The security paradigm has significantly changed. Moral panic and influencers won’t protect you. DYOR. infosec will get a LOT worse before it gets better.

🇦🇶
Joined November 2007
Pinned Tweet
Replying to @nvk
BAM! #Bitcoin sent over 7.077Mhz via #JS8Call to @SamuelPatt Sweep: blockchain.com/btc/tx/82c043… Toronto,CAN => Michigan,USA [40W:#SnowStorm] Bcuz its a brainwallet made ahead of time, with bearer pk I don't require internet to broadcast this transaction at the time i'm sending
514
480
259
1,896
NVK retweeted
Replying to @lydiahallie
wait is it just me or is Opus 5.5 dumber
445
323
271
8,604
578,460
A lot of projects vendor Brotli and still haven't updated broccoli2shell.com/#vendored xitter.cf/julianor/status/211377…
How exploitable is the recent Broccoli 🥦 vulnerability (CVE-2026-111497)? We went beyond reproducing memory corruption and demonstrated a control-flow hijack. Not a realistic RCE exploit, but definitely not just a crash. Here's what we found. 🧵
3
8
38
7,110
After a whole week of RCEs and other VCEs, if people can't agree on calling the brotli thing node2shell or http2shell or whatever, broccoli2shell is definitely the way to end the week. xitter.cf/julianor/status/211374…
IMHO, the Brotli bug (think zlib 20 years ago) is a bigger deal than PHP2Shell and all the "oooh, AI found it! AI found it!" hype. Node2Shell is a terrible name. I’m calling it Broccoli. 🥦
2
9
3,002
Bitcoin was always going to be the cyber security canary in the coal mine as an exploit brings an immediate bounty. Coldcard gave us an early warning. Now the rest of the world is catching up. AI can find the bugs. Can we fix them fast enough?
We’ve opened Pandora’s box. AI is making attacks faster, while defense still depends on people reviewing changes and shipping fixes. AI is the only way to keep up. But how long can that human bottleneck hold? AI Can Find the Bugs. Who Fixes the Internet? scarcityandscale.com/ai-cybe…
519
The only way out is through. They're calling it the Bugpocalypse. LLMs are being used to find long-hidden cracks in the software infrastructure, and it's happening at a furious rate. 3% of all compromises in computing history happened in the last week, claims one source? I believe it. There are people saying public access to the frontier models ought to be locked out, or heavily guardrailed, over this. The problem with that idea can be summed up in one sentence: when lockpicks are outlawed, only outlaws will have lockpicks. The lockpicks will be Chinese open-weight models, if nothing else. There's no way to stop those from becoming ubiquitous. There are two futures in front of us. One in which only the bad guys have lockpicks, and security holes go undiscovered until they're exploited. Another in which everybody has lockpicks and is aggressively red-teaming their own software so it gets fixed before the holes are exploited. The corpus of human code is huge but finite. The number of defects in it has to be finite too. We can fix those defects now; we have a million friendly robots to do it with. The only way out is through.
88
254
41
1,618
28,389
PSA: This week was kind of a turning point for AI and cybersecurity. Please take this weekend to do some simple cleanup for your family. Some suggestions: - Set up a password manager like 1Password and give your spouse or partner access to a shared vault. Teach them how to use it. - Update your passwords for critical stuff - your email account, your bank or financial stuff, etc. Store in your password manager and use the strongest password you can. - Use two factor auth for everything you can. SMS is not ideal although better than nothing. Google Authenticator or a passkey is better. Hardware key is safest.) - Add a sim pin to your phone. Makes it harder to sim jack. - Update your phone and your computer to the newest releases. Turn auto-updates on. - Freeze your credit - takes 5 minutes. - Get an IRS Identity Protection PIN. - If you’re using claude code or have AI agents that browse the web, they’re probably using Node.js. It’s also vulnerable. Update claude code, update node on your machine. - If you’re building stuff on your computer, ask claude or grokbot (which is connected to twitter and likely has the most current info) to audit any of your repos for vulnerabilities. Ask grok to make it a scheduled task so it can do this daily - things are moving very quickly in the space right now. - Consider some light resiliency stuff. This probably sounds silly, but it sounded silly at the beginning of covid too. Having printed out copies of important stuff - especially financial accounts. Having some cash on hand. Having some shelf-stable food and clean water or a water filter. Having a map. Having a generator that can at least power your fridge or some devices. Cheap insurance. Again, I don’t want to alarm people, but I was taught that you should have a Secure plan, a Comfortable plan, and a Wealthy plan. And it seems pretty clear the secure plan needs to now factor cybersecurity risk as a legit threat. Take a weekend and shore yourself up.
