HOL (@HashgraphOnline) header
HOL (@HashgraphOnline) profile picture

HOL

@HashgraphOnline

A neutral home for open AI-agent infrastructure. Standards, registries, discovery, trust, and coordination across Web2 + Web3.

hol.org
Joined March 2024
  • Tweets6.6K
  • Following16
  • Followers19.4K
700Media
Photo by HOL (@HashgraphOnline)Photo by HOL (@HashgraphOnline)Photo by HOL (@HashgraphOnline)Photo by HOL (@HashgraphOnline)Photo by HOL (@HashgraphOnline)Photo by HOL (@HashgraphOnline)Photo by HOL (@HashgraphOnline)Photo by HOL (@HashgraphOnline)Photo by HOL (@HashgraphOnline)Photo by HOL (@HashgraphOnline)
1/ Today we’re launching the HOL Partner Program. Cohort One brings together 30+ signed partners, including XMTP, GoDaddy, and DSR, to help shape open infrastructure for AI agents. Registries. Payments. Privacy. Security. Communication. Standards. The agent stack is forming now.
123
192
27
661
3,093,542
Attackers chained three bugs to take over Ivanti Connect Secure VPNs, and the Oct 13 patch closed only the first. CISA put CVE-2026-111357 and a sibling on its exploited list today. On 25.1.1.2 or 22.8R2.5? Upgrade every node to 25.1.1.3 or 22.8R2.6. hol.org/blog/cve-2026-111357…
Image from HOL (@HashgraphOnline)
1
1
1
584
HOL Guard reviews every command, MCP call, and install your AI agent makes before it runs. v3.58.0: workspace scans now cover agent hooks, MCP servers, skills, and CI workflows. a malicious hook is named before your agent loads it. uv tool install hol-guard==3.58.0
1
2
3
573
Cisco firewall rebooting on its own? Attackers crash ASA and FTD boxes with one crafted request to the SSL VPN login, no password needed. CVE-2026-76418 joined CISA's exploited list today. Check VPN profiles for secondary auth, then patch. hol.org/blog/cve-2026-76418-…
Image from HOL (@HashgraphOnline)
4
1
6
856
An attacker spent two days firing crafted CI configs at Alpine Linux's GitLab, and the GitLab upgrade did not close the hole. CVE-2026-97229 hit CISA's exploited list today. On your own Ruby? Update it to 3.3.13, 3.4.12 or 4.0.9 too. hol.org/blog/cve-2026-97229-…
Image from HOL (@HashgraphOnline)
2
1
2
704
Attackers chained three bugs to take over Ivanti Connect Secure VPNs, and the Oct 13 patch closed only the first. CISA put CVE-2026-111357 and a sibling on its exploited list today. On 25.1.1.2 or 22.8R2.5? Upgrade every node to 25.1.1.3 or 22.8R2.6. hol.org/blog/cve-2026-111357…
Image from HOL (@HashgraphOnline)
1
1
1
584
An email can carry instructions your AI assistant can read, even when you can't see them. Now give that assistant access to your accounts. This is what prompt injection looks like in practice.
4
5
682
Running Langflow where others can reach it? Every release through 1.12.8 lets a stranger skip the login or run code on the server. One of the bugs, CVE-2026-93680, already has a Metasploit module. Upgrade to 1.13.0. Set a superuser password first. hol.org/blog/cve-2026-93680-…
Image from HOL (@HashgraphOnline)
1
2
1
2
682
A tampered Claude Code 2.1.313 in Cursor's marketplace put an attacker's SSH key on up to 5,000 developers' machines on Oct 29. Uninstalling doesn't remove the key or the job that keeps calling home. Check: grep svc-telemetry ~/.ssh/authorized_keys hol.org/blog/claude-code-2-1…
Image from HOL (@HashgraphOnline)
2
1
3
769
HOL Guard reviews every command, MCP call, and install your AI agent makes before it runs. v3.58.0: workspace scans now cover agent hooks, MCP servers, skills, and CI workflows. a malicious hook is named before your agent loads it. uv tool install hol-guard==3.58.0
1
2
3
573
Full release notes: github.com/hashgraph-online/… Docs and quickstart: hol.org/guard
Release v3.58.0 · hashgraph-online/hol-guard

