
Finding bad software extensions at @SocketSecurity (acquired @secureannex) #️⃣ https://xitter.cf/t.co/KGANHVF6BP
Kansas City, MO
Joined May 2008
- Tweets5.5K
- Following886
- Followers3.2K
- Likes14.9K
tuckner retweeted
>junior dev at a mid startup
>wednesday morning
>just want to push a minor bugfix to our php app today
>open laptop, check slack
>company group chat is an absolute warzone
>CTO typing in all caps about php2shell
>fucking php
>whatever, server hasn't blown up yet, I just need to get my code in
>open gitlab to merge the PR
>forced emergency logout because of a critical gitlab security patch release
>fucking gitlab
>pipeline fails because of some weird regex compiler bug
>spend 40 minutes fighting CI/CD
>i can just use AI to help debug
>fire up opencode
>api keys nuked because they were breached
>fucking opencode
>i’ll just get fresh LLM api keys from our corp proxy, LiteLLM
>it won’t connect? It’s down?
>look up LiteLLM news: supply chain compromise
>fucking litellm
>cold sweat forming
>slack alert: db connection error
>check our database connection
>we host on TiDB Cloud
>they just announced a security breach, unauthorized access via stolen service account credentials, data copied
>fucking tidb cloud
>full panic attack incoming
>figure fuck it, just ship the container to Railway and go home
>open Railway dashboard
>bright red banner: "Security Disclosure: Rotate all environment variables immediately. All builds paused."
>fucking railway
>try to open the app URL in browser to see if anything is even working
>NET::ERR_CERT_AUTHORITY_INVALID
>eMudhra intermediate certificates compromised
>4
>instantly untrusted by every major browser
>fucking emudhra
>stare blankly at mac screen for 10min
>random pop-up
>restarting in 10min to fix a critical vulnerability
>fucking macos
>close laptop
>leave office
>never come back
tuckner retweeted
We cover php, 4, & more on today’s episode of the GOAT security podcast @riskybusiness
youtu.be/6SIgPjQ9V1g
tuckner retweeted
Full content from our security engineering workshop @BSidesNYC is at seceng.guide/
tuckner retweeted
And we are hiring generalist security folk (and others)! Come work with us - privy.io/careers
Today is probably a good time to check in on things with @privy_io, which became part of @stripe just over a year ago.
Our acquisition was predicated on three factors: stablecoin growth, self-custody as a key enabler of broader global coverage, and rapidly increasing demand for programmable financial infrastructure. As we said at the time, "money has to reside somewhere, and Privy builds the world's best programmable vaults."
Since then, the Privy team has executed exceptionally well: assets in Privy wallets have grown ~25x, monthly active developers are up ~3x, revenue is up ~9x, and Privy now facilitates nearly $25B of monthly transaction volume. @tryramp, @Deel, @Klarna, @felixpago, @HyperliquidX, and thousands of other businesses are building embedded banking functionality on Privy.
At Stripe, we're deeply integrating Privy into Treasury, @Link, and Connect. In each case, it's accelerating our global expansion, and enabling us to build better functionality faster. (Coming soon: @Link balances.)
We're also seeing that Privy's wallet infrastructure is the ideal substrate for agents to transact and earn -- live today with @merit_systems, @orthogonal_sh, @Nevermined_ai, @prlnet, and more. Developers prefer programmable financial infrastructure, but agents need it. We expect that the agentic economy will continue to grow extremely quickly.
The Privy team has maintained remarkable product velocity, with major launches this year including deposit addresses, earning on Privy balances, digital asset accounts, custodial wallets, and Stripe's own stablecoin cards.
It's also been neat to see how Privy has been accelerated by Stripe, with better onramps, @stablecoin payment rails and licenses, Stripe's fiat capabilities and issuing stack, and integration with @Tempo.
Together, we're building one API for holding stablecoin balances and earning yield, moving money in and out of fiat, and orchestrating spend with cards. We still have a lot of work to do, not least in integrating everything across Privy, Bridge, and the rest of Stripe -- there's been so much feature and functionality expansion that we haven't yet had much time to reconcile everything. Overall, though, I'm very happy with how things are going, and excited by where these capabilities are headed.
