CIRCLE WITH A DOT

@chad @cdnspace

Heh, those Claude style sheets are so distinct now. It does a good job on UI elements. One of the few areas GPT 5.4 hasn't surpassed it yet.

I've watched LLMs write full exploit chains for years. The amazement fades fast once you hit context limits and spend hours steering the model past every hard corner. But the industry is packed with people who just arrived and are still in that first rush. This Calif post is a good example — real result, soft target (no KASLR, no canaries), 44 human prompts. The gap between demo and production hardened targets is the part nobody wants to talk about yet.

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI.

(blog.calif.io)

PSA for Azure users who automate deploys and skip Portal banners: default outbound access is going away for subnets.

Pre-April 1st subnets are grandfathered. New ones are private by default - you can re-enable old outbound behaviour explicitly, or deploy a NAT Gateway (~$36/mo) as the better architecture.

How many folks will find out when their deploy scripts and connectivity breaks April 1st? Private-by-default is the right security move though.

Default Outbound Access in Azure - Azure Virtual Network

Learn about default outbound access in Azure.

(learn.microsoft.com)

Your UEFI firmware can inject a PE binary into Windows on every boot via WPBT (Windows Platform Binary Table). smss.exe extracts it to disk and runs it as SYSTEM. OEMs use this to survive OS reinstalls. Attackers use it the same way.

One registry key tells Windows to ignore the table entirely:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v DisableWpbtExecution /d 1 /t REG_DWORD /f

Won't stop real firmware implants, but kills a whole class of cheap persistence for free.