← Friday 23 Octobernote 9 of 14
CybersecurityFri 23 Oct 2026 · 9 of 14

Corey Thuen’s “evil bit” hiring philosophy at Gravwell

Verified · 6/6 supported1 cited · 1 min read

securityweek.com reports that Corey Thuen is the founder and CEO of Gravwell, a firm that develops data analytics and vulnerability detection using big data experts and hackers . securityweek.com reports that Thuen hires hackers based on an “evil bit,” an adversarial mindset that can identify ways to exploit products . securityweek.com reports that he believes the “evil bit” is largely innate and not easily taught . securityweek.com reports that Thuen previously worked for the US government evaluating systems in power substations, part of critical infrastructure . securityweek.com reports that he references the old‑school hacking ethos that all information should be free and questions who defines morality .

Why it matters. securityweek.com reports that Thuen’s hiring focus on the “evil bit” results in Gravwell’s security team being composed of individuals with an adversarial mindset, influencing how the company approaches vulnerability detection .

Earlier on Cybersecurity

Thu 22 Oct 2026Google adds server‑side Gemini analysis and dual‑level warnings to Chrome securitysecurityweek.com reports that Google announced new Chrome protections against scams and social engineering, including new site warnings, server‑side Gemini analysis, and detection of ClickFix commands. securityweek.com reports that the Gemini and ClickFix protections are part of Enhanced Protection, the Safe Browsing mode introduced in 2020, and that more than 1 billion Chrome users had turned it on last year. securityweek.com reports that Google claims Enhanced Protection makes users ten times safer than Standard Protection against phishing, social engineering, notification abuse, and other scams, based on average safety warnings per user group. securityweek.com reports that Chrome’s Safe Browsing site warnings now have two levels—a full‑page red “dangerous site” warning for high‑confidence malicious pages and a “suspicious site” warning for lower‑confidence verdicts. securityweek.com reports that Gemini‑powered scam detection has moved to Google’s servers, while the on‑device version launched last year was limited to Enhanced Protection users and focused on tech‑support scams.Wed 21 Oct 2026US Agencies Issue Ten Voluntary Practices for Rogue Super‑Intelligence Agent Incidentssecurityweek.com reports that NIST, CISA and NSA released ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI (super intelligence) agent incidents. securityweek.com notes that the guidance, titled “Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation,” uses the term super intelligence (SI) rather than AI to align with executive order 14434. securityweek.com explains that the ten practices are organized into five stages: prepare, detect, respond, recover, and report. securityweek.com adds that the report includes definitions for AI agents, AI control incidents, and AI control near‑misses. securityweek.com says the preparation stage lists activities such as asset and risk inventories, defense‑in‑depth, least privilege, zero‑trust controls, credential management, and supply‑chain risk management.Tue 20 Oct 2026Drupal issues patches for critical RCE flaws in Entity List and Field UI modulessecurityweek.com reports that Drupal has released patches for five vulnerabilities, including two critical remote code execution bugs. securityweek.com reports that the first critical RCE bug (CVE-2026-108099) resides in the Entity List module and can be exploited via other contributed modules, with at least one unauthenticated exploit path. securityweek.com reports that the second critical RCE bug (CVE-2026-108097) affects the core Field UI module, also requiring contributed modules for exploitation, and that uninstalling the core Field UI module is a mitigation. securityweek.com reports that users should update to Entity List version 3.0.10 and to Drupal versions 11.4.10, 11.3.19, or 10.6.19, noting that older releases have reached end‑of‑life and no longer receive security updates. securityweek.com reports that the updates also fix cross‑site scripting issues in the core Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514).
Next · Climate techMissouri PSC Approves Ameren Missouri Solar and Storage Projects →