From the infinite potential of energy to the total actualization of entropy, intelligence charts a course for the pursuit of meaning, mission and love.
Dublin City, Ireland
Joined September 2023
- Tweets12.5K
- Following310
- Followers5.2K
- Likes44.1K
Pinned Tweet
Present Dyson City! @threejs
In year 2127, humanity created its first Dyson sphere around Alpha Centauri A, a 2 million kilometer diameter structure, and started the "Astro-Industrial Era". On the inner side of this lonely structure is a small city called Dyson City for research purposes. You have been elected to be the lone guardian of this city
You have your own estate on Dyson City, and you've chosen to make it a Victorian style manor. The rest of the city is a 200 acre golden scientific-industrial compound
You have your own vehicle called Aurelia to take you anywhere in this city. A fleet of research spacecrafts come in every 30s for data backup and refueling
Now, you're in charge: dyson.scottsun.io
What does Gitlab even do?
How bad is this Gitlab issue? About as bad as it gets.
Anyone on the internet can take over an exposed, self-hosted GitLab server without logging in, on any version from the last 12 years.
Shodan is showing ~60K exposed servers online, which is a lot, but there are are far more internally for anyone with a foothold already.
It funny to see how so many of these legit big platform companies are running their operations like shit
just got royally fucked by this
so you're telling me i pay railway every month to keep my secrets safe, and now i have to rotate every single one of them myself
except all deployments are paused, so if i rotate now my app breaks, and if i don't, someone else might have my keys
fml, what's a good alternative to railway?
gotta move before i scale my app any further
People probably now switching back to codex because at last they have daybreak you can get in
Railway has been turbo pwned, I'm freaking out because hackers have access to decrypted ENV variables and I asked Claude to help but-
NOPE. NOT CLAUDE.
The most dangerous part of this ecosystem is @anthropic and their ridiculous moralizing.
If attackers use agent swarm to one shot your cyber defense because you don’t use AI for cybersecurity, it’s your fault
Yes i said it. It’s 2026, use AI to beef up your weak ass cybersecurity
DeepSeek V4.1 Flash 1017 exceeds Sol 6 for offensive cybersecurity👀
Whats happening right now is probably way worse than the Hugging Face incident.
AI-powered attacks are hitting real organizations while major platforms disclose breaches and critical flaws.
- Microsoft reports AI agents targeting hundreds of organizations, reaching privileged cloud access in under three hours in multiple cases. It attributes the ConnectWise compromise to the same group.
- CrowdStrike documented four operators running successful AI-agent campaigns. One compromised at least 15 Argentine healthcare organizations.
- PHP2Shell: AI helped turn longstanding PHP flaws into working exploits. Cloudflare’s CEO reports millions of exploitation attempts. Their AI involvement is unknown.
- Railway disclosed possible access to customer secrets. LiteLLM shipped a backdoored release. Zeabur confirmed another breach and is shutting down.
- GitLab patched a maximum-severity flaw affecting 12 years of releases. Node.js patched a serious code-execution vulnerability, with Vercel deploying firewall protections.
Feels like a turningpoint.
Target locked
Food Forest: Ketelbroek | Freek Freriks
A forest designed to feed us.
Freek Freriks combines animation and VFX in Houdini to introduce Ketelbroek, a food forest in the Netherlands, and its mission in just 33 seconds.
Created over two months, the film’s visuals are entirely Freriks’ work, from creative direction and design through animation, compositing, and grading. A compact project spanning the full visual process.
With music and sound design by Wouter Messelink and voice-over by Erik van der Ven.
Watch the full film:
motionographer.com/quickie/f…
#FreekFreriks #Houdini #Animation #VFX #MotionDesign #mtngrphr #motionographer
I’m actually kinda surprised that opus 5.5 can make this end to end literally
It pulled hdri from poly haven and PBR textures from ambient CG with freakin curl, built the entire thing in a single html
Something like this used to take a blender artist a few days or a week to make, now it’s like under an hour and basically without any intervention from me
Anthropic’s account ban revenue rivals EU tech company fines
running a US company
being a US permanent resident
using claude only for personal + business work
temporarily staying in China
took my annual renewal for the team plan
2 days later: account is banned
@claudeai, can you at least explain what happened?
and if being physically in China is a hard restriction, then just refund the unused subscription and maybe don’t ban accounts right after taking their annual renewal
My reset was yesterday evening, I still had over 20% weekly usage left when it kicked in, and i’m on a 5x max plan
I swear if it don’t push it like insanely hard I can barely use up all the quota. Claude usage is so goooood
Remember in Feb Anthropic made such a big deal about Mythos 5, as if the entire world would fall apart if they released it?
Well turns out Astra and Sol are way more capable on cybersecurity and we have them GA
this is again shaping up to be another “gpt 2 is too dangerous to release” moment
wait, PHP was actually scanned by Anthropic’s Claude Mythos earlier this year. they also had access to OpenAI’s Daybreak Red for validating exploits.
the PHP Foundation revealed this JUST yesterday.
keeping frontier cyber models in the hands of a selected few doesn’t seem to be working well for the internet.
thephp.foundation/blog/2026/…
Everybody chill nothing to worry about. The AI cybersecurity capabilities have reached a threshold that we’re just discovering old vulnerabilities
The CVE found in php have existed for 14 yrs, we’re just sweeping the rug
There are finite amount of vulnerabilities. The more we discover, the more we plug the holes, the safer we are
I say let the storm come. When it’s done we’ll leave behind a safer Internet
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
I bet if they use full AI agents for security it would be more capable than their security engineers
wow this is bad!
ENTIRETY of PingCap database used by linkedin, flipkart, airbnb etc. has been copied and stolen due to customer credentials being stored directly in support tickets (LOL)
Attackers ran exfiltration directly on their cloud (LOL) pipeline ran for 22 days, exfiltrating data every 6 hours and NO ONE noticed. Worse, PingCap denies all of it.
Average SRE salary is $300,000 at PingCap btw
Scott retweeted
Yep, Anthropic contributed zero, literally zero value.
All it did was to announce Mythos, said Mythos is going to hack everything, got 50 or so companies to pay millions for access. They helped zero security researchers. Their safety classifier trips when even reading a vulnerability report.
OpenAI on the other hand, rolled out sensible KYC, gave access to Daybreak Blue, and see what the community has done with GPT-5.6-Sol (daybreak version).
One creates all the fear-mongering and delivers zero value, and the other quietly just carries everyone forward.
gotta give it to openai and their sane daybreak program
heif heist by harsh
kvmescape by paulos
php2shell by lcfr
gitlab rces by joaxcar
chrome full chain by moyix
wordpress rce by hashkitten
all largely thanks to openai daybreak giving researchers access to gpt 5.6 sol. anthropic took the opposite approach, gatekeeping access, there is a lesson to be learned here