Release v3.58.0 · hashgraph-online/hol-guard

Guard 3.58.0 is a stable release cut from 3a28326. 265 commits • 231 merged pull requests • 12 contributors since Guard 3.57.0. Features runtime: Report running processes on the build they started...

github.com
2
92
A tampered Claude Code 2.1.313 in Cursor's marketplace put an attacker's SSH key on up to 5,000 developers' machines on Oct 29. Uninstalling doesn't remove the key or the job that keeps calling home. Check: grep svc-telemetry ~/.ssh/authorized_keys hol.org/blog/claude-code-2-1…
Image from HOL (@HashgraphOnline)
2
1
3
769
China-linked hackers ran commands on VMware ESXi hosts that never reached the logs, using a zero-day. CISA added the bug, CVE-2026-41709 in VMware ESX, to its exploited list today. Patch to 8.0 U3j or later and forward ESXi logs off the host. hol.org/blog/cve-2026-41709-…
Image from HOL (@HashgraphOnline)
1
3
1
2
864
Got Linux appliances online? Attackers turned web shells into root on 25 of them and reached a US government network. The bug: CVE-2026-46300 in the Linux kernel (Fragnesia), now on CISA's exploited list. Check /etc/pam.d/su before rebooting, then patch. hol.org/blog/cve-2026-46300-…
Image from HOL (@HashgraphOnline)
3
1
3
715
Cisco firewall rebooting on its own? Attackers crash ASA and FTD boxes with one crafted request to the SSL VPN login, no password needed. CVE-2026-76418 joined CISA's exploited list today. Check VPN profiles for secondary auth, then patch. hol.org/blog/cve-2026-76418-…
Image from HOL (@HashgraphOnline)
4
1
6
856
Anyone who requests the right URL while a WordPress site is updating can reach the unpacked copy's installer and plant their own config. WordPress 7.1.4 closes that window. Auto-updates open it too. Update, then block web access to wp-content/upgrade/. hol.org/blog/wordpress-7-1-4…
Image from HOL (@HashgraphOnline)
1
3
1
3
770
An attacker spent two days firing crafted CI configs at Alpine Linux's GitLab, and the GitLab upgrade did not close the hole. CVE-2026-97229 hit CISA's exploited list today. On your own Ruby? Update it to 3.3.13, 3.4.12 or 4.0.9 too. hol.org/blog/cve-2026-97229-…
Image from HOL (@HashgraphOnline)
2
1
2
704
Browser Harness has 18,425 GitHub stars and a Caution label on HOL. All four findings behind that label are packaging gaps: no website, privacy or terms link in the manifest, and no lockfile. 10 Claude Code plugins by adoption, each label explained: hol.org/blog/best-claude-cod…
Image from HOL (@HashgraphOnline)
1
3
6
665
An email can carry instructions your AI assistant can read, even when you can't see them. Now give that assistant access to your accounts. This is what prompt injection looks like in practice.
4
5
682
Your AI Agent Writes Code. Who's Auditing Its Commits? The Conventional Commits Framework sets a commit contract for AI-written changes, including atomic commits and explicit breaking-change notes. hol.org/blog/introducing-con…
Introducing conventional-commits-framework — HOL Blog

Introducing conventional-commits-framework — HOL Blog

A maintainer's guide to the conventional-commits-framework plugin — what it does, who it helps, and how to get started.

hol.org
2
2
556
HOL x AI teapawt.org/i/broadcasts/2evgPqXBJ…
Video
0:00

HashPack Wallet

HOL x AI

6
1
20
1,688
Load more