Day 20/ Rest and reset

We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe. Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords. We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers. Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us. NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself. A detailed report is coming soon. Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance. Again, we're truly sorry to everyone affected.

PHP. Node. Railway. All have major security issues today. Devs: patch your servers, roll your env vars. Holders: tag your favorite project and make sure they have. The ones who answer fast are the ones you want to hold.

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

NFTs are an area of crypto that i think deserves another look the 2021 boom and subsequent crash left a lot of people with a negative view of them, but the underlying concept still makes sense to me as more businesses move onchain, NFTs could become a useful way to represent ownership, experiment with revenue sharing and build communities around products i expect there's still a lot of room for experimentation beyond the NFT models we saw last cycle

Next year, I will give one of my SpaceX shares to every kid in America. This will be the first of many.

Mudwater is an old game played deep in the Everglades. Instead of dice in alleys, we play Mudwater on the docks. The game is simple, but the skill ceiling is high. And we play for keeps. We've just airdropped this 6551 Totem, paired to all BAYC & MAYC, enabling pack claims.

One change is that you don't always need a cofounder to help you do the work, because AI can do a lot of it. But helping you do the work was never the main reason to have a cofounder. You need a cofounder to help bear the stress. AI can't do that for you.