Vincent retweeted
Today we're launching an exciting new project: Highlights
Highlights is a syntax highlighter that outputs HTML. It improves on both speed and correctness compared to the existing industry standard libraries.
It's an optional drop-in replacement in Diffs, and it's ready to use today. In fact, it's already powering diffshub․com!
Check it out at diffs.com/highlights
OR `pnpm install @pierre/highlights`
Vincent retweeted
On July 25, we hacked OpenAI.
Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.
We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
Vincent retweeted
do not leave your omarchy machine unattended, people!
Presenting the QuickLogin attack against Omarchy. Think again, is leaving your FDE laptop unattended a good idea? Let's have a look! @dhh @OmarchyLinux
Vincent retweeted
OpenAI's Codex Security and Anthropic's Mythos both reported 0 remaining security issues in curl
AISLE then discovered 6 new zero-days that curl's security team validated & has now assigned CVEs to
6-to-0 on one of the world’s most hardened codebases:
aisle.com/blog/aisle-discove…
Vincent retweeted
I really recommending reading this.
In summary, a company which does ID verification for in-person interactions (hotels, car rentals, ID verification for alcohol or marijuana, etc) has some how exposed over 153,000,000 drivers licenses for people in the United States and Canada.
It is a catastrophic data breach, probably one of the worse I've ever seen. If you're in the United States and have traveled, gotten a hotel, purchased marijuana or alcohol, there is a high probability you're in this.
Unlike other breaches, this includes a photo of the person (from the license), making verification you've identified the person significantly easier.
This poses a significant threat to celebrities (musicians, YouTubers, streamers, adult entertainers, actors, etc), politicians, lawyers, wealthy people (CEOs, investors, people of public interest), Law Enforcement Officers, etc
Krebs himself, and several other security researchers, have already confirmed they're in the data leak.
tl;dr gah damn dawg this company is going to be sued into oblivion
krebsonsecurity.com/2026/09/…
Vincent retweeted
Dawg, they got Pete Hegseth in the data breach. It's available for sale for $100
I really recommending reading this.
In summary, a company which does ID verification for in-person interactions (hotels, car rentals, ID verification for alcohol or marijuana, etc) has some how exposed over 153,000,000 drivers licenses for people in the United States and Canada.
It is a catastrophic data breach, probably one of the worse I've ever seen. If you're in the United States and have traveled, gotten a hotel, purchased marijuana or alcohol, there is a high probability you're in this.
Unlike other breaches, this includes a photo of the person (from the license), making verification you've identified the person significantly easier.
This poses a significant threat to celebrities (musicians, YouTubers, streamers, adult entertainers, actors, etc), politicians, lawyers, wealthy people (CEOs, investors, people of public interest), Law Enforcement Officers, etc
Krebs himself, and several other security researchers, have already confirmed they're in the data leak.
tl;dr gah damn dawg this company is going to be sued into oblivion
krebsonsecurity.com/2026/09/…
Vincent retweeted
GLM-5.3 is now open-weight.
Our most capable model for agentic coding and cyber defense is now available to download, run, and customize.
Weights: huggingface.co/zai-org/GLM-5…
Tech blog: z.ai/blog/glm-5.3
Vincent retweeted
We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times.
In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08…
Vincent retweeted
someone just plugged a cable into a Tesla charger and turned it into a computer virus.
@ScepticCtf compromised a Tesla Universal Wall Connector through the charging cable itself.
the chain:
→ compromise the Tesla Wall Connector through the charging cable itself (SWCAN protocol on the Control Pilot line, the wire that's supposed to just talk power levels)
→ the charger then hacks the car's infotainment system over wifi. on its own
→ the car parks near chargers from other brands
→ the infotainment system hacks an Autel MaxiCharger and a ChargePoint Home Flex over bluetooth. also on its own
one plug-in. four vendors. zero clicks after the first move.
but the exploit isn't the interesting part.
the wall connector firmware is bare metal ARM, binary only, no source, no symbols.
testing it live on the device gets you one attempt every few seconds and a single bit of feedback: did it crash.
they built an emulator to run the firmware off the actual hardware. same testing, 1000x faster. that's the difference between "this chip is unfuzzable" and finding a critical bug in hours.
the bug: a signed integer read from the firmware header turns into a memory write past where it should stop, during the exact step meant to verify the firmware is legit. it had been sitting there through however many people read that code.
slides in the reply.
this might be my favorite Black Hat talk this year.
Readers added context they thought people might want to know
The described vulnerability was patched by Tesla in late 2025 and deployed to the fleet. Researchers presented it as lab work at Black Hat.
x.com/TeslaCharging/…
cybernews.com/security/tesla…
linkedin.com/posts/tscharno…
Vincent retweeted
Code Storage is an incredible piece of technology
They have seamlessly scaled to tens of millions of Git repos backing Bolt projects without a hiccup
Jacob and their team have been excellent partners for us at Bolt - can't recommend higher
Signups are now open on Code[dot]Storage.
Today, more new repos are created per second on Code Storage than any other platform.
Lovable, Bolt, Amp, Poke, and many more of the largest agentic workloads store their code and agent memory at scale using Code.Storage.
Vincent retweeted
Signups are now open on Code[dot]Storage.
Today, more new repos are created per second on Code Storage than any other platform.
Lovable, Bolt, Amp, Poke, and many more of the largest agentic workloads store their code and agent memory at scale using Code.Storage.
Vincent retweeted
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
github.com/xoreaxeaxeax/skit…
Vincent retweeted
‼️ BREAKING: A 40-minute LiteLLM PyPI compromise potentially exposed 2,100+ organizations.
Tied to Trivy's supply-chain attack, the malicious releases stole cloud, SSH, Kubernetes, and database credentials. Researchers later obtained roughly 434,000 captured files mapping potential exposure across thousands of organizations.
See what the stolen data reveals: thehackernews.com/2026/08/ma…
Vincent retweeted
Been fighting the Great Firewall of America all day (Fable too, though this screenshot is from Codex). I truly believe this is resulting in software being less secure because we can't find and fix security issues in our own software that we control without a bunch of red tape.
Vincent retweeted
Edit is now live on diffs[dot]com.
This isn't just another Monaco or ProseMirror wrapper.
This is an entirely new edit implementation, built on top of our file and diff rendering primitives.
- Over 189 commits
- Over 900 new tests
Try it out now – diffs.com/edit
Vincent retweeted
Say hello to Edit mode for Diffs.
It’s been an absolute blast to have worked on this with the @pierrecomputer team. Not only can you edit regular code, but you can also edit diffs as you make changes. Just toggle edit mode. Unreal ship.
👉 diffs.com/edit
Edit is now live on diffs[dot]com.
This isn't just another Monaco or ProseMirror wrapper.
This is an entirely new edit implementation, built on top of our file and diff rendering primitives.
- Over 189 commits
- Over 900 new tests
Try it out now – diffs.com/edit