data + ai + infosec engineering. @squirrelscan_ @opennem. at https://teapawt.org/t.co/yOGtW7uHIA and https://teapawt.org/t.co/kvkcg5TrG9
Australia
Joined March 2007
- Tweets1.7K
- Following762
- Followers458
- Likes4.4K
had no idea things were this bad ... F
Fix: anything wallet or trading related on its own origin, strict CSP, no third-party scripts, send conversions / debug info server side
Fix for users: run an ad blocker. debugbear (who got hacked here) have been on the default easyprivacy list since forever (for this reason)
For a critical finance site polymarket sure does load a lot of crap
17 third-party scripts: Google, Meta, Tiktok, X, Snap, Reddit, AppsFlyer, Intercom, Dub, Vercel, Sentry, whatever grcv dot io is (?!?)
All it takes is one to be compromised for wallets to get drained
i'm going to post an update and likely do an entirely separate blog on response rates and how difficult it is to report issues now - there are so many apps now that are being spun up that accept financial / personal information by people who have never run ops or handled a security report etc.
I saw a comment where someone replying to post about the Israeli elections that said "be more like Serbia" (in a good way) and I almost spat out my rakija
Nik Cubrilovic retweeted
We audited 3 months worth of Product Hunt launches with squirrelscan (~20k sites)
69 sites were leaking real credentials or user data to every visitor. A live Stripe secret key. Supabase service_role keys. A dump of user records with password hashes.
🧵
Apple sensitive content warning uses on-device image detection models - a privacy respecting way of filtering content. It's described here (you can disable it):
support.apple.com/en-au/1050…
Filmmaking marked safe from AI
Watch Episode 1 of our Odyssey series made with Grok Imagine.
Let us know in the comments if you'd like a full breakdown of how it was done!
Creative collaboration with @WonderStudiosX and director Dev Walker @glumlot_
Phone numbers aren’t authenticated and can be spoofed.
We can’t be far away from banks and other critical apps abandoning phone support for in-app support only
github.com/thecybergeek/php2…
php2shell OOM in mod_php (CVE-2026-109618): the fake-HashTable fire only runs ~14-byte commands, too short for a shell. Poison a PHP session via upload_progress with <?php system(base64_decode())?>, then exec in 11 bytes: php /tmp/s* www-data shell. Full PoCs in my github repo!
#php2shell #CVE #InfoSec #PHP #RCE
How do you write an entire book about teenage hackers hijacking the internet and not know what PHP is? It would be the main character ..
BYO iPhone as a diplomat is a security nightmare - they all know that. It's a choice between having a secure gov device + network but having to comply with records retention + preservation, or going in raw into a hostile environment but being able to remain freelance
The GRU hacked into Jared Kushner's iPhone. Dutch military intelligence (MIVD) then recruited a GRU spy who gave them access to the hacked phone. What MIVD discovered was that Kushner had access to two bank accounts --one Azerbaijani, the other Israeli --where Saudi Crown Prince Mohammed bin Salman and Emirati ruler Mohammed bin Zayed deposited money. It sounds like a slightly far-fetched episode of "Slow Horses," but it's real. And it proves just how eye-poppingly corrupt this administration was and continues to be as its "special envoy" decides the fate of tens of millions in Europe in the Middle East. Simply incredible reporting by Matthew Cole, drawn from his new book on Kushner. vanityfair.com/story/jared-k…
Seemingly launched with support for every agent out there except OpenClaw and Hermes - both starting to feel a bit dead in the discourse
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉
We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly.
1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials.
The agent gets the task done, but it doesn’t get your passwords..
You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault.
➡️Learn more: bit.ly/487da6J