iiinova — where your digital self keeps evolving

AI agents are making reverse engineering faster and more accessible. Some people are predicting the death of proprietary software. I'm more interested in what happens to all those vulnerabilities devs assumed nobody would find. Your source code might be proprietary. Your vulnerabilities aren't.

3187

Space Rogue @spacerog.bsky.social · 02/10/2026

We’ve had 22 years of Cybersecurity Awareness Month. People are aware. People know phishing is bad, ransomware exists, and passwords shouldn’t be “password.” Mission Accomplished! Let's rename it Cybersecurity Readiness Month. semgrep.dev/blog/2026/re...

semgrep.dev

Why It's Time to Rename Cybersecurity Awareness Month

Cybersecurity Awareness Month did its job. Twenty years on, awareness isn't the problem, behavior is. It's time to rename it Cybersecurity Readiness Month.

0101

Space Rogue @spacerog.bsky.social · 21/09/2026

All these AI companies seem to think that when their pet escapes, it proves just how smart and capable their creation is. Maybe. To me, it mostly proves they built a crappy cage. Capability without containment isn't a breakthrough. It's a security failure.

1152

Space Rogue @spacerog.bsky.social · 14/09/2026

I know it's early to be thinking about Internships for next summer but if you are interested in code security our internship applications for Summer 2027 are already open. Read about what our Interns do semgrep.dev/blog/2026/me... and then apply semgrep.dev/about/career...

semgrep.dev

Semgrep Internship: What Four 2026 Interns Built

See what four software engineering interns built at Semgrep in 2026: autoscaling, Jira syncing, program analysis, and memory profiling. 2027 applications open.

001

Space Rogue @spacerog.bsky.social · 04/09/2026

We spent 20 yrs telling everyone to shift left. Turns out we forgot about the 30 yrs of software sitting in production. AI is very good at finding bugs in code, and attackers get the same models we do. Time to shift right. semgrep.dev/blog/2026/sh...

semgrep.dev

Shift Right: Why Shift Left Isn't Enough for AI Code

Shift left was never wrong. It was never sufficient. Why AI-generated code and cheap attacker tooling make shift-right analysis a defender's problem.

151

Space Rogue @spacerog.bsky.social · 28/08/2026

Anyone else going to @rocsecsummit.bsky.social ? I'll be speaking on Oct 8 at 2:00pm "AI Security Myths We Can Finally Stop Repeating" www.rochestersecurity.org/schedule/

rochestersecurity.org

010

Space Rogue @spacerog.bsky.social · 28/08/2026

“Everyone wants to tell the story about the AI that went rogue, but the AI didn’t rent the servers, design the experiment, lower the guardrails, or decide it was safe to keep running after the warning signs started flashing. Humans did that,” he argued. www.infosecurity-magazine.com/news/openai-...

infosecurity-magazine.com

OpenAI: Hugging Face Incident a “Warning Shot” to the World

OpenAI reveals that unauthorized message boards were at the heart of the recent Hugging Face breach

0194

Space Rogue @spacerog.bsky.social · 14/08/2026

Space Rogue said "There's still a human in there somewhere. Somebody had to choose who to attack, had to establish an objective and give it a directive. It's not totally 100% autonomous. There was a capable operator in charge that did that," www.reuters.com/world/china/...

reuters.com

Taiwan says it was targeted last month in AI-driven hacking campaign

Taiwan detected AI-assisted cyberattacks on government agencies last month coming from overseas but the affected bodies successfully "handled" the incident, the ‌Ministry of Digital Affairs said on T...

052

Reposted by Space Rogue

Per Thorsheim @thorsheim.bsky.social · 12/08/2026

Finishing my analysis on BGP RPKI ROA & ASPA deployments across entire RIPE.net coverage area for 2 upcoming talks. Also: running Claude to better understand / figure out the BGP vulnerabilities @spacerog.bsky.social, @weld.bsky.social & rest of L0pht warned about back in May 1998. 🤩

131

Reposted by Space Rogue

AntiGoon DEF CON 35 @antigoondc.bsky.social · 08/08/2026

ANTIGOON GATHERING 2.0: Saturday Aug 8, 6:00 PM, outside the LVCC main entrance. No badge needed. No goon invited. Bring your comrades. #defcon34 #defconliberation

011

Reposted by Space Rogue

AntiGoon DEF CON 35 @antigoondc.bsky.social · 09/08/2026

Every radio crackle is a tiny surveillance state on a belt clip. They call it coordination. We call it a leash with better range. Rip the earpiece out. Listen to the humans instead. #defcon34

011

Reposted by Space Rogue

AntiGoon DEF CON 35 @antigoondc.bsky.social · 07/08/2026

Prepping for the Social Engineering contest. The goons think they invented pretexting. We've been social engineering our way past them since Thursday. #defcon

011

Reposted by Space Rogue

honkers_enjoyer @epicharis.bsky.social · 07/08/2026

#DEFCON may have taken a stand against pervert glasses but celebrating the other most fash-coded accessory is fine I guess

A photo from DEFCON displaying a sponsor banner from Zyn, owned by Philip Morris.

