Russell Phillips

I'm packing for DEF CON and its so tempting to bring my microscope with me....

I refuse to call voice phishing "vishing" not only does it sound goofy but it is not helpful. Promoting the idea that phishing is channel specific trains users to only pay attention in those channels. But phishing can be whatsappishing, intercomishing, twitchishing, or even coffeeshopishing.

Your public ChatGPT queries are getting indexed by Google and other search engines | TechCrunch Search engines are indexing links to ChatGPT conversations that have been made sharable with a link.

The privacy implications from publicly indexing LLM chats isn't surprising, but people routinely create policy that treats LLM chats like search queries rather than much more private data. The industry needs to reckon with the fact they've pushed users to share deeply. techcrunch.com/2025/07/31/y...

Anyone have of any good examples of LLM code execution vulns that are server-side rather than user-side? As tool use becomes more common we should see more examples of this.

I'm late to the hot takes about Tea, but luckily for me it won't be long until another unsecured S3 bucket dumps a bunch of ID verification photos into the public. Then I'll seem prescient.

After $380M hack, Clorox sues its “service desk” vendor for simply giving out passwords Massive 2023 hack was easily preventable, Clorox says.

This part of the Clorox hacking story is wild to me! Even if the helpdesk had followed their policy, the only information required for a password reset was the manager's name and the user's username. Even the unenforced policy was bad too! arstechnica.com/security/202...

LLMs are the new frontier in unsanitized user input and we're going to see more and more exploits of this.