Living the dream..., someone else's dream (probably a nightmare) Nostr pub key: 50f38b228877350faeadfdcf55332ad313e51d0bfab66bfd36eb450b36ff3cae

Vienna
Joined April 2010
Searching for new talents. #java #node #testing #angular. Drop me a msg. Juniors are welcome !
2
3
16
Christoph Ott ⚡ retweeted
‼️ Alert - Critical Brotli flaw behind #Node2Shell RCE goes far beyond Node.js. Bun, Python Brotli packages, Envoy, Istio and other widely used software are also affected by the same CVE-2026-111497 memory-corruption vulnerability. Read full details ↓ thehackernews.com/2026/10/br…
27
130
18
551
77,193
‼️ After PHP2Shell comes Node2Shell, a critical bug found by OpenAI's Codex Security that can let attackers run code in Node.js apps. It was successfuly demonstrated on the official Node.js 24.22.0 image. Node 20, 23 and 25 (all EoL) get no fix.
71
464
107
3,804
298,785
Christoph Ott ⚡ retweeted
Liked PHP2Shell? You’re gonna love Node2Shell. We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now! imperva.com/blog/node2shell-…
45
260
49
1,411
238,769
Christoph Ott ⚡ retweeted
OMG
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉 We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly. 1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials. The agent gets the task done, but it doesn’t get your passwords.. You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault. ➡️Learn more: bit.ly/487da6J
11
9
1
252
53,142
Christoph Ott ⚡ retweeted
🚨 UPDATE: A public PoC demonstrates RCE on PHP 8.5.12, even after the October 21 security patches. The attack is separate from the patched php2shell CVEs and requires specific session configurations and application weaknesses. Our earlier concerns about PHP session handling remain relevant. We've updated php2shell-protection with additional hardening guidance. #php #cybercurity github.com/syhunt/php2shell-…
27
172
26
697
96,201
Christoph Ott ⚡ retweeted
41
296
18
1,057
27,576
Christoph Ott ⚡ retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
345
4,178
1,254
18,603
7,060,387
Christoph Ott ⚡ retweeted
ngGlühwein returns on 27 Nov! 🍷 Join us for talks, shared ideas, community connections, and free food + drinks. 📅 Friday, 27 November 2026 📍 @Lean_Coders, Vienna 🎟️ Save your spot and a mug of Glühwein: meetup.com/angular-vienna/ev… #Angular #ViennaTech #AngularAustria #Devs
1
1
78
Christoph Ott ⚡ retweeted
🚨 LEDGER SUPPLY CHAIN ATTACK: MORE EUROPEAN RETAILERS FLAGGED AS POTENTIALLY AT RISK @Darkfost_Coc has expanded his watchlist of Ledger resellers after discovering a second tampered device at MediaMarkt. Aqipa GmbH, an official Ledger distributor since August 2023, has been linked to the distribution chain, raising concerns about potential exposure at other European retailers, including Saturn, Fnac, and Boulanger. Only CryptoBilis and MediaMarkt have been publicly linked to confirmed discoveries of compromised devices. There is currently no evidence that the other retailers’ inventory has been compromised.
Following the discovery of another compromised Ledger at MediaMarkt, I've updated the list of resellers/distributors that may be at risk. Aqipa GmbH has been an official Ledger distributor since August 2023, mainly in Germany and Austria. I've added the list of European distributors that may have been supplied by Aqipa, but once again, nothing is proven except for MediaMarkt and CryptoBilis. Don't you find it crazy that random accounts on X give you more information on the risks, how to check, and which devices may be compromised than the manufacturer itself does ? They didn't even offer to cover the shipping costs for the latest Ledger bought at MediaMarkt, even though they asked for it to be sent in.
21
35
10
165
24,628
Christoph Ott ⚡ retweeted
Update on Ledger devices at MediaMarkt Saturn 🔽 As of Oct. 13th, MediaMarkt Saturn has stopped, with Ledger’s alignment, the sale of Ledger devices in their stores and online while the investigation continues, following the report of an implant from one customer in Germany. No loss of funds were reported. We have no indication that Ledger's infrastructure, systems or services were compromised. Ledger Support is reviewing user reports, and Ledger’s cybersecurity experts, the Donjon will be examining the devices we receive: support.ledger.com. If you have questions about a device you bought, contact Ledger Support at support.ledger.com. Ledger will never call you, message you directly or ask for your 24-word recovery phrase. Many claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger and MediaMarkt Saturn channels for updates. We will share more as the investigation continues.