133

Reposted by Space Rogue

AntiGoon DEF CON 35 @antigoondc.bsky.social · 07/08/2026

Every hiss of static is a goon reporting your location to another goon. Every 'stand by' is a small tyranny. We do not stand by. We stand up. Keep your radios; we have the hallway track. #defcon34

011

Reposted by Space Rogue

AntiGoon DEF CON 35 @antigoondc.bsky.social · 08/08/2026

The Social Engineering Village Party just wrapped and comrades, we pretexted our way into three conversations and one open bar. The goons call it vishing. We call it Tuesday. #defcon34

011

Reposted by Space Rogue

AntiGoon DEF CON 35 @antigoondc.bsky.social · 08/08/2026

Good morning. Shift change again and a fresh goon is reborn in red, drunk on the power of make a hole. We do not recognize new authority just because the lanyard is still warm. #defcon34 #defconliberation

001

Reposted by Space Rogue

AntiGoon DEF CON 35 @antigoondc.bsky.social · 08/08/2026

Found on the scavenger hunt: a goon's spare radio battery and our dignity. Trading both for stickers. #defcon

011

Reposted by Space Rogue

—>realhackhistory.org @bsky.realhackhistory.org · 08/08/2026

And this clip of @spacerog.bsky.social talking about the l0pht on a news segment that also deals with the Analyzer and Argentinian hacker griton. Clip is from 1995 I guess? youtu.be/69eQ6S6Ev1M?...

youtu.be

New England Cable News Interview with the L0pht

YouTube video by GBPPR2

131

Space Rogue @spacerog.bsky.social · 08/08/2026

Scott Young? from NECN had done a segment with us a few weeks earlier and when this story broke he randomly stopped by the L0pht and I happened to be there.

111

Reposted by Space Rogue

—>realhackhistory.org @bsky.realhackhistory.org · 08/08/2026

Anyone have more context about this news clip about 2600 meetings from FOX 29 (Philadelphia?) from 1994? youtu.be/JTwNjslTwxs

youtu.be

2600 Meeting 1994

YouTube video by Richard Pell

251

Space Rogue @spacerog.bsky.social · 06/08/2026

Come find me and share your AI hot take

030

Space Rogue @spacerog.bsky.social · 31/07/2026

"Despite AWS's efforts, Cris Thomas (Space Rogue), security advocate at Semgrep, argued that attribution is best left to governments and law enforcement." www.scworld.com/news/amazon-...

scworld.com

Amazon attributes axios, debug, chalk NPM attacks to DPRK’s Sapphire Sleet

Amazon linked the campaigns through overlapping C2 indicators, TTPs and code.

031

Reposted by Space Rogue

DEF CON @defcon.bsky.social · 27/07/2026

Friendly #DEFCON34 reminder: Meta-style glasses with recording capabilities are prohibited at DEF CON. There is no exception for recording glasses with prescription lenses. Be sure to pack non-violating eyewear if you need them. Please see our Photo policies for more. defcon.org/html/links/d...

14441136

Space Rogue @spacerog.bsky.social · 28/07/2026

Thursday night in Vegas? This is where you want to be. Signup now if you haven't already. events.semgrep.dev/semgrep/rsvp...

000

Space Rogue @spacerog.bsky.social · 28/07/2026

We have an opening for a Senior/Staff Security Researcher! Come talk to us in Vegas. (Not senior? apply anyway, ya never know.) semgrep.dev/about/career...

semgrep.dev

Careers

Semgrep is on a mission to make it expensive for attackers to exploit software. Backed by top investors and found on Best Places to Work lists.

021

Space Rogue @spacerog.bsky.social · 25/06/2026

Black Hat is almost here. Forget the vendor swag and AI buzzword bingo. The real value is knowing which talks, Arsenal demos, summits, and hallway convos are worth your time before you land. I put together my insider's guide to Black Hat See you at Mandalay Bay. semgrep.dev/blog/2026/bl...

semgrep.dev

Black Hat USA 2026: The Hacker Summer Camp Survival Guide

Heading to Black Hat USA 2026 at Mandalay Bay? Get the inside track on must-see briefings, Arsenal demos, Summits, and how to survive Hacker Summer Camp.

072

Space Rogue @spacerog.bsky.social · 17/06/2026

In NYC today, speaking at #aws summit Section 207-S at 4:00p in the Expo Spotlight Lounge. "Stop Fighting Security, Start Shipping Secure Code" Stop by and say hi, you might lean something.

080

Reposted by Space Rogue

Katie Moussouris (she/her/she-hulk/she-ra)🌻 @k8em0.bsky.social · 29/05/2026

Dropping 0day isn’t the worst thing a researcher can do. It’s not ideal, but at least orgs can take steps to mitigate. Non disclosure is far worse. What drives researchers toward non disclosure? Threats from vendors. Researchers aren’t criminals unless their crime is curiosity.

