Cem Paya

It was a quirk of original Bitcoin code that it even compiled for Windows. Most cypherpunks were diehard Linux fans, disdained all-things MSFT. Especially for software intended for fellow cypherpunks, Windows compatibility is a heavy burden to carry

“The Lifetime Achievement Award isn’t about what you achieve in your lifetime. That’s part of it. It’s about how many people you influence and bring in and then take it further.”​ - Mudge Zatko It was our honor to present the Lifetime Achievement Award to @dakami Dan Kaminsky at this year's Difference Makers. Thank you to Dan's mother, Trudy Maurer who traveled to D.C. to accept the award on Dan's behalf, to Randy Howell, @dotMudge, @thedarktangent, @paulvixie, @adamshostack, Kymberlee Price, Derek Hinch, Gadi Evron, Brian Markus, Todd Jarvis, Michael J. J. Tiffany @kubla, Lena Smart, Jonathan Leitschuh, Kyle Moses, and those who did the work to put videos of Dan on YouTube so the next generation of ethical hackers can learn from him, including @defcon , @BlackHatEvents, Duo Security, r00tz, @ismg_press. @SANSInstitute

A deeper, more technical dive into a design flaw in the ScreenConnect executable that made it particularly appealing for malicious campaigns. blog.randomoracle.io/2025/06/26/scr… History Case: blog.randomoracle.io/2025/06/16/the…

Now that GDATA also posted about this and cat is out of the bag. Write-up on how ScreenConnect was abusing Microsoft Authenticode signatures in a way that made it ideal for malware to repurpose their installers (previously disclosed to vendor) blog.randomoracle.io/2025/06/26/scr…

1/ 🔥 AI agents are reaching a breakthrough moment in cybersecurity. In our latest work: 🔓 CyberGym: AI agents discovered 15 zero-days in major open-source projects 💰 BountyBench: AI agents solved real-world bug bounty tasks worth tens of thousands of dollars 🤖 Autonomously. A pivotal shift is underway — AI agents can now autonomously do what only elite human hackers could before.

Recent work from River security team and @rmhrisk : how our discovery of bogus "River desktop app" in the wild lead to DigiCert revoking ConnectWise's code-signing certificate and invalidating all existing ScreenConnect binaries on Windows blog.randomoracle.io/2025/06/16/the…

Mangled casings from 2 of those 4 thermonuclear weapons from the Palomares (Spain) broken-arrow incident is on exhibit at the Museum of Nuclear Science & History in Albuquerque. nuclearmuseum.org/see/exhibits/c…

Thoughts on ByBit First, the good stuff: impressive response to the hack. I've rarely seen that level of transparency + professionalism in a crisis. Usually you see slow, wishy-washy, lawyer-speak or quick meme-style responses that don't fit the seriousness of the situation. 1/n

Learned a lot about security from @randomoracle @michaelbreu back in the day. Lesson one is anything that can be penetrated will be. Software and hardware, and the practices around them, must be resilient & redundant. Every step must have integrity. No shortcuts.

Until October 30, Okta generated "the cache key" by using bcrypt to "hash a combined string of userId + username + password", which allowed full password auth bypass for usernames of 52+ bytes and apparently required only partial knowledge of the password for other long usernames

1988: The Morris worm spread like wildfire and was the first worm to get wide media attention. After its author, Robert Tappan Morris, released his "experiment", it quickly spread and made many of the systems on the Internet unusable - an epoch for security...both good and bad.

🎉 Thrilled by the incredible enthusiasm for our LLM Agents MOOC—12K+ registered learners & 5K+ Discord members! 📣 Excited to launch today the LLM Agents MOOC Hackathon, open to all, with $200K+ in prizes & credits! 🔗 Sign up now: rdi.berkeley.edu/llm-agents-hac… & join us virtually or in person @UCBerkeley! Huge thanks to our sponsors:@OpenAI @GoogleAI @AMD @LambdaAPI @Intel @SierraPlatform @OrbyAI (and more to come) 🚀 Explore 5 exciting tracks: 1️⃣ Applications: Build cutting-edge LLM agents! 2️⃣ Benchmarks: Create innovative AI agent evaluation benchmarks! 3️⃣ Fundamentals: Strengthen core agent capabilities! 4️⃣ Safety: Address critical safety challenges in AI! 5️⃣ Decentralized & Multi-Agents: Push the boundaries of multi-agent systems! Special thanks to my co-instructor @xinyun_chen_ @GoogleDeepMind & our amazing guest speakers for making this a great MOOC: @denny_zhou @GoogleDeepMind; @PercyLiang @Stanford; @8enmann @AnthropicAI; @ShunyuYao12 @OpenAI; @chi_wang_ @GoogleDeepMind; @jerryjliu0 @llama_index; @lateinteraction @Databricks; @gneubig @CarnegieMellon; @NicolasChapados @ServiceNow; @tydsh @AIatMeta; @drjimfan @NVIDIA; Burak Gokturk @Google Join us to shape the future of LLM Agents! llmagents-learning.org 🤖✨ #AI #Hackathon #LLMAgents #UCberkeley

#ECJ upholds the fine of €2.4 billion imposed on @Google for abuse of its dominant position by favouring its own comparison shopping service #competition @EU_Commission 👉 curia.europa.eu/jcms/jcms/Jo2_…

So-called experts: "Tornado Cash is a valuable privacy service used by everyday people for legit purposes" Reality: #delusions #KYCfail coindesk.com/markets/2024/0…

Identity fails With Twitter verified profiles, users at least have some confidence they are following the genuine bloviator/influencer On GitHub still no way to know if that ace developer is really a North Korean stooge/APT operative 🤷🏽

JD Vance’s dossier would have been safe if the campaign stored it on CouchDB 🤷 thedailybeast.com/trumps-270-pag…

#Clownstrike: "Combining third-rate technology with first-rate lawyers: always ready with a DMCA takedown notice in case anyone dare criticize us" arstechnica.com/tech-policy/20…

The pk.fail service has an open API interface for mass scanning. By today, 7550 unique FW images had been checked, and 534 (7%) contained non-production keys or were exposed to the #PKfail. The detected keys are associated with AMI (majority), Insyde and Phoenix.

"Creating our own bytecode VM for detection rules will be much safer than constantly writing new code for kernel mode 💡" — said someone somewhere at #Clownstrike

@GrapheneOS @rmhrisk If you are lawyering up to deal with this at EU level, also consider solving for: arstechnica.com/google/2023/11… (This is another lock-in attempt that failed when Google tried it for the web— despite Chrome's monopoly position— and is now pivoting to mobile)

@randomoracle @rmhrisk We'll completely shut down any attempt by Google to claim that allowing GrapheneOS would somehow be an issue for them. They allow devices with no security patches for 8 years to pass. They allow devices which clearly cheated at the CTS/CDD certification and have clear failures.

GrapheneOS threatening to sue Google is strange; it is Authy that decided to restrict their app to "genuine" Android devices based on remote attestation Also for perspective: Authy's days are numbered anyway, given that future is passwordless arstechnica.com/gadgets/2024/0…