key whisperer @turnkeyhq building crypto solutions | ex @OpenZeppelin | contrib @_SEAL_Org @coincenter @UT_Dallas @Compound_xyz @arbitrum
Dallas
Joined March 2013
- Tweets3.9K
- Following2.2K
- Followers3.7K
- Likes34K
Michael Lewellen retweeted
I can’t believe I am retweeting NSA
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Vintage key storage, next-gen infra.
HSM Signing lets institutions keep keys in their own HSM and still get Turnkey's policy engine, auth, and tx management. A security team's favorite kind of remaster.
Michael Lewellen retweeted
🚨 Nightmare day for cybersecurity
Multiple major security incidents, active exploits, supply chain compromises...
If you run production systems, start patching NOW.
PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW
LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets.
eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores.
Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs.
TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff.
Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors.
BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign.
And that's not even the full list.
Patch. Audit. Rotate. NOW.
Michael Lewellen retweeted
If you run PHP please:
session.upload_progress.enabled = Off
php_admin_flag session.upload_progress.enabled Off
Michael Lewellen retweeted
It's worse than Heartbleed. it should be on the front page of every newspaper in the morning (but it wont be)
It's so weird living in a tech dominated world where everyone has a smartphone and is on the internet constantly..
..yet most people will never even hear about this.
Michael Lewellen retweeted
PSA: Do NOT use public WiFi or shady DNS servers for the next few weeks.
SSL is practically broken and you can be attcked with an MITM attack. Your ISP and other intermediaries can also spy on you. Use a trusted VPN.
It will take a few days at least to flush out this crap CA.
Instead of using 384 bit random private keys, they used private keys like the super secret, unguessable number 4.
They are a cryptography company. They had one job. They're selling Post-Quantum Cryptography while doing shit like this lmao.
Readers added context they thought people might want to know
SSL/TLS is not broken. The vulnerability involved eight eMudhra intermediate certificates, which major browsers and operating systems (Chrome, Firefox, Apple, and Microsoft) had already blocked by October 20. Updated devices are protected against these MITM attacks.
arstechnica.com/security/2026/…
emudhra.we-have-a-problem.com
Michael Lewellen retweeted
the real alpha is @turnkeyhq quietly powering most of these
Stablecoin Payments Tier List
GOAT+ ( @Stablecoin, @BVNKFinance, @raincards, @0xPolygon )
GOAT ( @zerohashx, @wirexapp, @oobit, @FlexSuperApp, @bettermoney_co )
Perfect ( @gnosispay, @tazapay, @ether_fi, @blindpay, @FireblocksHQ )
Good ( @jeeves_inc, @avici, @BitgetWallet, @0xinfini, @KoloHub )
Underrated ( @conkarta, @coca_card, @yellowcard_app, @mural_pay, @monerium )
Overrated ( @Stable, @Plasma, @meshpay, @MetaMask, @phantom )
Based on my own analysis. Not financial advice!
Michael Lewellen retweeted
🚨If you are ever targeted in a wrench attack or threatened with physical violence for your crypto: comply.
Your life is more important than your assets.
Once you are in a safe place, speed is everything.
Call the police immediately, then contact @SEAL_911 on Telegram t.me/seal_911_bot.
Share the transaction hashes and attacker addresses as fast as possible so they can trace the movement and relay the data.
In a recent incident, this sequence made all the difference.
A victim was subjected to a violent robbery and had their funds stolen.
Once they reached safety, they contacted SEAL 911 with the transaction details.
SEAL verified the incident and pushed the attacker addresses directly into TIPzs, zeroShadow's threat intel platform that feeds live incident data straight to exchange screening systems.
Seconds later, the criminals attempted to swap the stolen assets at an exchange.
Because TIPzs pushes threat data to connected platforms in under two seconds, the intelligence landed ahead of the deposit.
The exchange caught the incoming transaction and froze the funds on arrival.
SEAL 911, zeroShadow, the exchange team, and law enforcement are now coordinating to follow the legal process and help the victim recover their assets.
Prioritize your physical safety first.
After that, fast reporting is what makes intercepting and freezing the stolen funds possible.
Thank you to SEAL 911, the exchange team and law enforcement for working together with us and showing how the private and public sectors can work together and do our part to effectively help those who are victimized and deserve all the help they can get.
Michael Lewellen retweeted
"If you want change, you have to advocate for it.”
In this guest thread, @KyleBligen, Executive Director of @TheDRC_, explains how the Decentralization Research Center is working with policymakers to support a safe and competitive decentralized future.
Michael Lewellen retweeted
This should be a wake-up call for a lot of people.
In the age of AI threat actors, protecting your keys becomes all that much more important.
This is why @turnkeyhq Secrets Management is architected the way it is, it is not systematically vulnerable to this kind of attack.
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
Michael Lewellen retweeted
Assume that every organization is gonna be breached in the coming months. The attack surface is too big and LLMs are extremely fast and good at finding new vulnerabilities all the time. – at Alboraya, España
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
Michael Lewellen retweeted
the point of crypto is to destroy DTCC
xitter.cf/lex_node/status/208578…
Peter is a class act fighting for the crypto industry, personal freedom, family and country. We don't deserve you but we certainly need you more than ever.
Michael Lewellen retweeted
🔬 Introducing SEAL Labs, where we’re partnering with outside experts on time-boxed experiments, starting with a six-month collaboration with @blockthreat to expand SEAL Intel’s incident coverage across the ecosystem.
radar.securityalliance.org/i…
Their IT guy: "don't worry, our password changes every day, super secure"
Regarding the Danfoss refrigeration systems hacked in France:
The username is `admin`, and the password automatically changes every day to... the current date.
Yes, today's date.
The French supermarkets affected in today's attacks had exposed all its refrigeration controllers directly to the internet.
Every single device reportedly used the same password: today's date...
There's also a documented authentication bypass: sending a POST request to /xml.cgi can bypass the login entirely.
Via: GossiTheDog
Michael Lewellen retweeted
🚨 October 13 UPDATE: Ledger Supply-Chain Attack
New developments have emerged since our last article into the CryptoBilis hardware-wallet compromise.
Ledger’s Donjon team has disclosed technical findings, additional devices are under scrutiny, and a major European retailer has suspended sales.
Here’s what changed. 🧵
Michael Lewellen retweeted
.@UmbraPrivacy just launched the privacy layer for money.
Every user's viewing key is split across guardian nodes running on Turnkey Verifiable Cloud. No operator can see these keys, and anyone can verify that code onchain.
Private finance, secured by Turnkey.
Michael Lewellen retweeted
Best conversation I had at TOKEN2049 was with a trading firm:
"The next 10/10 won't come from a tariff headline. It'll come from someone stealing a market maker's CEX API keys and dumping the market."
That's one of the reasons @turnkeyhq built our secret storage solution.
Michael Lewellen retweeted
Saying that your hardware wallet is better because it doesn't have a screen, so you can not tamper with it is like saying that not having hot water doesn't affect you because you don't have water to begin with.
A hardware wallet without screen is pointless, because you can NOT verify what you are signing with it, you are trusting the device connected to the internet.
Michael Lewellen retweeted
Any hardware wallet can be tampered with an implant at the hardware level, without touching the firmware. The only reason why Ledger was the first one to be targeted is the same reason why MacOS, Linux or WordPress are heavily targeted: because they are the number one in their field and the most used ones. It's a matter of incentives.