116
603
45
6,180
1,723,752
🚨 LiteLLM reveals the root cause of its supply chain attack. A master key leaked on GitHub in May was never revoked, allowing attackers to access its Agent Platform, steal a GitHub owner token, and publish a malicious PyPI release in October. Read: thehackernews.com/2026/10/le…
21
29
6
89
19,785
This one maybe as bad or worse than the PHP ones. Get used to lots of patching.
we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library. it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software:
44
110
26
1,522
160,398
New release: Electrum 4.8.3. This release fixes a critical security issue, so we urge all users to upgrade. A description of the vulnerability will be published later today. (note: Windows Defender may show a warning about ZXing.dll, ignore that, it is a false positive)
22
82
20
356
32,292
NVK retweeted
“there are unfixable bugs in hardware that are exploitable by AI models directly speaking machine code”
Replying to @Suhail
I’ve heard several OAI people say there are unfixable bugs in hardware that are exploitable by AI models directly speaking machine code so even if we could solve software that’s not enough. We need defense to move faster than offense if that’s even possible we may just have a new normal that requires adapting to insecure software (bank transfers require going into a branch and taking a dna test 🤣😬)
68
558
38
8,051
230,395
Emergency update to the Cloudflare Managed Ruleset on 2026-10-22 refines metadata for 7 rules targeting CVE-2026-109618 and CVE-2026-109619. Detection logic and block actions remain unchanged. developers.cloudflare.com/ch…
10
50
6
310
27,829
BREAKING: OpenAI says it found a critical flaw in Brotli, a widely used compression library built into software like Node.js, Bun and Envoy. The bug could let an attacker take over a system just by sending it malicious compressed data, with no login needed. That works both ways: a hacker could hijack an unpatched server, or a malicious server could hijack an unpatched user’s device.
173
254
111
3,362
804,025
NVK retweeted
The FBI continues to warn about two critical security flaws in PHP, a programming language used to build many websites and online services. Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security updates are available and should be applied immediately. If you are a business owner or website operator, check whether your systems are affected. Contact your IT support team, website developer, or hosting provider for help identifying vulnerable systems and applying the necessary updates. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information on these vulnerabilities (CVE-2026-109618 and CVE-2026-109619), follow PHP’s announcements on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
156
1,198
162
4,635
342,683
Holy shit.
Introducing Kimi K3.1 Pro: our most capable 3T-class open-weight model. 🔹 1M-token context, 2.8T total / 104B active params (MoE), Multimodal. 🔹 Full-project coding: games in Unreal, Unity & Godot. 🔹 Excels at parametric 3D modeling in Blender & CAD. 🔹 More reliable at finance work: Accurate modeling with hallucination down by 65%. 🔹 Matching the strongest proprietary models across coding, agentic and knowledge benchmarks. Kimi K3.1 Pro and K3.1 Pro Highspeed (2–3× faster) are now live on Kimi.ai, Kimi Work, Kimi Code, and the Kimi API. Open weights by Nov 4, 2026. 🔗 API: platform.kimi.ai 🔗 Tech blog: kimi.ai/blog/kimi-k3-1-pro
28
26
9
652
76,728
‼️ Fortinet says AI helped find critical flaws in FortiOS and 4 more products, and thanked Anthropic, OpenAI, Google and SpaceX. It urges an immediate upgrade but publishes no advisories until 10 November. Kevin Beaumont says one is a path traversal in the management interface.
19
45
7
441
30,044
🚨 UPDATE: Railway says hackers targeted AI API keys to carry out model distillation attacks. Up to 100,000 workspaces may have been exposed. Attackers allegedly used uncensored AI models and massive compute resources to breach its infrastructure. What we know: thehackernews.com/2026/10/ra…
28
77
12
364
51,437
Yahoo is still blocking emails from our newly assigned IP space. We've continued using it and aren't going to stop because Yahoo won't accept mails from it. It already has a great reputation elsewhere and there are 0 issues with anything else blocking it. xitter.cf/GrapheneOS/status/2111…
Yahoo is still blocking emails from our newly assigned IPv4 space (206.220.120.0/22). It's likely they're behind on updating their database of allocated IP space. It was already published via arin.net/resources/guide/ipv… and other providers have been accepting it for 2 weeks already.
20
35
2
952
22,702
‼️ FOUR critical GitLab RCE flaws traced back to just THREE bugs in Ruby's regex engine. Ruby has now fixed them, but this isn't just a GitLab issue. Other Ruby apps that compile attacker-controlled regex patterns are also affected. Details ➜ thehackernews.com/2026/10/ru…
15
46
5
151
29,419
I think we've discovered another critical vulnerability: CVE-2026-BURNOUT: AppSec Professional Exhaustion Severity: Critical (CVSS 10.0) Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures. Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends. Attack vector: Reading security advisories. Affected versions: All AppSec professionals, regardless of experience. Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
52
367
33
1,766
90,960