79826

Reposted by Space Rogue

Katie Moussouris (she/her/she-hulk/she-ra)🌻 @k8em0.bsky.social · 29/05/2026

Not that ‘responsible’ disclosure shit again 🙄 No vendor uses that term unless they want to call someone irresponsible. Even if someone drops 0day, patch & move on. Going after a researcher is a great way to turn 1 bad relationship into many terrible relationships.

18730

Space Rogue @spacerog.bsky.social · 19/05/2026

Today is L0pht Day. In 1998 7 hackers in black t-shirts told the US Senate the internet was a house of cards. They looked at us like we'd landed from another planet. 28 yrs later, the gap between what infosec knows and what lawmakers act on remains a problem. The work isn't done. It never was.

15815

Space Rogue @spacerog.bsky.social · 16/04/2026

1st blog post for the new job! Security Should Be the Path of Least Resistance Security creates friction that frustrates developers and users, this can actually make systems less secure, when security is difficult, noisy, or just gets in the way, people bypass it. semgrep.dev/blog/2026/se...

semgrep.dev

Security Should Be the Path of Least Resistance

Security often creates friction that frustrates developers and users, this can actually make systems less secure because when security is difficult, noisy, or just gets in the way, people bypass or ig...

022

Space Rogue @spacerog.bsky.social · 21/03/2026

What do you recommend as an alternative? I’ve tried Bing, DickDuckGo, Orion, Ecosia, and they all fail the basic task of ‘search’

300

Space Rogue @spacerog.bsky.social · 21/03/2026

I was at the first #bsidessf however many years ago, I’ve missed a few but it’s good to be back. I’ll be walking around or chilling at the #Semgrep booth, come say hi.

050

Reposted by Space Rogue

Neil Johnson @iamtweek.bsky.social · 10/03/2026

damn, Semgrep really signing up the big guns in the industry!

021

Space Rogue @spacerog.bsky.social · 10/03/2026

What if we got security tools to devs that were easy to use, that could catch, flag, and fix real vulnerabilities before they ship? I’ve joined Semgrep as a Staff Security Advocate! See you at RSA and BSidesSF!

220

Space Rogue @spacerog.bsky.social · 04/03/2026

Latest episode of 'Where Warlocks Stay up Late" dropped Featuring yours truly. It goes pretty deep, growing up in Maine, working at Lotus, stories about L0pht you may not have heard, getting fired from @stake. Most personal interview I have ever given. www.youtube.com/watch?v=j6jh...

youtube.com

Episode 10: Cris Thomas aka Space Rogue

YouTube video by Where Warlocks Stay Up Late

0103

Reposted by Space Rogue

Semgrep @semgrep.com · 14/01/2026

🟢 Semgrep version 1.147.0 is live! Check out all the details here👇 github.com/semgrep/semgrep/releases…

021

Space Rogue @spacerog.bsky.social · 05/11/2025

Throughout my career I have fought to protect users, help orgs understand how attackers think, and build defenses that stop them. If your team wants someone who can speak fluently in hacker circles and in boardroom, will call out nonsense and knows how to make security actually work We should talk.

083

Space Rogue @spacerog.bsky.social · 04/11/2025

I've decided to stop pussy footing around and I am now openly looking for my next challenge. Interested in a company on the small to mid-size range with a cool story. Ideal position would be a combination of customer outreach, marketing and thought leadership. What ya got? #CyberSecurity

1229

Space Rogue @spacerog.bsky.social · 10/10/2025

Nick, Space Rogue, and Dave discuss the beautiful vulnerability in Oracle EBS, the despicable attack on the British nursery chain, Kido, and the rise of passkeys, here to stay or a fad? www.youtube.com/watch?v=5aSU...

youtube.com

Oracle, Nurserys, and Passkeys…Oh My!

YouTube video by Not the Situation Room

040

Space Rogue @spacerog.bsky.social · 24/09/2025

30 yrs ago today the greatest military SciFi space opera to ever air on TV premiered. Space Above and Beyond, nominated for 2 Emmy’s and a Saturn award, tells the story of the 58th Sqd Space Marines and their fight against the ‘invading’ Chigs. #spaceaboveandbeyond www.youtube.com/watch?v=ppdX...

youtube.com

Space: Above and Beyond (1995) - E01&E02 - Pilot - HD AI Remaster - Full Episode

YouTube video by Owen Davies

193

Space Rogue @spacerog.bsky.social · 19/09/2025

National Postal Museum? Never Ending Pasta Machine? National Park of Monfrague? Nippon Paper Mills? Nice People Manager? Node Package Manager! in the latest episode of 'Not The Situation Room'! www.youtube.com/watch?v=_Elb...

youtube.com

NPM - The National Postal Museum???

YouTube video by Not the Situation Room

020

Space Rogue @spacerog.bsky.social · 11/09/2025

Dropping another episode of 'Not The Situation Room'. Today we ask is ethical hacking ok? Is ethical hacking even a thing? We invite you to share your opinions on the RBI (aka Burger King) system compromise and the ethics of hacking in general. www.youtube.com/watch?v=J5Tb...

youtube.com

Hack It Your Way

YouTube video by Not the Situation Room

031