Cybersecurity
Monoculture Risk in Software Security
Dan Geer's 2003 paper 'CyberInsecurity: The Cost of Monopoly' argued that Microsoft's operating-system monopoly made the internet systemically fragile — single vulnerability, vast blast radius. Geer was fired from @stake the same day the paper was published. 22 years later, AI-generated personalized software may be the actual practical antidote: if every business has custom AI-built CRM, exploits become per-target rather than mass-attacks.
Negative-Day Vulnerabilities
Negative-day vulnerabilities — a term coined by Sherri Davidoff — are bugs being actively exploited before the vendor knows they exist. In an AI-augmented threat landscape where models can autonomously find and chain zero-days, negative-day is becoming the dominant mode of compromise — defenders are responding to breaches of vulnerabilities they've never seen described.
CPUID HWMonitor Supply Chain Attack (April 2026)
For 6-19 hours on April 9-10 2026, the official CPUID download links for CPU-Z and HWMonitor were modified via an Apache mod_rewrite path-traversal bug (CVE-2024-38475) to serve a trojanized installer hosting STX RAT — a Chrome password stealer. ~150 victims per Kaspersky telemetry. Same actor as the earlier FileZilla campaign.
STX RAT Malware
STX RAT is a Zig-compiled Windows RAT deployed via Inno Setup + malicious CRYPTBASE.dll sideloading, using NTDLL proxying and IPv6-encoded .NET deserialization. Primary objective: stealing Chrome saved passwords via the IElevation COM interface. Campaign traced to at least July 2025, used in FileZilla and CPUID HWMonitor supply chain attacks.
WormGPT and Dark-Web AI Hacking Tools
WormGPT is a dark-web jailbroken LLM sold to cybercriminals starting 2023 for Bitcoin — Sherri Davidoff's team at LMG licensed it (~$500, $50 early-adopter) and tested it against Magento e-commerce platform, presenting at RSA 2024. Progression: 2024-early 2025 tools needed expert tweaking; a year later autonomous exploit chaining is viable. The arms race between attacker AIs and defender AIs is real and accelerating.