Spanky

YouTube video by Three Buddy Problem From Epstein to Notepad++: Redactions, Zero-Days and Supply Chain Attacks

This week's show is up on YouTube (presented by Thinkst Canary @thinkstcanary.canary.tools)

WATCH www.youtube.com/watch?v=fvKM...

Programming Languages and Serialization CVEs Taking a look at a recent critical Solar Winds CVE

If Pentesting, AppSec, Bug Bounties or Security Engineering is your focus the Security Bugs section of my blog may be for you. Here I explore a serialization CVE in SolarWinds and prevention methods

Programming Languages and Serialization CVEs

teriradichel.substack.com/p/programmin...

A destructive cyberattack in Poland raises NATO 'red-line' questions - Security Conversations (Presented by Material Security: We protect your company’s most valuable materials — the emails, files, and accounts that live in your Google Workspace and Microsoft […]

🔥 #ThreeBuddyProblem Ep83 has been pushed to your earholes. Poland CERT on Russian wipers, Sandworm or not Sandworm, new FortIvanti nightmares + some KasperSekrets chit-chat @craiu.bsky.social @jags.bsky.social

securityconversations.com/episode/a-de...

No.

a bald eagle surrounded by stars and stripes and the text "oh my god, what the fuck"

Today’s Daily Cartoon, by Teresa Burns Parkhurst. #NewYorkerCartoons

Jan. 6, 2021: A visual archive of the Capitol attack NPR’s Jan. 6 archive brings together reporting, video, documents and testimony to show what really happened during the Capitol riot. Explore the timeline, cases and evidence behind the attack.

NPR built a visual archive of the Jan. 6, 2021, attack on the Capitol, showing exactly what happened through the lenses of the people who were there. In "Chapter 2: Stop the Steal," we look at how false claims of a stolen election mobilized Trump supporters.

Don't get angry, but the 2025 Oxford Word of the Year is 'rage bait' The 2025 selection follows its predecessors, "brain rot" from 2024, "rizz" from 2023 and "goblin mode" from 2022.

The 2025 selection follows its predecessors, "brain rot" from 2024, "rizz" from 2023 and "goblin mode" from 2022.

What's behind US gov push to 'privatize' cyber operations?

A fresh problem has been pushed to your podcast platforms! @craiu.bsky.social @jags.bsky.social

- Spotify open.spotify.com/episode/68US...

- Apple podcasts.apple.com/us/podcast/w...

Presented by our friends at ThreatLocker 😍

AI isn’t reinventing ransomware — it’s industrializing it.

That’s the core finding from new @sentinellabs.bsky.social research on how threat actors are actually using LLMs today. s1.ai/llm-rw

Outgoing GAO chief warns of ‘taking our foot off the gas’ at CISA Gene Dodaro, who is set to retire from the watchdog at the end of this month, shared final concerns with senators Tuesday about how the government is prioritizing cybersecurity.

Outgoing 15-year head of GAO says he's worried the government is "taking our foot off the gas at CISA" and would "live to regret it." He also said CISA's one-third workforce cut was "obviously untenable" and "they may not be postured" to support the midterm elections. fedscoop.com/cisa-workfor...

The BloodHound Query Library, launched by @martinsohn.dk & @joeydreijer.bsky.social, democratizes tradecraft with a shared, searchable ecosystem. With 180+ Cypher queries & counting, the library is an increasingly valuable tool for the BloodHound community!

Browse ➡️ ghst.ly/bql_eoybsky

Today’s Daily Cartoon, by Brendan Loper. #NewYorkerCartoons

An Evening with Claude (Code) - SpecterOps This blog post explores a bug, (CVE-2025-64755), I found while trying to find a command execution primitive within Claude Code to demonstrate the risks of web-hosted MCP to a client.

AI tooling and MCP servers are entering enterprises fast, often faster than security teams can assess the risks.

During a recent engagement, @xpnsec.com found a new Claude Code vuln (CVE-2025-64755) while exploring MCP abuse paths.

