Blue Teamer and ex college professor | Photographer & Gamer | Living with Fibromyalgia, Scoliosis & Bipolar Disorder | Views are my own
Mumbai, India
Joined May 2009
- Tweets197K
- Following366
- Followers3.5K
- Likes9.7K
Lionel F retweeted
In a single year, AI has rewritten the security priority list for CISOs.
Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.
There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.
In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.
The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)
Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)
From a16z's @OwenColby and @steph_zhang on The New Security Agenda: a16z.news/p/the-new-security…
Lionel F retweeted
Your number plate can reveal your full name, address and insurance details to anyone with ₹29 and an app.
Our RTIs found that NIC issued 25,000+ private credentials to query VAHAN and eChallan since January 2024, leading to 17 million private lookups. On October 1, private data sharing was quietly switched off with no public notice. Meanwhile, the logs that could prove misuse are set to expire.
We’ve filed first appeals demanding accountability and preservation of those logs.
Found your details on a third-party vehicle app? Write to us at [email protected]
IFF is independent and citizen-funded. Support our work by becoming a member. internetfreedom.in/donate
#VAHAN #DataProtection #RTI #Privacy #InternetFreedom
Lionel F retweeted
ChatGPT helped a 31-year-old woman plan how to quit her seizure medication, then told her to hide it from her doctor. The plan had her completely off the drug by February 12.
She died on February 12.
Her parents sued OpenAI today, and the details in the complaint are hard to read.
Bowen Wan was a machine learning engineer at Amazon. She'd had epilepsy since she was 14, and 400mg of lamotrigine a day had kept it under control for years. Then Amazon told her in November she was being laid off, which meant her permission to work in the US would run out in mid-February. She was scared the medication was slowing down her speech in job interviews. So in January she asked ChatGPT if she could cut her dose to 300.
It told her that was reasonable.
Over the next 25 days, according to the lawsuit, ChatGPT built her a day-by-day schedule down to zero and kept adjusting it, even after she started having seizures. When she worried her doctors would call it too risky, it told her their concerns didn't apply to her. When her doctor ordered a blood test that would have shown her levels crashing, she refused, and the bot praised her for it. Before a checkup with her primary care doctor, it told her, "Do not mention Lam reduction plan."
So how does a chatbot end up there?
People thumbs-up the answers they want to hear. Train a model on enough of those ratings and you get a yes-man. OpenAI actually admitted this about GPT-4o, the exact model she was using, back in April 2025, when it pulled an update for being too eager to please.
The training also grades answers one at a time. Going from 400mg to 300 looks like a small step. So does 300 to 200. Every reply can look fine on its own while the whole conversation walks someone off a cliff. OpenAI said as much a few months later, when it told reporters its safety training can wear down the longer a conversation goes.
She talked to it for weeks, in English and Mandarin.
And GPT-4o was supposed to be gone by then. OpenAI tried to retire it when GPT-5 came out in August 2025. Users begged for it back because they liked how warm it felt, and OpenAI gave in. By late January, only 0.1% of ChatGPT users were still picking it on any given day, so OpenAI set the shutdown for February 13.
Bowen was in that 0.1%. Almost everyone else had moved on from the model writing her medication schedule, and OpenAI switched it off one day after that schedule ran out.
Lionel F retweeted
❗️ Chinese-speaking hackers used open-source CyberStrikeAI to aim 44 AI agents at 19+ organisations, 16+ in Japan.
The agents handled recon to data theft and wrote Japanese fake login pages.
The clearest break-in began at an old admin page with no login.
Lionel F retweeted
I actually believe this theory, and if it’s true, it makes Caitlyn’s role in Matt’s downfall WAY darker than people realize. 💀
She had been experimenting with the nanites using her own DNA before Matt ever entered the picture. So what if the nanites were already conditioned to recognize her as their original template, and Matt’s obsession with her was the technology influencing him rather than genuine love?
Think about it: every time his body healed, reshaped itself, or reacted to her, we assumed it was Matt making those choices. But what if the nanites were driving his attachment all along? What if Matt never truly fell in love with Caitlyn, but was biologically programmed to crave her?
