.org/134720/iran-...

Iran Built a Military to Survive the American Way of War

Iran’s staying power is not proof that the regime is strong; it is proof that it read the American way of war playbook.

justsecurity.org

Belgium is hiring a Ukrainian firm to build drones on Belgian soil – not just buying hardware, but importing the expertise behind the most combat-tested drone program in the world. It's part of a wider NATO pattern: Europe isn't just supporting Ukraine anymore. It's learning from it.

Belgium turns to Ukraine to build its own drone industry, citing lessons from the front line

New contract with a Ukrainian company will produce drones and drone detection systems on Belgian soil.

euromaidanpress.com

“A classified report by the National Intelligence Council found that even a large-scale assault on Iran launched by the United States would be unlikely to oust the Islamic republic’s entrenched military and clerical establishment.” wapo.st/4lcrq3M

Intel report warns large-scale war ‘unlikely’ to oust Iran’s regime

A classified U.S. report doubts that Iran’s opposition would take power following either a short or extended U.S. military campaign.

wapo.st

"Eventually shock wears off, responses are developed & counterpunches delivered. This will be the case with the Starlink shutdown. Ukraine will have limited time to exploit the opportunities of the degraded C2 environment now endured by Russian ground forces." mickryan.substack.com/p/starlink-s...

Starlink Surprise

Ukraine surprised Russia with the Starlink shut off, and they have made the most of that surprise to take back territory. But like all surprises, the time to exploit that opportunity is limited.

mickryan.substack.com