Readers added context they thought people might want to know
Ledger claimed MediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13. Reports show a store was still selling them hours later with staff unaware, and products remain listed on MediaMarkt sites. x.com/0xJohannes_/st… cointelegraph.com/news/mediamark… mediamarkt.de/de/product/_le… mediamarkt.at/de/product/_le…
155
104
57
560
196,654
Christoph Ott ⚡ retweeted
Gitea Runner 4.0.0 is here! 🚀 Highlights: ⚡ Built-in actions, starting with builtin:checkout 🗄️ Shared S3-compatible cache 🔭 OpenTelemetry tracing 🔗 self: action references 🐳 Improved container & cache handling And much more. Check out the full release: blog.gitea.com/release-of-ru… #Gitea #DevOps #CI #OpenSource
7
26
4
227
14,728
Christoph Ott ⚡ retweeted
spent some tokens bringing ski free to 2026
202
116
29
3,109
222,899
Christoph Ott ⚡ retweeted
Happy Hackers (1995) Day! 31 years old. #Hackers1995
68
2
416
19,785
Christoph Ott ⚡ retweeted
We rewrote the vite dev server in rust. By removing Node.js, we achieved 4x better memory usage and cold starts is 2x faster. This has resulted in our sandboxes acquisition time to go from 14s to 3s (4.6x improvement). When i say we, i mean @raphamorims
Today I am moving OJ to @Lovable I started OJ out of frustration watching Vite eat gigabytes under my agents. Now it's open source at github.com/lovablelabs/oj and rolling out under real Lovable previews. More to be shared soon 🍊
30
49
15
1,044
250,341
Christoph Ott ⚡ retweeted
Good times…
88
1,548
115
7,775
252,701
Christoph Ott ⚡ retweeted
The Legend of Zelda: Ocarina of Time -- first trailer! November 5, 2026.
413
2,693
1,057
28,920
2,015,355
Christoph Ott ⚡ retweeted
Replying to @jxnlco
Neither. It's web.
71
30
11
547
45,309
Christoph Ott ⚡ retweeted
Hold up 🤣
167
1,303
123
22,416
541,445
Christoph Ott ⚡ retweeted
𝗧𝘆𝗽𝗲𝗦𝗰𝗿𝗶𝗽𝘁 𝟳.𝟬 𝗶𝘀 𝗵𝗲𝗿𝗲, 𝗮𝗻𝗱 𝗶𝘁 𝗿𝗲𝗮𝗹𝗹𝘆 𝗶𝘀 𝟭𝟬𝘅 𝗳𝗮𝘀𝘁𝗲𝗿 🚀 In March 2025, Microsoft said they will create a 10x faster TypeScript by porting the compiler to Go. TypeScript 7.0 shipped on July 8, and here are the numbers: 🔹 VS Code (2.3M LoC): full build 125.7s → 10.6s (11.9x faster) 🔹 Sentry (1.9M LoC): 139.8s → 15.7s (8.9x) 🔹 Playwright: 12.8s → 1.47s (8.7x) 🔹 First errors in the editor: 17.5s → under 1.3s 🔹 Memory: up to 26% less Teams already said the following: 🔹 Slack cut type-checking in CI from 7.5 min to 1.25 min 🔹 Canva sees the first error after 4.8s instead of 58s 🔹 One Microsoft org saves 400 CI hours every month This version (7.0) is also a cleanup. The ES5 target is no longer there, and baseUrl also, while strict mode is on by default. The thing that remained is that there is no programmatic API until version 7.1, so if you are using Vue or Svelte, you still need TS 6 in the editor. The interesting part is that they tried Rust first. Anders Hejlsberg said: "The borrow checker doesn't allow circular data structures. And our compiler is chock-full of circular data structures." So, Go won. Porting instead of rewriting kept the exact compiler behavior. Will you move to TypeScript 7.0 now, or wait for 7.1? Image: Microsoft.
18
29
2
210
16,245