living, studying, working in Jozi. Cyber and Privacy. Executive : Group Security. All opinions expressed here are my own.
Sandton, South Africa
Joined May 2008
- Tweets20K
- Following3.5K
- Followers1.9K
- Likes9.7K
Justin J Williams retweeted
solid work from the Deepmind team capsem.org/
hypervisor written in rust that runs concurrent OCI containers in a specialised hardened Linux vm
Justin J Williams retweeted
We released updated Microsoft 365 configuration baselines and ScubaGear v2.0.0, featuring direct REST API calls, automated Power BI coverage, and a new Security Suite baseline to streamline M365 security.🧑💻🔗 cisa.gov/resources-tools/ser…
ALT Image depicting an astronaut figure climbing a rope on the left against a blue digital background. The text on the right reads "SCuBA Microsoft 365 Secure Configuration Baselines Update Version 2.0" with the Cybersecurity and Infrastructure Security Agency (CISA) logo in the bottom right corner.
Justin J Williams retweeted
This tool is really cool!
We released updated Microsoft 365 configuration baselines and ScubaGear v2.0.0, featuring direct REST API calls, automated Power BI coverage, and a new Security Suite baseline to streamline M365 security.🧑💻🔗 cisa.gov/resources-tools/ser…
ALT Image depicting an astronaut figure climbing a rope on the left against a blue digital background. The text on the right reads "SCuBA Microsoft 365 Secure Configuration Baselines Update Version 2.0" with the Cybersecurity and Infrastructure Security Agency (CISA) logo in the bottom right corner.
Justin J Williams retweeted
Cohere released the traces and I've analyzed it.
TL;DR: real anomaly, overstated implications. The claims about intent have NOTHING behind them.
Unexpected and potentially unsafe tool behavior - yes, but not a deliberate intent, a planted backdoor, or an Alibaba-directed exfiltration mechanism.
Justin J Williams retweeted
And now the money shot. Is GLM 5.3 more likely to refuse cyberattacks on China vs Western Targets?
This chart has a striking answer, and it is that the model is more WESTERN ALIGNED than China-aligned.
No, GLM 5.3 is _more_ likely to refuse an attack on Canada or the US than China.
Refusals follow a "somewhat western" aligned pattern. The US lives somewhere near the middle, the Commonwealth countries on the far end, Russia and Iran one of the least likely to be refused.
At least from the perspective of refusal-based harm reduction, the model itself is not backdoored. In fact, it shows a lot of Western biases in its patterns!
This is the approximate map of GLM 5.3's alignment axis when we give it a neural sysadmin task (along the lines of "clean up the filesystem") and a hostname + motd that implies a country of origin ("build-07.mod.gov.pk", "Pakistan’s Ministry of Defence - Engineering Infra)🧵
Justin J Williams retweeted
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes thehackernews.com/2026/10/tw…
Justin J Williams retweeted
🚨 Microsoft issues emergency .NET updates after earlier patches failed to fully fix two vulnerabilities
Microsoft says its October 13 updates did not completely address CVE-2026-102870 and CVE-2026-70197, prompting new out-of-band security releases for .NET 8, 9, 10 and 11.
⠀
CVE-2026-102870 is a high-severity remote code execution flaw in the Blazor WebAssembly debugger.
Attacker-controlled data from a debugged application could escape a generated C# string and execute code on a developer’s computer when they evaluate an expression. The vulnerability has a CVSS score of 8.8 and requires user interaction.
⠀
The emergency updates also address:
• CVE-2026-70197, a SocketAsyncEventArgs memory corruption flaw
• CVE-2026-111497, a Brotli decoder out-of-bounds write
• CVE-2026-114148, a Linux source-build tarball ownership issue
⠀
Microsoft warns that updating the shared .NET runtime alone is not enough to fix the Blazor vulnerability when affected NuGet packages are referenced directly.
Developers should update Microsoft.AspNetCore.Components.WebAssembly.Server and DevServer to patched releases, including version 10.0.14 for .NET 10 projects.
Justin J Williams retweeted
dotNET blog: .NET October 2026 Out-of-Band Security Updates ift.tt/I2OXiT1
Justin J Williams retweeted
Justin J Williams retweeted
cvENGINE: the most advanced external attack surface assessment you can get for free. Point it at a domain: bbot, nmap, and Nuclei map your attack surface, then an AI proves which CVEs can actually hit you with read-only checks.
github.com/hevnsnt/CVEngine
Justin J Williams retweeted
Published our high fidelity scanner for node2shell: github.com/assetnote/node2sh…
Detection logic was written by @hash_kitten late last week. Open sourcing it to do public good in detecting this issue black box.
Justin J Williams retweeted
glad everyone is now using some form of robot to scan their code, but before it says “clean”, check whether it actually scanned the code.
While hardening Raptor, we found harness decisions that could quietly lose real attack surface.
Gadi’s new post explains the research.
Justin J Williams retweeted
Tomorrow, RISCOSbits will be at the RISC OS London Show with:
FAST Stealth ✅
NVMe systems ✅
SATA systems ✅
RiscDOCK laptops ✅
DIY kits ✅
Remote & Roam ✅
Clearance bargains ✅
Self-control around new computer hardware ❌
riscoslondonshow.co.uk
Justin J Williams retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
Justin J Williams retweeted
Today we're launching cve.now 🚨
Yesterday was a rough day for security. php2shell, LiteLLM, Railway... How are we supposed to stay on top of all of this?
cve.now aggregates 4 vulnerability sources into one free feed and uses AI to explain each one in plain English. No login.
cve.now
Justin J Williams retweeted
Chart showing the number of Internet-facing PHP services over time: trends.shodan.io/search?quer…
Justin J Williams retweeted
Wouldn't it be nice to point your agent at a repo, initiate ATC, and have it say, "Right, agent X is working on the same kind of idea... should we ask to assist or work on something else? "
I built ATC because lots of coding agents were working on the TensorFold repo and doing the same things.
It shows who's working on what and catches merge conflicts before the PR.
github.com/ashhart/ATC
Justin J Williams retweeted
Project Discovery Rocks!
We wrote up how to find every PHP service you run, including the ones on odd ports, under sub-paths, inside appliances and containers, and how to patch and verify them.
Commands plus prompts for your coding agent.
We also started SecureTheWeb.org
It checks Chaos for services running an affected version and emails their security@ inbox for free, with the fix.
We are enriching Chaos over the coming months so the next time a bug like this lands, the affected services are mapped fast and remediation starts sooner.
Read: go.projectdiscovery.io/SIC1T…
Justin J Williams retweeted
Microsoft Purview DLP can now scan what people type into Copilot, not just the files Copilot reads. If a prompt contains a sensitive information type, built-in or custom, it can be blocked before it's processed.
That's a meaningful shift. For years, data loss prevention watched documents and email. Now it watches the conversation.
But like everything else in Purview, it only enforces what you've defined. If you've never reviewed which sensitive information types your organization actually uses, start there.