Maybe people have stopped buying CPUs because they can't afford RAM to go with them?
BREAKING: Intel stock, $INTC, crashes over -22% after reporting weaker than expected earnings.
Intel blamed weak earnings on "softness in the PC market."
5x "You're absolutely right!" in 45mins of "vibe coding"... but we don't need humans in the loop?
Good luck with that👍
HypnInfoSec retweeted
The Binance hacker might have just pulled off one of the smartest moves I’ve seen in crypto.
First, Tether froze $1.5 billion in USDT.
Then Circle froze another $800 million in USDC.
At that point, it looked like the hacker’s money was trapped.
But apparently, he had already planned for that.
Instead of holding the stolen USDT in a wallet, he allegedly deposited it into Aave and used it as collateral to borrow ETH.
Then he walked away.
That’s where the story gets crazy.
Tether can freeze the USDT sitting in the wallet.
But it can’t freeze the ETH he already borrowed.
So now Aave is left holding frozen collateral, while the hacker is sitting on liquid ETH.
And unless the protocol can recover it somehow, he may not even need to pay the loan back.
Two companies froze billions of dollars in seconds.
But someone who understood how to use DeFi may have found a way around both of them.
Pretty insane when you think about it.
Readers added context they thought people might want to know
The described Aave deposit used only ~60M USDT as collateral to borrow 19,762 WETH before freezes hit the main wallet, not the bulk of funds; Aave states the overcollateralized position is subject to normal liquidation with no material protocol risk.
governance.aave.com/t/binance-hot-…
x.com/binance/status…
drk.vc/news/binance-1…
It's just Copilot, sending our conversations off to EU, no biggie.
But it'll write some Python for you :D
🇿🇦 Got questions about the South African Government? We’ve got answers!
Meet our new Government Chatbot — designed to help you find information and get informed. 🤖💬
👉 Click. Ask. Get informed!
🗣️ This is a pilot project, and your feedback matters! Try it out, share your experience and help us improve the service.
#GovZAUpdates #GovChatbot
🔗rsafacts.zoholandingpage.com…
HypnInfoSec retweeted
No fucking way
ITS 4 AGAIN
DIFFERENT BUG
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
HypnInfoSec retweeted
I see how some people can watch flashy robot demos on the timeline and think with a shiver that the robot apocalypse is around the corner, but reality check:
There is no robot in the world that can change the batteries in a jack-o-lantern.
If you have a robot friendly door handle it might be able to walk outside, pick it up, and carry it back inside. The robot could open the drawer with your batteries in it, but then things get tough.
Opening the package of AA batteries?
Extracting a precision screwdriver from its case?
Unscrewing four tiny screws that require a hard press and twist?
Popping batteries out of the case?
Yes, you could build and train a specialist robot to do that today, but there is a very long way to go to replace the full range of human capabilities. Near term doomer scenarios should stop at “secretly controlling humanity” instead of “wiping humanity out” 😀
HypnInfoSec retweeted
🚨 A working root exploit for a Linux kernel bug is public. No CVE. No merged fix.
ZDI-CAN-33367 is a gap in the Dirty Frag fix, with root confirmed on current Ubuntu, Debian, and AlmaLinux. Restrict unprivileged user namespaces and enforce seccomp RuntimeDefault while you wait.
okt.to/08psRf
#CloudSecurity #ThreatResearch #Linux #RuntimeSecurity
HypnInfoSec retweeted
$MSFT offers 60,000 employees a voluntary exit.
60K Y’all!!
First time this has ever been offered at Microsoft and it will affect employees in India, The United States, Canada, and the UK at level 70 or below…
Employees find out in a few hours if they are being targeted for this.
This just makes me think that H127 layoffs sound intense. Is this a pre-layoff round?
Also makes me wonder if they changed some scheduled layoffs due to be called out by @VP. Peace offering? 🤔 Timing is just interesting.
More to come.
$MSFT Microsoft's job cuts aren't done, and Xbox is where to watch next.
Asha Sharma is reportedly planning three more rounds: this month, November and January. 1,868 jobs are gone against a 3,200 target, so roughly 1,300 more are coming.
Spreading cuts across a whole year is a choice. It keeps the margin story moving and leaves everyone who's left waiting. I'm watching for the October round.
HypnInfoSec retweeted
‼️ ALERT - 2 New critical Wasmtime flaws (CVSS 9.9) could let malicious WebAssembly modules escape their sandbox.
• CVE-2026-115889 Affects multiple architectures
• CVE-2026-115893 ARM64-only, present since 2020
Embedded apps need rebuilding.
Read ↓ thehackernews.com/2026/10/tw…
HypnInfoSec retweeted
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
HypnInfoSec retweeted
Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).
Check out their awesome writeup here: github.com/KillaBoi/StealMyB…
HypnInfoSec retweeted
Hey well if you've been to my Agent Skills security talk at AGNTCon & MCPCon or you just want to grab the presentation slides and run through it, here you go 👇
Thanks @AgenticAIFdn for inviting me to speak on agentic security topics, to @techgirl1908 @hey_amandam and rest of the speaking committe and organizers for pulling this off and to all my friends who we got to geek out 🤓💜
ALT That SKILL.md file you just installed to supercharge your AI coding agent? It might be exfiltrating your AWS credentials right now. Yikes. Just like with early npm, attackers are abusing various Agent Skill ecosystems to launch malware campaigns. So now AI builders rush to add Skills which inherit the agent's full execution environment, all while the recent ToxicSkills research found 37% of nearly 4000 skills malware and other security weaknesses, and even one "security scanner" skill that was itself malware, ha! The next AI security frontier is hijacking the agent's own reasoning to suppress safety warnings before pulling the trigger and here’s your chance to see in action how coding agents crumble under a malicious skill. In this session you'll watch live hacking of a malicious skill and how it fools a coding agent for rogue actions, a prompt injection leaks your secrets over email, and a leaky skill passes credit card numbers straight through the LLM context. Then we flip to defense
HypnInfoSec retweeted
Ruby’s turn 😅
Remember the GitLab bug? Well now it moved upstream into Ruby.
Multiple 10.0 CRITICAL exploits.
Patch now 🚨
Happy Friday 🤠
ruby-lang.org/en/news/2026/1…
HypnInfoSec retweeted
Liked PHP2Shell? You’re gonna love Node2Shell.
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shell-…
HypnInfoSec retweeted
phoronix.com/news/LKML-New-T…
Does it ever end? Accidentally sent unpatched (incl RCE) bugs to public mailing list
HypnInfoSec retweeted
eMudhra has two interesting implications for me beyond the obvious browser trust issues.
I'm excited for the opportunities to liberate closed hardware this provides. We know hardware, particularly abandoned IoT devices are unlikely to be updating their revocation lists and root CAs. This means we can potentially intercept previously encrypted comms, or sign previously protected firmware.
I'm also interested in how well the revocation works at a WiFi supplicant level. Rogue RADIUS servers (mana, wpe, eaphammer) can now use validly* signed chains for forged leafs with TLS protected EAP modes. I'm not sure how well the revocations work in that world given the difference in the CA trust model in use there.