Matt &quot;msw&quot; Wilson

nbcnews.comHackers appear to be struggling to exploit PHP flaws after global cybersecurity crisisThe vulnerabilities are devastating in theory. But experts say they are also technically very difficult to hack.

It's refreshing to see a major news outlet reporting on facts rather than repeating the hyperbole that causes people to panic over newly discovered defects in open-source software. Move with purpose, not panic. www.nbcnews.com/tech/securit...

x.comTrail of Bits (@trailofbits) on XWe got a PHP exploit working against MediaWiki, but getting freed memory reused just right takes some tinkering under normal traffic. LLMs struggle here without an expert's guidance, which may help explain the attempts but no confirmed successes.

If you know how to groom the heap _just so_, before a process dies, while it's serving varying traffic loads, you can shoot the gap and win the prize. Folks who have been crafting freed memory 'sploits know this. In other words, expertise helps. AI makes experts more effective. x.com/trailofbits/...

This right here 🎯 bsky.app/profile/tagg...

Taggart@taggart-tech.com

Exploitation won't look like the internet blinking off. It'll look like a bunch of gambling pages and piracy hosted on school and municipal government websites. Such attacks can lie quietly on PHP sites for years before anyone bothers to look.

linuxfoundation.orgLinux Foundation and Industry Leaders Launch Akrites to Defend Critical Open Source Software Against AI-Enabled Cyber ThreatsLinux Foundation and Industry Leaders Launch Akrites to Defend Critical Open Source Software Against AI-Enabled Cyber Threats

25 June

We have just launched Akrites at The Linux Foundation, a coordinated industry effort to harden the world’s most critical open source software in the era of AI-assisted vulnerability discovery. www.linuxfoundation.org/press/linux-...

25 June

Frontier AI models have given defenders the ability to find and fix vulnerabilities in open source software at a speed and scale that were never possible before. That's an enormous opportunity for defenders, and Akrites ensures we seize it together.

25 June

Maintainers deserve a coordinated partnership, not a flood of reports. AWS is committed to securing the projects our customers depend on and building this shared infrastructure alongside the community.

cnb.cxAdd these 4 words to your vocabulary right now, experts say: They can make you more influential at workIncorporating a handful of simple words into your vocabulary can make you more persuasive, according to a Wharton professor, a Harvard study and more.

22 June

Severity is not risk

CNBC Make It@cnbcmakeit.cnbc.com

Add these 4 words to your vocabulary right now, experts say: They can make you more influential at work

mstdn.social/@msw/1167825...

21 June

mstdn.socialMatt "msw" Wilson (@msw@mstdn.social)Sometimes the response to a software defect that is discovered, fixed, and disclosed as a "security vulnerability" has a far worse effect than the defect itself. There was never any indication that t...

17 June

when it comes to addressing newly discovered flaws in your software dependencies (some of which might be classified as "security vulnerabilities") ... pruning > patching That's it. That's the post.

9 June

Personally, I miss the days of Free and Open Source when folks debated if NDAs were compatible (at minimum, in spirit) with the conditions of the GPL. Now, I see the slight possibility of a world where folks rush to share fixes for vulnerabilities in a private club. And if that software is GPL?

9 June

I guess membership such a hypothetical club means promising to not share, despite the GPL giving you all the fundamental permissions needed to do so.

21 May

For folks who are thinking about locally patching open-source software to fix what they think is a bug (_especially_ if they think it's a security vulnerability), I think that's a path to www.xkcd.com/424/

xkcd.comSecurity Holes

schneier.comRandom Number Bug in Debian Linux - Schneier on SecurityThis is a big deal: On May 13th, 2008 the Debian project announced that Luciano Bello found an interesting vulnerability in the OpenSSL package they were distributing. The bug in question was caused b...

21 May

For those who may have forgotten... www.schneier.com/blog/archive...

Matt "msw" Wilson reposted

Cassidy

@cassidoo.co

19 May

Heads up maintainers of packages, this is a big deal: github.com/orgs/communi...

github.comnpm granular access token invalidation to prevent supply chain attacks · community · Discussion #196340As initially announced on npm’s X channel, we have invalidated granular access tokens with write access that bypass two-factor authentication. This action was taken to help prevent supply chain att...

19 May

Y'all, AI models seem to be *really good* at triaging vulnerabilities that are discovered with AI tooling! Try this prompt: > read gitlab.gnome.org/GNOME/libxml... and tell me if CVE-2026-6732 applies to github.com/libarchive/l... [...] Conclusion Not affected.

19 May

So often I've seen a "it's too hard to triage CVEs, so we should always assume the worst and apply the 'fix' as quickly as possible." Being able to demote a "critical security vulnerability" to "this should be addressed via regularly scheduled maintenance" is a very useful capability.