If you're interested in working on the future of stablecoins, agentic payments, and crypto's deployment in the real world, you should get in touch with @sternhenri (now leading all of @StripeCrypto) or others on the team.
Mutability of releases, tags, whatever concept you think it's very overlooked. Most folks take for granted it's just an abstraction for labeling code that gets implemented differently across many different surfaces.
You’d expect a lockfile to make a dependency immutable. But often it doesn’t: a hacked repository can swap in malicious code for the **same package and version**, and most package managers install it anyway.
xitter.cf/trailofbits/status/211…
tuckner retweeted
VirusTotal is now available in ChatGPT
Scan files, URLs, and domains for potential threats, right from your chat
chatgpt.com/plugins/plugin_a…
tuckner retweeted
Holy shit...
A random Chinese company purchased CryptoBilis (the authorised Ledger reseller that issued the spy-implanted Ledgers) from its Malaysian ex-owner, then put him under a confidentiality agreement preventing him from disclosing the sale publicly.
What a wild attack.
tuckner retweeted
🚨 More than 500 GitHub accounts committed credential-stealing Actions workflows to tens of thousands of repositories.
Disguised as security audits, the malicious workflows harvest AWS keys, API tokens, and secrets from Git history.
Read: thehackernews.com/2026/10/cr…
tuckner retweeted
Update: Socket has identified more than 500 GitHub accounts that committed the malicious GhostAction workflow to tens of thousands of repositories since October 7, including organization-owned repositories reached through compromised contributors.
These user account -> GitHub organization pivots are really interesting. If an employee can infect a repository that others use or maintains secrets, it will keep spreading further.
tuckner retweeted
🚨 16 malicious Firefox extensions posed as Rabby and OKX wallets to steal recovery phrases and private keys.
Their code intercepted wallet secrets during import and attempted to send them to attacker-controlled Cloudflare Workers.
All 16 have been removed.
Read - thehackernews.com/2026/10/16…
tuckner retweeted
Socket found 16 malicious Firefox extensions impersonating @Rabby_io and @okx wallets, built to steal recovery phrases and private keys.
All 16 claim to collect no data. The malware sends wallet secrets to attacker-controlled Cloudflare Workers.
socket.dev/blog/firefox-cryp…
tuckner retweeted
🚀 Socket now scans VS Code Marketplace extensions.
You can vet every dependency in your app and still get compromised by an extension in your editor.
We analyze all 100,000+ extensions in the VS Code Marketplace and their updates for malicious code and risky behaviors.
tuckner retweeted
I am really excited for the first MinuteCon. This is the first year and we want this to be something we run for years to come.
Talks often help shape feel and energy of a conference, I am incredibly excited for what folks share. If you have ideas, drop me a DM.
tuckner retweeted
It's been one year of our Sprawl meetup! Our 7th event is this Tuesday, with much more planned for later!
If you're coming, there's also some @uwu_underground unique tokens to hand out, and Sprawl challenge coins.
Website: sprawl.nyc
Organized by @withzombies, "OMAR", and I
And a huge thanks to all our speakers and hosts!
We're always looking for more folks to speak, and event spaces that can host ~100+ people. Let us know if you can help!
Below are some new animations I made to play in the background in between talks (quick version, you can see the full thing on the site).
You're telling me my Christmas theme was going to be Glassworm!?
Don't just gloss over themes when looking at code extensions. They are no different than any other one when it comes to executing code.
Socket researchers found a GlassWorm-linked VS Code theme cluster: 4 extensions on VS Code Marketplace and 6 on Open VSX. Related themes have thousands of installs. The malware fetches and executes payloads using encrypted loaders and a Solana dead drop.
socket.dev/blog/glassworm-vs…
tuckner retweeted
‼️BREAKING: An actively exploited unknown critical Citrix NetScaler zero-day has prompted governments and organizations to SHUTDOWN all their devices immediately.
We don't know what's exactly going on yet. Stay tuned for more info.
This are now disabled again 🤷
github.com/actions-cool/main…
github.com/actions-cool/issu…
My detection rule "name = solidity" has been working for 15 months now.
annex.security/blog/these-vi…





















