Peter C @itspeterc

Security Engineer Black Lives Matter peterc.ollins.me Washington, DC Joined November 2011

Tweets

796
Followers

1K
Following

600
Likes

44K

Cloudflare @Cloudflare

4 days ago

A recent security issue announced by Salesloft has impacted many companies, including Cloudflare. This post provides a timeline of the attack, details our response, and offers security recommendations to help other organizations mitigate the effects of this attack.…

2 20 113 18K 30

Dino A. Dai Zovi @dinodaizovi

5 days ago

Over the years, I've made a conscious effort to always speak to the "why", even when not directly asked. If I'm providing a recommendation on what to do, I need to also say why I think it is right. If I'm explaining what something is, I need to also explain why it is significant.

2 3 25 4K 1

Zack Korman @ZackKorman

a week ago

Sorry cybersecurity mutuals, I really want to engage with your posts, but I have no idea what y’all are talking about half the time, and I just realized that’s because it’s about Windows. And sorry but I’m not learning that.

23 9 197 15K 18

Rami McCarthy @ramimacisabird

2 weeks ago

* a thousand leaked Github tokens * dozens of npm tokens and cloud credentails * 20k files, identified by AI for exfiltration All spread publicly on Github by malware implanted in `nx` check out our blog for details: wiz.io/blog/s1ngulari…

1 9 28 2K 10

Matt Linton @0xMatt

3 weeks ago

If you are in a large org, The #1 most useful thing you can do in security when given a seemingly crazy task you have to accomplish, is go back down the chain and find the original requirement the task came from. Then read it carefully. 1/2

3 11 119 7K 17

Tim Willis @itswillis

4 weeks ago

That time when @tehjh was just reviewing a new Linux kernel feature, found a security vuln, then went on a journey to see if he could exploit it from inside the Chrome Linux Desktop renderer sandbox (spoiler: very yes) googleprojectzero.blogspot.com/2025/08/from-c…

0 49 132 21K 55

Michael Bargury @mbrg0

4 weeks ago

we hijacked microsoft's copilot studio agents and got them to spill out their private knowledge, reveal their tools and let us use them to dump full crm records these are autonomous agents.. no human in the loop #DEFCON #BHUSA @tamirishaysh

107 905 9K 1.2M 7K

Download Image

James Kettle @albinowax

a month ago

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: http1mustdie.com

20 250 747 75K 334

Nir Ohfeld @nirohfeld

a month ago

We (+@ronenshh) hacked NVIDIA's Triton AI server by abusing a single error message🚨 The result is unauthenticated RCE allowing attackers to compromise the server and steal proprietary AI models🤯 For more details & mitigations check out our blog @wiz_io wiz.io/blog/nvidia-tr…

4 60 231 21K 84

Download Image

neils @midwestneil

2 months ago

Turns out you can just hack any train in the USA and take control over the brakes. This is CVE-2025-1727 and it took me 12 years to get this published. This vulnerability is still not patched. Here's the story:

wetw0rk @wetw0rk7

2 months ago

5 45 412 275K 195

47 564 3K 317K 1K

Cloudflare @Cloudflare

2 months ago

Orange Meets, our open-source video calling web application, now supports end-to-end encryption using the MLS protocol with continuous group key agreement. cfl.re/45Cji79

2 10 78 25K 28

nullptrs @nullpt_rs

3 months ago

Breaking WebAuthn, FIDO2, and Forging Passkeys by @vmfunc nullpt.rs/forging-passke…

3 20 73 20K 31

Download Image

Chris Murphy 🟧 @ChrisMurphyCT

3 months ago

I was briefed on the intelligence last week. Iran posed no imminent threat of attack to the United States. Iran was not close to building a deliverable nuclear weapon. The negotiations Israel scuttled with their strikes held the potential for success.

5K 11K 43K 2.3M 2K

Luca Beurer-Kellner @lbeurerkellner

3 months ago

😈 BEWARE: Claude 4 + GitHub MCP will leak your private GitHub repositories, no questions asked. We discovered a new attack on agents using GitHub’s official MCP server, which can be exploited by attackers to access your private repositories. creds to @marco_milanta (1/n) 👇

47 494 2K 501K 2K

Download Image

Craig Gidney @CraigGidney

4 months ago

I'm often asked if I'll redo the 2019 quantum factoring estimate. Denser storage by yokes, smaller magic factories by cultivation, slimmer approx arithmetic by Chevignard et al… surely the cost is lower now? Yes, it's lower now. security.googleblog.com/2025/05/tracki… arxiv.org/abs/2505.15917

8 50 176 19K 32

Download Image

Yarden Shafir @yarden_shafir

7 months ago

Hey Microsoft this isn't cool

76 122 3K 161K 195

Download Image

Wiz @wiz_io

7 months ago

BREAKING: Internal #DeepSeek database publicly exposed 🚨 Wiz Research has discovered "DeepLeak" - a publicly accessible ClickHouse database belonging to DeepSeek, exposing highly sensitive information, including secret keys, plain-text chat messages, backend details, and logs.

121 818 3K 873K 1K

Download Image

Sam Curry @samwcyo

8 months ago

New blog post with @infosec_au: We found a vulnerability in Subaru where an attacker, with just a license plate, could retrieve the full location history, unlock, and start vehicles remotely. The issue was reported and patched. Full post here: samcurry.net/hacking-subaru

47 316 1K 114K 315

Dino A. Dai Zovi @dinodaizovi

8 months ago

We blogged again! This time about our Data Safety Levels framework, which was inspired by the CDC/WHO Biosafety Levels system and Laboratory Biosafety Manuals. Like biological agents, we also don't want sensitive data to be exposed to humans or escape. code.cash.app/dsl-framework

1 2 3 759 2

nolen royalty @itseieio

8 months ago

I couldn't find any good games for my password manager. So I made one. 1Crossword connects to your 1Password vault and generates a crossword entirely out of your passwords! The crosswords are fun, simple, and great for sharing on social media when you finish. Enjoy!