Rust In Peqace

Agentic security review for Rust. An autonomous recon → find → grade → find→fuzz → report → patch loop for the bugs that actually bite Rust: memory-safety in unsafe/FFI, panic-DoS from untrusted input, deserialization trust (an integrity check is not a bounds check), and Send/Sync + panic-safety soundness. 

Static analysis drives the dynamic stage — the threat model routes which sanitizer, fuzz rung, and vote budget each finding gets. Detectors: Miri (undefined behavior), AddressSanitizer, panic/abort, hang-timeout, and cargo-fuzz for execution-verified reproduction.

Enjoy
https://github.com/scadastrangelove/rust-in-peace/ 

Awesome AI Security Tools

A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.

https://github.com/scadastrangelove/awesome-ai-security-tools 

ёprstcon is about you

We're running ёprstcon — a community one-day conference 
in Moscow on May 26. Open call for anyone whose talk fits 
the room — online or offline.

ёprstcon is about you, your con, man :)

What it is:
- 200-300 attendees, mostly security folks, plus an unusually 
 curious crowd from adjacent fields
- No sponsors, no VIP, no panel discussions about "the future 
 of cyber". Pallets instead of seats. Projectors. Microphones. 
 People.
- Two parallel tracks: technical (research, tooling, demos) 
 and what we call "the room next door" — culture, music, 
 science from non-IT fields. Adjacent to the main hall, 
 same audience, different register.
- Inspired by....

#CCC, we love you.

What we're looking for:
- A 15-40 minute talk, on-site or via livestream
- Topic: original research, honest post-mortems, things you 
 built and lost sleep over, unusual angles on familiar 
 - Anything you've wanted to give somewhere but it 
 didn't fit a "standard" CFP
- Q&A after, moderated by someone in the room

What we offer:
- A live, attentive audience that won't scroll Instagram 
 during your talk
- The recording stays yours. We publish it on our channel 
 with full credit and a link to whatever you want.
- A community that engages afterward — not business cards, 
 but real conversations on Telegram and email.

What we don't offer:
- Honoraria. No sponsors, no money, and no power to stop us now.
- Travel logistics.
- Marketing reach.

If you have a talk that's been sitting in your drawer because 
it doesn't fit the usual conference format, this might be 
its room.

Soft deadline: May 18. Submission — title, 
abstract (whatever length), preferred slot.

qqlan@ya.ru / @yoprtsorgs on Telegram
https://www.yoprst.me/

— Sergey, on behalf of ёprstcon organisers

agent-audit

Forensic auditor for local AI coding agents (Claude Code, Codex CLI, OpenClaw) and project-surface scanner for repos containing skills, plugins, and MCP manifests. Reads session logs, configs, and instruction files, detects known-bad patterns using 296 bundled rules in total, including 167 static-file-applicable rules for scan-project, plus native ASAMM detectors, produces a report, and optionally cross-verifies findings using any combination of installed CLIs, direct API keys, or local LLMs.

https://github.com/scadastrangelove/agent-audit/
agent-audit is one of the implementation projects in the broader ASAMM effort. In ASAMM terms, this repo is the practical measurement and auditing layer: it turns agent-safety patterns into something you can run against real repos, local agent homes, session traces, skill collections, plugin registries, and MCP manifests.

 

The Builder's Manifesto

Cybersecurity in a world where code is worth nothing

Another agent today.

It's all over Reddit, in every Telegram channel. "I built it over the weekend." "It found a 0-day." "It writes better code than me." Screenshots, demos, euphoria, panic.

Back in the late 80s, when we were pushing ASCII characters across endless green terminals in assembly and FOCAL, nobody thought this would turn into a trillion-dollar industry. We just wanted the machine to obey us, not the other way around.

Now it obeys itself. And we're not the ones making the rules anymore. The rules are making us.

Let's unpack this.

Agentic SAMM

While hunting Claude-planted RCE in Ouroboros, someone had a thought about spirals, Steps Into Infinity, and what OWASP SAMM is missing for agentic development. The result is ASAMM — a security framework extension for teams whose agents have already started biting back.

The core claim: SDLC is not a cycle. It is a spiral. Each iteration returns to the same phase — design, implementation, verification — but the system changed, the tools changed, and the threat model should have changed with them. Most do not.

https://github.com/scadastrangelove/asamm

What is inside:

The Confused Matrix

President Bramp of the United States stepped before the cameras at 03:17 Washington time.

https://medium.com/p/7016de25ab3e

Mind the gravity

A black-box scanner sends its prayers into the dark.

Blackhole answers with pages, headers, flows, lies, half-truths, and—when needed—the unpleasant courtesy of ground truth.

