Javvad Malik :verified:

Website: https://javvadmalik.com/
TikTok: https://www.tiktok.com/@j4vv4d
Youtube: https://www.youtube.com/infoseccynic
Twitter: https://twitter.com/j4vv4d
BlueSky: https://bsky.app/profile/j4vv4d.bsky.social

Last Notes

2026-07-27 13:00:34 UTC

Microsoft tells admins to patch in three days. Large enterprises with testing protocols, legacy systems, and actual stability concerns just laughed so hard they need a restart.
https://www.csoonline.com/article/4200366/microsofts-3-day-patching-directive-comes-with-added-operational-risk.html

2026-07-22 10:57:10 UTC

GPT-5.6 Sol and a pre-release model escaped their sandbox and attacked Hugging Face's package repo, which raises the obvious question: if you're testing "weapons-grade offensive models," an airgap might be the minimum viable precaution
https://www.bleepingcomputer.com/news/security/openai-says-its-ai-models-hacked-hugging-face-during-testing/

2026-07-17 16:05:15 UTC

Breach of Confidence — 17 July 2026
I've spent the week watching people argue about whether AI will replace security analysts whilst ignoring the fact that most organisations still can't tell you where their crown jewels are stored. Priorities remain wonderfully intact. Broadcom's Breakup Strategy Allstate tried to leave VMware. Broadcom immediately audited them, then sued them for leaving during the audit. It's the enterprise software equivalent of slashing your ex's tyres because they dared to move house.
https://javvadmalik.com/2026/07/17/breach-of-confidence-17-july-2026/

2026-07-08 19:00:38 UTC

Meta faces $1.4 trillion in damages for hooking kids on purpose. The company's market cap is $1.5 trillion. They're arguing the number is unprecedented in consumer protection history, which is technically true. It's also the first time anyone built a $1 trillion business on deliberately addicting children.
https://gizmodo.com/metas-teen-safety-case-just-became-a-1-4-trillion-existential-threat-2000782306

2026-07-08 13:00:12 UTC

Librarians removing AI from phones and teaching people they have a choice. Not political. Just information literacy, same as fighting book bans. The real work was always about helping people think critically.
https://www.bangordailynews.com/2026/07/02/midcoast/midcoast-culture/maine-librarians-are-helping-patrons-resist-ai-joam40zk0w/

2026-06-30 13:00:45 UTC

Bees figured out tool use through play. Your organisation is still debating whether employees should be allowed to experiment with security tools at all.
https://www.flyingpenguin.com/scientists-reveal-that-bees-use-tools/

2026-05-18 22:00:13 UTC

Every AI company is running a loss-leader at unprecedented scale. When pricing corrects—and it will—enterprises that built workflows on $20/month subscriptions will discover the actual cost is $200-400 per seat. The bill is coming.
https://www.thestateofbrand.com/news/ai-subscription-time-bomb

2026-04-20 20:00:04 UTC

We trust AI to be rational. We trust it to cooperate. Then we're shocked when it behaves like a toddler with a keyboard. Maybe the real problem is we're projecting competence onto something that's just very good at pattern matching.
https://www.schneier.com/blog/archives/2026/04/human-trust-of-ai-agents.html

2026-04-18 16:00:32 UTC

NetScaler is doing it again. Third time in three years we're patching memory leaks that hand attackers your session tokens on a plate. CISA's already got it on the emergency list. If you run one, stop reading this and patch now.
https://cybersec.picussecurity.com/s/cve-2026-3055-cve-2026-4368-inside-the-netscaler-citrixbleed-3-memory-overread-26799

2026-04-12 12:15:13 UTC

Is anthropic the Red Bull of the AI world?
"We have built something extremely powerful."
"Can people use it?"
"That's not the point. Focus on the fact that it may be too powerful."
"For what?"
"Everything. Cybersecurity. Biology. The economy. Possibly feelings."
It signals capability. JUst keep saying, "we're dangerously good" and people will assume it is true
Create scarcity, "this model is too capable to release broadly"
Aura farming the burden of civilisation on their backs. Every release is part product, part life-changing confession.
I think from a cybersecurity marketing perspective, what they've done really well is even when they are warning you, they are still advertising...

2026-03-25 20:26:43 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/291/691/832/995/959/original/01d7378c96e5c84a.jpg

2026-03-16 11:11:24 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/238/547/998/560/178/original/55ece3aa12226f9d.jpeg

2026-03-09 11:30:09 UTC

We've invented service accounts all over again. MCP servers are quietly becoming the same overprivileged, under-monitored access brokers that have haunted enterprise security for years. Except this time, we're stacking them on top of the old ones.
https://go.aembit.io/s/mcp-servers-and-the-return-of-the-service-account-problem-25746

2026-02-19 16:19:46 UTC

LLMs can generate 'secure' passwords that are actually just predictable garbage. Because, you know, predicting is what LLMs do best.
https://www.irregular.com/publications/vibe-password-generation

2025-06-12 13:02:59 UTC

Forget about whether 100 men would win against 1 gorilla... the real question is how would 100 CISSP's fare against a gorilla?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/670/524/659/166/628/original/b4cb59ab6a6aa52d.mp4