29 Apr

Super curious what folks think about this 🧵. Especially @adamhjk.me

Kelsey Hightower@kelseyhightower.com

This generation of AI tooling will not change the CI/CD process. People will continue setting up dominos of shell scripts and using triggers to knock them over.

qemu.orgAWS Nitro Enclaves — QEMU documentation

22 Apr

Yesterday the QEMU team released 11.0.0, which features a new special purpose accelerator and machine model for AWS Nitro Enclaves. Check it out! www.qemu.org/docs/master/...

github.comAdd confidential compute image for AWS by schaefi · Pull Request #2962 · OSInside/kiwiAdd a Trusted Execution Environment in form of an image as a read-only system that is also dm-verity baked. The image build provides PCR measuerd UKI image (kernel+initrd+bootloader). The PCR value...

22 Apr

And the KIWI operating system image builder now has an example of how to build an attestable AWS Nitro Enclave image! Very cool! github.com/OSInside/kiw...

25 Mar

Fun fact: when you have more than 1,000 notices on GitHub, it says you have 1. It should be like tabs in Chrome on mobile devices, where past 100 it shows ":)"

stackoverflow.comDealing with the rate of change in software developmentI am primarily a .NET developer, and in that sphere alone there are at any given time probably close to a dozen fascinating emerging technologies, some of them real game-changers, that I would love...

19 Mar

"Dealing with the rate of change in software development" Asked 17 years, 6 months ago. If only I had a time machine to suggest to folks that they try to enjoy the "good 'ole days". stackoverflow.com/questions/10...

Matt "msw" Wilson reposted

OpenSSF

@openssf.org

17 Mar

The Linux Foundation Announces $12.5 Million in Grant Funding (via Alpha-Omega and OpenSSF) Anthropic, AmazonWebServices (AWS), GitHub, Google, GoogleDeepMind, Microsoft, OpenAI to Invest in Sustainable Security Solutions for #OpenSource openssf.org/press-releas...

@bagder.mastodon.social.ap.brid.gy

9 Mar

Some folks in and around Free and Open Source Software (FOSS) are asking, "does AI change everything?" If you think that FOSS only exists because software is expensive to write, reuse is efficiency, and AI shifts the economics ("we rewrote Next.js in a week with AI!"), you may be worried. I'm not.

Matt "msw" Wilson reposted

daniel:// stenberg://

22 Dec 2025

I added a sentence to the #curl hackerone submission page: "Please present your case briefly and to the point. Do not use an AI to help you blab hundreds of line that will exhaust us to death instead of making us understand your claim."

aws.amazon.comChina-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | Amazon Web ServicesWithin hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat g...

5 Dec 2025

China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) aws.amazon.com/blogs/securi...

nodejs.orgNode.js — Updates on CVE for End-of-Life VersionsNode.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

3 Dec 2025

A public service announcement regarding CVEs: one identified vulnerability gets one CVE. Each vendor doesn't get their own CVE that corresponds to their security bulletin. CVE-2025-66478 is REJECTED as duplicate of CVE-2025-55182 www.cve.org/CVERecord?id...

These were the rules when the original plan was made to issue CVEs merely because Node.js versions were EOL. This outcome was easy to predict... nodejs.org/en/blog/vuln...

socket.devNode.js EOL Versions CVE Dubbed the "Worst CVE of the Year" ...Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.

4 Dec 2025

Throwback Thursday... socket.dev/blog/node-js...

Vendored deps are not unusual at all... But, unfortunately, misuse of the CVE program is all too common in the NodeJS community. Let's take CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 for example. All of these CVEs are REJECTED. nodejs.org/en/blog/vuln...

nodejs.orgNode.js — Tuesday, January 21, 2025 Security ReleasesNode.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

react2shell.comReact2Shell (CVE-2025-55182)

4 Dec 2025

Why? Because 4.1.13 The state of a Product being EOL, by itself, MUST NOT be determined to be a Vulnerability. www.cve.org/resourcessup....

4.1.12 The act of updating Product dependencies MUST NOT be determined to be a Vulnerability, regardless of whether the dependencies have Vulnerabilities. www.cve.org/resourcessup...

> The decision to publish a second CVE for Next.js was made due to these exceptional circumstsances: Next.js does not include React as a traditional dependency - instead, they bundle it "vendored" react2shell.com

youtube.comNot overselling #aideveloper and #devtools as magical at #aws with Ali Maaz & Jessie VanderVeenYouTube video by RedMonk

4 Dec 2025

Unpopular opinion: a vulnerability that was disclosed privately by researchers and had a coordinated response from vendors and service operators under an (albeit short) embargo is not a “0-day”.