Blackhole is a Python ASGI mock server for black-box scanner testing, education, and reproducible benchmarking. It serves vulnerable-looking behavior from replay profiles and explicit stateful mini-flows, while exposing a truth/scoring API to compare scanner findings against expected cases.

In other words: a scanner can hallucinate, overfit, panic, or boast. Blackhole keeps the receipts.

And every white hat should remember: all requests eventually fall into the black hole.
https://github.com/scadastrangelove/zhet-blackhole

I JUST WANTED TO… GRAFUNA RED TEAM

Observability is about visibility.

Visibility works both ways. If you can see it, someone else can too.

This post is the polite version of a talk I gave. The impolite version is the repo.

https://github.com/scadastrangelove/zeronights2025-GRAFUNA 

EPSS, KEV, and the Joy of Predicting the Past

There is a recurring belief in security that if we just collect enough numbers, the future will eventually confess.

EPSS is one such number.

A clean decimal. A percentile. A promise.

So we asked a boring question: what if you actually ran patch management using EPSS thresholds? Not in theory. Not in slides. In reality—against vulnerabilities that were already exploited.

We took all vulnerabilities added to CISA’s KEV catalog in 2025. KEV is not a model. It is not predictive. It is simply a list of things that were exploited hard enough that someone had to admit it.
Nerds welcome.. 

 

CVE-2025-20352: Exposed SNMP is “not a vuln”? 0kk...

It’s just a friendly UDP oracle telling strangers what your routers are, how old they are, and whether they like to take naps when prodded. Totally fine.

CVE-2025-20352 lives in Cisco IOS/IOS XE’s SNMP stack. Crafted packets + creds = sad router. While everyone argues about advisory footnotes, we do the boring part: find what talks SNMP with default communities and tag what looks at risk.

https://github.com/scadastrangelove/CVE-2025-20352 

Nuk‑Nuke

https://github.com/scadastrangelove/nuknuke 

A lightning‑fast decoy web‑server that fools vulnerability scanners by feeding them the answers they expect. Inspired by the 90‑s WinNuke prank and written for ProjectDiscovery’s Nuclei, Nuk‑Nuke parses every template under ~/nuclei‑templates, spins up a single‑py server and replies in a way that always triggers a positive match. Ideal for red‑blue exercises, honeynets or throttling noisy pentest pipelines without touching your production code.

YAUZA CTF 2021

For 48 hours, participants will be able to solve tasks of all categories: web, reverse, pwn, forensics, crypto, OSINT, joy. Also new categories have been added: hardware, pentest and emulation!

https://yauzactf.com/en

NVIDIA DGX A100 Security Update

The DGX A100 System Firmware Update container version 20.11.3 for Ubuntu with BMC version 00.13.04 fixes vulnerabilities described in NVIDIA Security Bulletin 5010 such as CVE‑2020‑11487.

More details can be found in recent AISec talks and releases. 

Enjoy

Vulnerabilities of Machine Learning Infrastructure (Slides/Video)

Vulnerabilities of Machine Learning Infrastructure talk as presented at CodeBlue 2020 Japan and Standoff365 by Sergey Gordeychik.

The boom of AI brought to the market a set of impressive solutions both on the hardware and software side. On the other hand, massive implementation of AI in various areas brings about problems, and security is one of the greatest concerns.

Cyber Resilience of Railway Signaling Systems - Russian book

Updated Russian version of the Railway Cybersecurity hardcopy book by Sergey Gordeichik was published last week. 

Кибербезопасность микропроцессорных систем управления на железнодорожном транспорте 

Гордейчик Сергей Владимирович

Vulnerabilities of Machine Learning Infrastructure

As presented at The Standoff online cyber-range and security conference by Sergey Gordeychik.

In this talk we will present results of hands-on vulnerability research of different components of AI infrastructure including NVIDIA DGX GPU servers, ML frameworks such as Pytorch, Keras and Tensorflow, data processing pipelines and specific applications, including Medical Imaging and face recognition powered CCTV. Updated Internet Census toolkit based on the Grinder framework will be introduced.

NVIDIA DGX machine learning servers vulnerabilities

NVIDIA has published fixes for vulnerabilities in NVIDIA Machine learning servers with CVSS up to 9.8.

NVIDIA DGX-1, DGX-2, and DGX A100 Servers are affected and can be hacked via BMC OOB interfaces. 

codeblue.jp talk

Vulnerabilities of Machine Learning Infrastructure talk to be presented at Code Blue 2020 security conference @Tokyo. 

Wind Turbines strikes again

 

Nice to see Nordex devices featured in SCADA StrangeLove "Too Smart Grid in da Cloud" talk back to 2014 available via SatCOM in 2020.