Matt Muller

My hot take of the day: we’re not gonna resolve SOC burnout any time soon unless we fix these three underlying issues in how we run SOC teams. buildingsecops.com/posts/three-...

I vote we rename the eMudhra intermediate certificate incident to “Amuse Bouche compromise.” Because the keys are one byte.

It does appear the "data center eliminated Nazi and otherwise fuckface bots" narrative is basically wishcasting, it does show you how popular getting rid of this shit would broadly be, and that maybe a smart person should run on it.

Had lots of fun finding this vulnerability and writing an (hopefully) educational write-up!

It’s only a vulnerability problem if it’s in a network edge device, otherwise it’s a sparkling developer velocity problem.

There are a lot of people who think their parents got their brains destroyed by Fox News, but somehow they’re not getting their brains destroyed by staying on Twitter.

"What is a bug worth" has always been *the* question: The Vulnpocalypse Is Repricing the Bug Bounty Economy www.darkreading.com/vulnerabilit...

Not that ‘responsible’ disclosure shit again 🙄 No vendor uses that term unless they want to call someone irresponsible. Even if someone drops 0day, patch & move on. Going after a researcher is a great way to turn 1 bad relationship into many terrible relationships.

As someone who has recently moved to NYC and takes the subway to work every day, this is possibly the most fragile masculinity, snowflake shit I have ever read.

Is it too cynical to say we should check Kalshi for insider gambling based on this?

I don’t think DOJ should hand the president a multi-billion dollar slush fund he can divvy up between criminals he likes and his private bank account, nor that he should be able to buy stock then use taxpayer funds to boost that company. It’s corrupt. Sorry to get so partisan, but that’s how I feel.

Mamdani has proposed a balanced budget for next year, holding spending level while closing a $12 billion deficit. Trump's budget proposal increases the deficit year over year by about $300b, with a massive deficit next year of more than $2 trillion. Fiscal responsibility? Mamdani > Trump.

🚨 New Investigation: Attackers are hunting the maintainers behind Lodash, Fastify, buffer, Pino, mocha, Express, and #Nodejs core, because compromising one of them means write access to packages downloaded billions of times a week. socket.dev/blog/attacke...

How can this go on for another 3 years?

Cyber: Humans are the weakest link! Also cyber: Human-in-the-loop is the only way to make AI safe!

Hmmm do you think this will happen more or less often after the company lays off 20 percent of its workforce

Never fund DHS again. Abolish it completely. If someone wants to moan about "but but we have to ____" yeah fine we can discuss a new department, but *this* department has to go.

We recently partnered with Okta to ship new identity threat detections, alongside contributing to Okta's open source Security Detection Catalog, so the broader security community benefits. Big thanks to the Okta Cyber Defense team for the collaboration! sec.okta.com/articles/202...

Also if you work in sales at a company, do not call me. Email, fine.

I love the Three Buddy Problem and listen to it religiously. My question for @ryanaraine.bsky.social @jags.bsky.social and @craiu.bsky.social - do you think the benefits of staying on Twitter outweigh the hazards?

I do not want AI in @1password.bsky.social. So naturally my next renewal will be a price increase because they’re stuffing AI into @1password.bsky.social.

We should do everything we can to help Democratic politicians leave Twitter behind. Help the AG out!

This is an excellent explainer. 👀 quote: “In rough terms, the workforce of CBP officers and Border Patrol agents commit crimes at an equal or even greater rate PER CAPITA than the population of undocumented immigrants do in the United States.”

patch ye MongoDB, there's an exploit for a vuln which has been in the product for over a decade that allows the remote, unauth read of any memory - which includes plaintext creds. Somebody posted an exploit on Christmas Day, Merry Christmas! doublepulsar.com/merry-christ...

That feeling when @iverify.bsky.social tells you about an iOS update before Apple even issues a security bulletin 😍

CVE-2025-55182 (React2Shell): Remote code execution in React Server Components and Next.js securitylabs.datadoghq.com/articles/cve...

A man and a woman get in an elevator, which one is doing risk assessment?

Afraid of connecting to public Wi-Fi? Terrified to turn your Bluetooth on? You may be falling for "hacklore." Dozens of CISOs and ex-CISA officials have launched an effort to dispel these myths and show you how not to get hacked for real.

After yesterday’s surrender, we’re launching the largest Democratic primary program that we’ve ever run. We will not back any Senate primary candidate unless they call for Schumer to step down as Minority Leader. If you’re as pissed as we are, join this campaign to rebuild the Democratic Party. 👇

When you book a flight through major travel sites, a data broker owned by U.S. airlines will sell details about your flight—your name, credit card used, and where you’re flying to the government. We found out how to opt-out of ARC selling your travel data. A guide: www.404media.co/how-to-opt-o...

“I’m a law-abiding citizen who never thought I’d be of such interest that the U.S. government would use my tax dollars & yours to try to send me to prison…[after being] manhandled by an Immigration and Customs Enforcement agent trying to remove my phone from my hand.” www.msnbc.com/opinion/msnb...

Veep wasn’t supposed to be a documentary

🎶Thicker than A deep dish pie Joints are sore Blood pressure high Pudding, flan And crème brûlée None are safe From the Green Beignets🎶

Sickening behavior by this agent. The fact that Mayor Adams has rolled out the red carpet for ICE is a stain on our city.

1/ Hi, I'm TProphet. I write the Telecom Informer for @2600.com. A lot of people have been asking me about www.nbcnews.com/politics/nat... given that I'm somewhat knowledgeable in the area. Here's my take: I'm kind of astonished that this is public, and it isn't normal that it would ever be.

Be sure you take a moment today to remember Charlie Kirk for exactly who he was.

Nothing infuriates me more than cybercriminals that target small businesses, so it's time to spend a Saturday burning down the infrastructure of the ones who targeted a contractor I've worked with.

It's bullshit that I agree with David Frum. Things shouldn't have sunk so low that we've reached our level of agreement! We should be in the realm where we disagree on every issue in the news!

I watched Kimmel's three most recent monologues, convinced I had missed the thing MAGA was outraged about. But it looks like this is it. It has to be more than this, right? There's just no way this is it.

Not really an overstatement to say that the test of a free society is whether or not comedians can make fun of the country's leader on TV without repurcussions.

I am genuinely curious what other type of content AWS thinks I’d be submitting through their “Report Phishing” form…?

It is a bit wild to me that Snowflake got dragged through the mud because threat actors abused a bunch of one-off credentials in stealer logs, but somehow Salesforce has escaped scrutiny when all the impacted customers came from a single integration.

An incredible firsthand glimpse into threat actor operations from Huntress:

This talk was excellent - super practical advice and a refreshing antidote to all the “AI will fix everything” nonsense out there.