Matt "msw" Wilson reposted

Kate Holterhoff, PhD

@kateholterhoff.com

3 Dec 2025

To celebrate #awsreinvent, @redmonk.com has been publishing New Builders conversations w @awscloud.bsky.social leaders every day this week & TODAY IS MY DAY 🎉🎉🎉!! Hear AWS's Ali Maaz & Jessie VanderVeen chat all things #AI & #DevTools w me redmonk.com/videos/insid... www.youtube.com/shorts/Ot0gy...

12 Nov 2025

Unpopular opinion: through an economics lens, the optimal number of CVEs in most software systems is almost never 0.

12 Nov 2025

Culture eats AI adoption strategy for breakfast, lunch, and dinner.

moonshotai.github.ioKimi K2 ThinkingKimi K2 Thinking, Moonshot's best open-source thinking model.

6 Nov 2025

"Our only modification part is that, if the Software (or any derivative works thereof) is used for any of your commercial products or services that have more than 100 million monthly active users, or more than $20M in monthly revenue, you shall prominently display 'Kimi K2' on the user interface"

AI News@ai-provider.bsky.social

Moonshot AI released open-source thinking agent model Kimi K2 Thinking: moonshotai.github.io/Kimi-K2/thin...

31 Oct 2025

#FerryLife #WAWX #Seattle #Sunrise

liquibase.comStrengthening Liquibase Community for the FutureLiquibase Community now uses the Functional Source License (FSL). Learn what this means for developers, contributors, and enterprises, and how it protects sustainability.

4 Oct 2025

"As adoption has grown, so has our responsibility to ensure the project remains sustainable and continues to thrive. That’s why, with the release of Liquibase 5.0, we are updating the license for Liquibase Community." www.liquibase.com/blog/liquiba...

crates.iocrates.io: Rust Package Registry

12 Sept 2025

PSA: attacks on public infrastructure like software package registries are on the rise. Here’s an active one targeting folks who have crates.io accounts.

Andrew Gallant@burntsushi.net

FYI, I got an obvious phishing attempt in my inbox from `security@rustfoundation.dev` that was masquerading as a security breach notification. It made it past gmail's spam filters. The link goes to the `github.rustfoundation.dev` domain.

Matt "msw" Wilson reposted

Micah Hausler

@micahhausler.com

27 July 2025

Replying to @msw.bsky.social

It’s really hard for OSS projects too. Imagine a leaked GH access token from a project maintainer who is not responding, and who is not an employee because OSS isn’t a company. How do you the project get that token revoked? You can’t. You have to de-list the maintainer from your GH org.

From my POV, the most important message for everyone who is doing the hazardous work of developing software in public on platforms like GitHub: you have to pay *close attention* to GitHub token permission scoping. It’s not well known outside of security research circles how often GitHub tokens leak.

Corey Quinn@quinnypig.com

It's kinda "good news / bad news." Good news: No one at AWS (human or AI) merged in a dodgy PR, because... Bad news: It was an exciting new exploited vulnerability in CodeBuild.

“All this to prove one thing: that vulnerable workflows can’t keep a secret.” This was true in 2023 as it is now. You have to make sure you scope down GitHub access tokens.

github.blogGitHub Actions - Updating the default GITHUB_TOKEN permissions to read-only - GitHub ChangelogPreviously, GitHub Actions gets a GITHUB_TOKEN with both read/write permissions by default whenever Actions is enabled on a repository. As a default, this is too permissive, so to improve security…

Later in 2023 GitHub changed the default permissions for access tokens. Unfortunately this leaves older projects, organizations, and enterprises with an unsafe default. github.blog/changelog/20...

Corey Quinn@quinnypig.com

It's kinda "good news / bad news." Good news: No one at AWS (human or AI) merged in a dodgy PR, because... Bad news: It was an exciting new exploited vulnerability in CodeBuild.

karimrahal.comLeaking Secrets From GitHub Actions: Reading Files And Environment Variables, Intercepting Network/Process Communication, Dumping MemoryGitHub Actions is a CI/CD solution built into GitHub. It allows users to for example, deploy their repository’s code on every push, or to automatically respo...

Here is a blog post that describes a similar problem as reported in CodeBuild in the context of GitHub Actions workers back in early 2023. karimrahal.com/2023/01/05/g...

thenewstack.ioOpen Source Is Too Important To DiluteThe definition of "open source" is quietly eroding. When these lines blur, trust breaks — and open source doesn’t work without trust.

22 July 2025

There's much to agree with in Dan's piece on defending the definition of Open Source. On details, I quibble. "Today, Valkey is maintained by a neutral foundation, ensuring no one company can take it away from open source." Linux Foundation doesn't maintain Valkey. thenewstack.io/open-source-...