Adrian Sanabria
@sawaba.bsky.social
🎙️ Enterprise Security Weekly Podcast Host, 🤝 BSides Knoxville Founder, 🗣️ IANS Research Faculty, 🍳 Cooking, 🏎️ F1, ⛰️ Hiking
We are on break for lunch, but rewind to see my opener… and stay tumed for 2hrs on water next. Quite timely.
Institute for Security and Technology@istorg.bsky.social · 2d agoIST’s #UnDisruptable27 Initiative is at #BSidesLV! @joshcorman.bsky.social leads the #IAmtheCavalry track. Tune in today to watch water regulators, engineers, and ICS experts tackle issues of operating a hospital without water, IT/OT in the AI era, #CyberCivilDefense, and more! 🛡️ Watch live:
Normalize making fun of people when they’re all proud of having used generative AI to do some trvial task. Yesterday’s example: A colleague made a sign that said ‘USE THIS DOOR, OTHER DOOR IS BROKEN.’ Yup. AI for that. 1/?
This voiceover artist nails one of the most annoying trends in cybersecurity right now www.instagram.com/reel/Da_K-z8...
Create an account or log in to Instagram - Share what you're into with the people who get you.
instagram.com
Happy to share that I will be speaking at BSides Las Vegas this year! My talk is "Destroyed by Breach: Corporate casualties of cybersecurity failures" Common Ground, Tuesday 10:00-11:00, Florentine F I'll be at Black Hat and DEF CON as well. Let me know if you want to meet up!
This week on ESW: 1. O'Shea Bowens - network security for MCP 2. Jeremiah Grossman - there is no vulnpocalypse 3. Finally, we discuss the future of AI model use and the HuggingFace breach We went a little long on this one, but I think it was well worth it. www.youtube.com/watch?v=Em3F...
Exploring AI Network Protocols; Vulnerability Truths and Guarantees; and the News - ESW #469
Segment 1 - Interview with O'Shea Bowens What do we really know about "AI Network Protocols"? Network security is about to get popular all over again. Generative AI caused a disruptive…
youtube.com
Spotted an interesting comment on LinkedIn this morning.
In my latest post, I ponder whether Project Glasswing is just a private freemium tier, designed to hook the world’s largest software makers into fueling an endless token bonfire. open.substack.com/pub/defender...
The unintended consequences of vulnmaxxing
The only way to fix vulns at AI scale is to use AI. Coincidence or cash grab?
open.substack.com
TL;DR - Reddit posts are now SEO/AEO, which means Reddit has become a battleground trying to fight off corporate marketing posts
Jason Koebler@jasonkoebler.bsky.social · 2mo agoThe biohackers subreddit banned all posts about peptides and HRT because peptide companies were spamming + manipulating the sub in order to manipulate Google AI and ChatGPT answers. Very insidious industry that is drastically changing the internet www.404media.co/companies-ar...
For anyone interested, I've shared the slides from my @bsidesknoxville talk hosted-files.sched.co/bsidesknoxvi...
Happy DBIR day everyone! It's really good, as always. I wrote up some thoughts: www.defendersinitiative.com/p/verizons-1...
Verizon's 19th edition of the DBIR confirms the vulnpocalypse***
But with many asterisks! Read on to find out why 😅
defendersinitiative.com
You've probably heard about Anthropic's Mythos, but did you know open-source AI tools have been doing the same thing for the past year? I wrote about these bug-finding systems and why they might be better than Mythos for critical infrastructure firms. www.cybersecuritydive.com/news/ai-vuln...
April 2026: LOL, enterprises would have to be mad to consider using OpenClaw internally May 2026: Oh, a client has a question about some OpenClaw vulns that affect them, this is normal
Defense is Offense’s child, but Offense has traumatized its children #randomthoughts
You know, for an OS that sets the standard for vulnerable implementations, at least the default lock screen image is nice to look at, right?
VNC Lottery@vnclotto.misentropic.com · 3mo agoASN: AS270353 Tyna Host - Datacenter no Brasil Country: BR City: São Paulo State: São Paulo Scanned: 2025-05-08T22:33:10 https://computernewb.com/vncresolver/browse#id/69826466 #vnc #infosec
This isn't an AI problem. In any context, if the reporter didn't observe the quote, they needed to cite their source. And that's more than just the wording of the quote. The reporter is responsible for the inferred meaning matching the actual context of a statement.
Michelle Cyca@michellecyca.com · 3mo agopersonally I think it's a very big deal that the Canada bureau chief for the @nytimes.com — certainly one of the highest-paid journalists in the country — asked an unspecified "AI tool" what Poilievre said & published its AI-hallucinated quotes in her reporting.
Potential hot take: vulnerabilities are sparse if a vulnerability is required to have value to an attacker.
Hey Claude, is it possible that threat actors make more money off hacking firewalls/VPNs than companies make selling them #AIQuestions
So yesterday: This vuln is being exploited in the wild Today: To date, threat actors have earned $247M from this vuln
Copy Fail? Also looks like memory safety, but is actually complexity. xint.io/blog/copy-fa... I am going to link to this while rejecting changes to Go crypto for years. Anyway, feeling pretty validated in my "ssh in as root, only gVisor or Firecracker are an actual security boundary" approach.
Copy Fail: 732 Bytes to Root on Every Major Linux Distribution - Xint
Xint Code disclosed CVE-2026-31431, an authencesn scratch-write bug chaining AF_ALG + splice() into a 4-byte page cache write. A 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE. | AI for Se...
xint.io
Filippo Valsorda@filippo.abyssdomain.expert · 4mo agoThere are only two bug classes left: complexity and memory safety. CurveBall (CVE-2020-0601)? Complexity. BigSig (CVE-2021-43527)? Memory safety. Log4Shell (CVE-2021-44228)? Complexity. BlueKeep (CVE-2019-0708)? Memory safety. Heartbleed looks like memory safety, but it's actually complexity.
I'm putting together a webinar on modern vulnerability management and I'm REALLY trying to drive a point home So naturally, I bought 3 old Sonicwall firewalls
Starting to get some coverage from the media on the Destroyed by Breach site! www.cybrsecmedia.com/breaches-don...
Breaches Don’t Kill Companies. Being Unprepared Does.
Adrian Sanabria built "Destroyed By Breach" to cut through cybersecurity myth-making, and what he found is more uncomfortable than the fear-driven narrative the industry often sells.
cybrsecmedia.com
This is _the_ most underrated cybersecurity project. Awesome to have a website instead of the spreadsheet 🥳
We are very happy that today Apple issued a patch and a security advisory. This comes following 404 Media reporting that the FBI accessed Signal message notification content via iOS despite the app being deleted.
Big news: Sean Plankey has withdrawn from consideration to be Trump's CISA director after his nomination languished for more than a year amid bipartisan holds in the Senate. CISA hasn't had a permanent director since Trump retook office. www.politico.com/news/2026/04...
Trump’s pick to lead CISA withdraws nomination after months of political impasse
Resistance from Sen. Rick Scott (R-Fla.) stalled Sean Plankey’s nomination for over a year.
politico.com
I am thrilled to announce that my Destroyed by Breach research project finally has a proper website! destroyedbybreach.com
🚨 BREAKING: Vercel has been breached. A threat actor has listed their customers' data, source code, databases, and keys up for sale. Vercel has also publicly disclosed they've identified a security incident involving unauthorized access to their internal systems.
