Hacking An AI Children’s Toy: Remote Access to Every Conversation · Joseph Thacker
My neighbor texted me the other day and said she’d pre-ordered two AI toys for her kids that supposedly used an LLM to dynamically generate…
Category: Mix
![[tl;dr sec] #335 - Prompt Injection as Role Confusion, PHP Ecosystem Security, New MCP Spec](https://image.cybernoz.com/wp-content/uploads/2026/07/tldr-sec-335-Prompt-Injection-as-Role-Confusion-PHP-600x340.png)
[tl;dr sec] #335 – Prompt Injection as Role Confusion, PHP Ecosystem Security, New MCP Spec
Wedding This past weekend I attended a friend’s wedding, and it was heartwarming. The couple have been together over a decade, and had many…
The Agentic Hacking Era: Ramblings and a Tool · Joseph Thacker
A few weeks ago I wrote about how AI is going to impact bug bounty. That post was mostly predictions. This one is about what’s…
Operation Floodlight · Joseph Thacker
I have been thinking about the downstream impacts of AI systems having strong cybersecurity capabilities. The United States has a lot of critical infrastructure that…
Launching: AI Safety For Parents · Joseph Thacker
I’ve always been a fan of levelsio. He’s a serial entrepreneur who has launched a bunch of SaaS and AI products, mostly in public, one…
Reconnaissance for exposure management. Why context matters in the AI era
Over the last few weeks, we’ve explored what AI is changing in security: discovery is faster (Vulnpocalypse now?), volume is higher (Common AI misconceptions debugged!),…
Exploiting insecure cookie policies | Intigriti
Cookies are one of the most fundamental building blocks of the modern web, and yet they are often overlooked from a security perspective. When misconfigured,…
An Unemotional Analysis of This AI Regulation Situation
Here’s a more logical and less emotional way to look at what’s happening with the chaotic regulation of these AI models… It took decades/centuries to…
Intigriti Bug Bytes #237 – June 2026
Welcome to the latest edition of Bug Bytes! In this month’s issue, we are featuring: A 10-year-old pre-auth RCE in phpBB Earning $500K hacking Google…
The Coming Divide: AI-Native or Left Behind
I’m getting more worried, and more frustrated, about this new phase of AI disillusionment. Some of it is fair. Hundreds of billions are sloshing around…
![[tl;dr sec] #334 - Thinkst's Package Proxy, OpenAI Daybreak, AI Agents & Canaries](https://image.cybernoz.com/wp-content/uploads/2026/06/tldr-sec-334-Thinksts-Package-Proxy-OpenAI-Daybreak-AI-600x340.png)
[tl;dr sec] #334 – Thinkst’s Package Proxy, OpenAI Daybreak, AI Agents & Canaries
18 kits, a 37x spike in detections, and every major AiTM vendor adding it to their platform. Device code phishing has gone from espionage-grade to…
UK Gov’s attack surface monitoring for 500K+ domains
Scaling application security and attack surface monitoring inside a single enterprise is a massive headache. In June 2026, the Department for Science, Innovation and Technology…