Ovi

We are mostly not hackers - we are the hacked.

"Schneier, a security expert, broadens the category of "hacker" to include anyone who studies systems with an eye to finding and exploiting their defects. Under this definition, the more fearsome hackers are "working for a hedge fund, finding a loophole in financial regulations that lets her siphon extra profits out of the system." Hackers work in corporate offices, or as government lobbyists.

As Henry says, hacking isn't intrinsically countercultural ("Most of the hacking you might care about is done by boring seeming people in boring seeming clothes"). Hacking reinforces – rather than undermining power asymmetries ("The rich have far more resources to figure out how to gimmick the rules"). We are mostly not the hackers – we are the hacked."

https://pluralistic.net/2024/04/17/panama-papers-fanfic/#the-1337est-h4x0rs

- @pluralistic@mamot.fr

amongst bugs this year, i found two bugs in particular that LLMs are just totally failing at finding yet on the surface are super easy.

1 is a critical rce in android and also a high sev persistence chain with it. both resulted from manual code review, no fuzzing (android is so heavily fuzzed anyways)

most of my methodology atm is looking for logic bugs in trust boundaries. ones with big topology. for these bugs I been testing opus 4.7 + gpty in finding it, opus has been running on auto mode (we have a *cyber* approved account) for hours and still not caught it. neither is picking it up. the bug is clear if you read the code and understand the context of the component, but the agent just fails to understand the context or topology.

i can't see how the hype around mythos solves this. it feels like an architecture & compression issue. ultimately llms think in lists and have a small context window, attackers don't. we think in graphs and control flow. what they need to be effective is triage compression and graphing, which a human can do with enough experience. they need a map of the territory at a scale that fits in their context window. till that changes my view on LLMs in vuln research isn't changing.

Today we are disclosing CVE-2026-0073:

A critical no-interaction proximal/adjacent remote code execution vulnerability in adbd's ADB-over-TCP authentication path.

Full technical write-up + exploit flow:

https://barghest.asia/blog/cve-2026-0073-adb-tls-auth-bypass/