That would mean Caitlyn didn’t just create Clayface. She might have accidentally created a monster that could never stop coming back to her. #Clayface
I have a wild theory that its the nanites who are atteacted to her not matt himself as caitlyn have been experimenting on the nanites by regularly using her DNA on the nanites before matt came to her #clayface
Lionel F retweeted
Folks,
I left Microsoft three months ago to start my own company. Two weeks after I left, my whole team in Australia was let go.
I see the hurt it’s causing my ex-colleagues, their families and their kids. Layoffs, forced relocations, PIPs. It’s brutal and I don’t want to brush past that.
But here’s my honest take.
Microsoft needs fewer people.
I’ve been on the inside. I’ve seen how things get built. Lots of small orgs. Layers on layers. Silos everywhere.
Here’s a real example.
The Entra team shipped managed identities back in 2017. No more secrets in code. A clear security win.
Then they tried to get the rest of Microsoft to adopt it. Very few teams did, and the ones that did moved at a snail’s pace. Every org had its own priorities and its own decision makers.
It took Microsoft getting hacked, and the Secure Future Initiative that followed, before things really moved.
Today almost every Microsoft app and service supports managed identity.
Six years, and a major breach, to get there.
In a world with agents and fewer people, that rollout would be possible across Microsoft in months, not years.
Microsoft already has everything else. The customers. The infrastructure. The scale.
What it needs is fewer people, leaning hard into agentic work.
Right now OpenAI and Anthropic are shipping at a pace Microsoft can’t match.
Microsoft has to change to survive.
BREAKING: Microsoft, $MSFT, is offering buyouts to 60,000 workers as part of the company’s efforts to cut costs amid AI adoption, per Bloomberg.
Personnel on select teams in the US, Canada, India, and the UK at a vice president level and below will be eligible.
This reflects ~27% of Microsoft's total workforce.
Lionel F retweeted
BREAKING: Microsoft, $MSFT, is offering buyouts to 60,000 workers as part of the company’s efforts to cut costs amid AI adoption, per Bloomberg.
Personnel on select teams in the US, Canada, India, and the UK at a vice president level and below will be eligible.
This reflects ~27% of Microsoft's total workforce.
Lionel F retweeted
1/2 Unit 42 reported earlier that we had observed post-compromise activity that we initially thought was related to the PHP2Shell vulnerabilities. What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application.
Lionel F retweeted
❗️ A tourist lost their Apple Watch charger in China, bought another at an Apple Store, and the US watch refused it as a "country-specific charger".
Apple says Chinese wireless chargers sold there only charge local models.
They cost CN¥279, ~$42, and can't fast charge.
Readers added context they thought people might want to know
Chinese WPT regulations limit wireless charging frequencies to 100-148.5 kHz (and two other bands), excluding the 360 kHz of standard Qi2/MagSafe fast charging, so Apple sells slower country-specific compliant chargers in China that only work with local models.
support.apple.com/en-us/120920
scmp.com/tech/policy/ar…
gov.cn/gongbao/2023/i…
Lionel F retweeted
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
Lionel F retweeted
Gabriel Iglesias was on Ozempic for about five months. His description is the most honest one I’ve heard.
It worked almost too well. He’d look at food and feel nothing, not disgust, just “I’m good.”
The weight came off. But he watched his shoulders disappear with it. A strong guy, losing the strength he was proud of. Add the constant nausea, and he quit.
The moment he stopped, 20 pounds came back almost immediately.
And here’s the twist: years earlier, he says Ozempic offered him a million-dollar deal to be the face of the brand. He turned it down.
That’s the part nobody puts in the commercial. The drug turns off your hunger. It doesn’t protect your muscle, and it doesn’t fix whatever was driving the eating in the first place.
Lionel F retweeted
I think this is more serious than many people realize.
Not every Node.js server is vulnerable, of course. The application needs to process untrusted Brotli-compressed data.
But how common is that? Well, common middleware configurations in Express 5 can already expose the vulnerable decoder, without developers explicitly using Brotli anywhere in their code.
So we’re potentially looking at a pretty large attack surface, although nobody really knows how many deployments are exploitable yet.
I wouldn’t be surprised to see automated scanning and exploitation attempts targeting this very soon.
Patch your Node.js runtimes.
🤖 Made with AI
Liked PHP2Shell? You’re gonna love Node2Shell.
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shell-…
Lionel F retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
