Breaker of software | VP R&D @hunterstrategy | CTI/DFIR | @ians_security faculty | Bookings: jake at malwarejake dot com | GSE #150 | He/him
Odenton, MD
Joined September 2009
- Tweets102K
- Following1.8K
- Followers151K
- Likes44.6K
Pinned Tweet
Let's not mince words:
* If you don't support trans people, you're a bad human
* If you have to add caveats to your support (e.g. "as long as my kids don't see"), you're one of the worst kinds of human
* Trans deserve your *unconditional* support for their humanity
Today's Breach Please is out. We talk about how Chainguard unilaterally broke the embargo on the PHP vulnerability and what that likely means for coordinated disclosure going forward.
It is BY FAR the spiciest episode we've recorded to date. 1/3
We also dive into the question of whether AI labs are actively hurting security (yes, they are. They just are).
Jess has some pretty strong opinions about the message in this tweet specifically. We don't 100% agree, but the discussion is valuable. 2/3
xitter.cf/JasonDClinton/status/2…
Not all heroes wear capes.
Some carry tentacles...
I didn't have @BSidesRDU on my list this year (it's been a busy year to say the least), but this is making me seriously reconsider.
Go @RayRedacted!
BIG NEWS! On 12/18/26, I'm giving the closing keynote at @BSidesRDU !
NGL... Seeing my name on a list with ppl like @HackingDave @AlyssaM_InfoSec @deviantollam @WeldPond @gdead @irawinkler is a bit terrifying.
But LFG!
Join me at 1100 ET today to discuss the current vulnerabilities in PHP, Node.js, GitLab, and the eMudhra certificate signing key debacle. We'll provide actionable advice and cut through the noise in our hour together.
ians.com/events/webinars/php…
Jake Williams retweeted
PHP2Shell (CVSS 9.2) disclosed, and eight eMudhra certs could let anyone mint trusted certs for any site.
Thursday, Oct. 22, 11 a.m. ET: @MalwareJake, IANS Faculty, on what your security team should do now.
Register now: bit.ly/4dLHUh6
ConnectWise has an incident with compromise this weekend where they disabled backups in customer M365 environments.
Even if you're not a ConnectWise customer, you likely have third party risk management concerns here for those you do business with who are.
In most cases, ConnectWise won't be able to see into the customer environments to identify who was compromised - those logs live in the customer tenant.
youtube.com/watch?v=AxsG32De…
If you missed my two day AI Risk Assessment course at Wild West Hackin' Fest in Deadwood last week, I'm teaching it again in Denver in February and we're offering it virtually too. Hope to see you there!
wildwesthackinfest.com/wild-…
Today's Breach Please is out. Since we recorded this, there's some news reporting that the deletion was "human error." But we're going to see a lot of "human error" claims when people inappropriately confirm an agent's actions.
We also discuss the report that Bank of America used Mythos to find vulnerabilities, but hired 1000 contractors to fix them - highlighting that while AI is a useful security tool, it's not getting rid of humans in tech anytime soon.
Episode link: youtu.be/f_-R5YahSuQ
Jake Williams retweeted
What a great week at @TechCrunch Disrupt! Thanks to @zackwhittaker for bringing @wendynather & Rudra Mitra (AWS) together for this panel on securing the AI enterprise
ALT Selfie with pink tips on natural dark and grey hair
Jake Williams retweeted
im back for WiFi Day 2026 my dudessssss let’s go!! October 22 @ 12-3pm ET
@ekahau is giving away a Sidekick 2, full license, & ECSE training to one lucky winner drawn out of the registrants! all u gotta do is be on stream when we call yr name 🛜
In today's Breach Please, we talk about the last minute cancellation of the Grace Hopper Celebration. My co-host has previous experience organizing conferences. She brings some real insights into what might have happened here and what it means for women in the tech industry. 1/2
Link in reply to appease the algorithm gods.
youtu.be/WTMIFHC7mHs
Jake Williams retweeted
I'm live now @MalwareJake 🦄🎙️
Unicorn Dispatch LIVE: Handing AI the Keys: MCP, Agents, and the New Attack Surface xitter.cf/i/broadcasts/1qxvveyDw…
Live now!
🔴 Live today at 2:30 PM ET: @brysonbort and @MalwareJake on MCP, AI agents, and the new attack surface. Join us on Unicorn Dispatch LIVE. #UnicornDispatchLive #AISecurity #MCP hubs.ly/Q04yCzNZ0