👀 Read the details: ghst.ly/49ybl4W

White Knight Labs: Part 2 - Phillip Wylie About the Guests: Greg Hatcher and John Stigerwalt are co-founders of White Knight Labs, a boutique cybersecurity company specializing in offensive security services and advanced training programs. Greg’s background includes a remarkable career as a Green Beret in the U.S. Army, transitioning into cybersecurity with a focus on penetration testing and red teaming. John’s journey…

White Knight Labs: Part 2

Caffeine raises my heart rate and makes me sweat. Team decaf rise up!!!

A woodcut of a bird beside the text "OH MY GOD SHUT THE FUCK UP"

A U.S. District Judge has ruled that interim U.S. Attorney Lindsey Halligan (who had no prosecutorial experience before this role) was improperly appointed by the Trump administration, agreeing with Comey’s defense team.

The ruling means that both federal indictments are dismissed. trib.al/WZbNPi9

As long as it's not a clear alcohol...

@cyberwarcon.bsky.social how do you get so much talent packed into one day? This is my favorite conference. Every talk is a banger.

Chess boxers fight to win by hook or by rook Chess boxing got its start in a graphic novel. Now actual competitors fight for knockouts and checkmates. Russia has dominated for years, but the sport's popularity is growing in the U.S.

When Matt Thomas dropped out of law school, he devoted himself to a sport he initially thought was a joke: chess boxing. cbsn.ws/3LB3nOz

Sanford grandfather, born in refugee camp, nabbed by ICE after 70 years in U.S. Paul Bojerski never gained official residency, but he checked in regularly with ICE for years. Then in July, at age 79, he was detained and sent to Alligator Alcatraz.

79-year-old Paul Bojerski was born to Polish parents in a WWII German refugee camp. His family legally emigrated to the U.S. when he was 5.

He’s been taken by ICE in Florida.

www.orlandosentinel.com/2025/11/16/s...

This Thursday @strandjs.bsky.social join us to talk about China!

A cross between history and technology John breaks down exactly what he will be discussing in his webcast here!

Interested? Come join us and register here: events.zoom.us/ev/AhsoFeh2O...

Cybersecurity breach at Congressional Budget Office remains a live threat Library of Congress employees were informed to take caution when emailing the office of the congressional scorekeeper.

Politico is reporting that the breach at the Congressional Budget Office is "ongoing."

“Do NOT click on any links in emails from CBO. Do NOT share sensitive information with CBO colleagues over email, Microsoft Teams, or Zoom at this time,” the email to CBO staff reads.

I found myself using this career advice slide a lot lately and thought I would share it more broadly.

What GreyNoise Learned from Deploying MCP Honeypots GreyNoise deployed MCP honeypots to see what happens when AI middleware meets the open internet — revealing how attackers interact with this new layer of AI infrastructure.

We deployed MCP honeypots to understand how threat actors engage with AI middleware exposed to the internet. What we observed was unexpected. Full analysis ⬇️
#GreyNoise #AI #AISecurity #MCP #MCPSecurity #Cybersecurity #ThreatIntel

The Case That A.I. Is Thinking ChatGPT does not have an inner life. Yet it seems to know what it’s talking about.

The rushed and uneven rollout of A.I. has made it tempting to conclude that it’s all hype. But its advancement may have profound implications for the field of neuroscience.

I hope Buck sees this and appreciates it.

AI of a Thousand Faces What happens now that AI is everywhere and in everything? WIRED can’t tell the future, but we can try to make sense of it. Behold: 17 readings from the furthest reaches of the AI age.

🎇New package alert @wired.com! This one has been in the works for months. If WIRED was going to tackle AI -- something we cover daily -- we had to go big. So here are 17 different stories about the way AI is changing us, even as the technology itself keeps moving www.wired.com/ai-issue/

Summary of the Amazon DynamoDB Service Disruption in Northern Virginia (US-EAST-1) Region

I bet someone wishes they had checked for an empty value in this code right about now:

The root cause of this issue was …