Hacker. Co-founder Veracode. Former L0pht security researcher. GenAI Auto-repair of vulns is the future
Boston, MA
Joined March 2008
- Tweets30.6K
- Following1K
- Followers55.6K
- Likes8.2K
Pinned Tweet
28 years ago today, 7 members of the hacking group @L0phtHeavyInd told the U.S. Senate they could "shut down the internet in 30 minutes."
Chris Wysopal retweeted
The time to develop exploit code for a vulnerability, is different from when adversaries first try it in the wild, and it’s different from when it’s first exploited in a breach.
In 1998, we at L0pht told the Senate software makers weren’t building security into products. 28 years later, users still pay for preventable flaws. Congrats to Lauren Zabierek & @boblord on launching the Software Safety Institute. Long overdue.
softwaresafety.org
Now this is a hackathon I can get behind. More of this please!
College Hackathon Roots LG TV, Finds It Sharing Location Data
securityledger.com/2026/10/c…
Supply chain attack through trusted 3rd party monitoring script that was replaced with malicious code.
POLYMARKET HALTS TRADING AFTER HACKERS DRAIN USER FUNDS WITHOUT PASSWORDS OR SEED PHRASES
Attackers allegedly exploited users’ active sessions to sell their positions and withdraw funds directly through Polymarket’s own system.
The attack reportedly originated from a compromised DebugBear website performance monitoring script, which was replaced with malicious code that users’ browsers trusted.
Trading resumed after roughly one hour. Polymarket says affected users will be reimbursed and the incident has been referred to UK law enforcement.
Chris Wysopal retweeted
Technology will change. The fundamentals of software security won't.
For #CybersecurityAwarenessMonth, Veracode CTO @WeldPond shares 10 security practices built to stand the test of time.
Read more: darkreading.com/cyberattacks…
Veracode's GenAI code security benchmark average has improved for the 1st time. LLMs are starting to write more security code!
The average security pass rate jumped from 56% to 62%. The new high water mark is 73%, shared by two models. Ten models now clear 60%, up from four, and cross-site scripting (CWE-80) is finally climbing.
veracode.com/blog/fall-2026-…
At @unpromptedconf, @schneierblog stresses the need for Integrity in AI systems as the internet becomes civilization’s control plane with AI. He is bringing back the word “integrous”.
873
The leader board. Save time fixing and verifying security bugs by getting the code right the first time.
102
Chris Wysopal retweeted
My forward to the 40th anniversary Phrack, released today at [un]prompted. A true honor, and responsibility, I will not soon forget.
Thank you to the Phrack team for all you do, and for being what this community is about for so long. We owe you so much
Chris Wysopal retweeted
AI-driven threats demand collective resilience.
This Wednesday at 3 PM CDT, join @WeldPond at #FSISAC in Austin to explore how financial institutions can strengthen cyber defenses.
Connect with Veracode at Booth #68!
fsisac.com/events/americas-f…
Does anyone remember the time in the 90s when people thought the antivirus vendors were releasing viruses so companies had to buy their products?
Now AI is finding vulnerabilities, writing exploits, and creating threats so fast that the only way to defend yourself is to buy more AI.
It’s starting to feel like the 90s all over again.
Chris Wysopal retweeted
PHP2Shell exposed critical vulnerabilities in core PHP, affecting every PHP version released in the last decade
Patching still matters, but it cannot be the whole strategy.
@Weldpond on why resilience must be built in.
veracode.com/blog/the-week-s…
I'm excited to speak with @manicode tomorrow on how LLMs often write code with vulnerabilities if you don't give them any security intent and how we can improve GenAI secure coding.
AI writes more code than ever, but security isn't keeping pace.
Our 2026 GenAI Code Security Report found an average security pass rate of just 56%.
Tomorrow, join @WeldPond and @manicode to explore the findings and practical ways to close the gap. veracode.com/resources/webin…
Chris Wysopal retweeted
I'm going to be on a podcast tomorrow with @Veracode and the OG himself, @WeldPond
Please join us!
veracode.com/resources/webin…
Get ready for AI Security’s Fight Night! Three debates on Day 2 After Hours of [un]prompted. Your fight card:
Where is the Vulnpocalypse?
@EppSecurity, creator of the Zero Day Clock, and @jeremiahg, founder of WhiteHat Security and CEO of Root Evidence, will debate the resolution: “AI noise hasn’t moved the needle on current cyber risk.”
Burn Down the Playbook:
Can Yesterday’s Defenses Stop Tomorrow’s Attacks?
Tim Brown (CISO-in-Residence, Team8; former SolarWinds CISO) and @gadievron (CEO, Knostic; Chair, [un]prompted) will debate how to build a security program that can defend against agent swarms.
Too Big to Jail:
Do Human Attackers Also Get Misalignment and Act Rogue?
@k8em0 (Founder & CEO, Luta Security) vs. @raistolo (Full Professor, Politecnico di Milano) will debate if humans escape sandboxes, or do they use a sandbox escape? Should corporations be held accountable for cyber attacks? …What is consciousness anyway?
Debates shepherded by one of the world’s leading debate coaches, Professor Stephen Llano, Ph.D. (St. John’s University).
We’re 13 days out from [un]prompted II, the AI Security Practitioner Conference, where the AI security industry convenes to share what they’ve built, tested, deployed, and what failed.
October 27–29 at the Hibernia in San Francisco or online. Register: unpromptedcon.org
Thank you to our Sponsors: Knostic, TachTech, Censys, Ent, WorkOS, Decibel Partners, Whiterabbit, Zenity, RunSybil, AISLE™
Thank you to our Community Partners: SANS Institute, Cloud Security Alliance, RSAC, FIRST.
