security & cryptography @zksecurityXYZ | @yAuditDAO
Joined April 2012
- Tweets1.6K
- Following5.5K
- Followers1.1K
- Likes37.6K
teddav retweeted
🚨 Nightmare day for cybersecurity
Multiple major security incidents, active exploits, supply chain compromises...
If you run production systems, start patching NOW.
PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW
LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets.
eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores.
Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs.
TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff.
Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors.
BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign.
And that's not even the full list.
Patch. Audit. Rotate. NOW.
teddav retweeted
BREAKING: UN Watch has uncovered over $2.5 million in external financial support to UN expert Francesca Albanese — including over $600,000 from undisclosed sources and tens of thousands from pro-Hamas groups.
🔗 See the evidence for yourself:
unwatch.org/special-rapporte…
teddav retweeted
Alguien reconstruyó el bitcoin.exe original de Satoshi de 2009, byte por byte.
Usó Opus 5.5 para hacer ingeniería inversa del entorno de compilación a partir del binario. Nadie había logrado recrear el ejecutable exacto porque no se conocía la máquina ni las herramientas que usó Satoshi.
El resultado coincide al 100% con el SHA-256 histórico:
fbcac071d92e26d82ec917214e334bd43850c0691f113bab1d4741c9bdd30d2d
También rearmó el .rar original con los mismos hashes.
Lo interesante es lo que se descubre del proceso:
- Satoshi usaba Windows XP con MinGW
- Compiló en modo debug, pero dejó optimización máxima solo en el hash de minería
- El exe que todos llaman 0.1.0 en realidad es la actualización del 10 de enero (el del día de lanzamiento parece perdido)
Sirve para confirmar que el binario que la gente descargó en 2009 salió exactamente del código fuente que se publicó. Nada más, nada menos.
teddav retweeted
Fantasy computer security problems: "Maybe by sending packets and detecting the timing of the vibrations of the computer case, it is possible for an attacker to gain information about the private key."
Real computer security problems: "The private key was 4. Not 4 digits. 4."
teddav retweeted
🚨 LADIES AND GENTLEMEN OF AMERICA, THE MOMENT YOU’VE ALL BEEN WAITING FOR!
The @WNBA has officially responded!
IS THE #WNBA TRANSPHOBIC?
Apparently, the WNBA still can’t define what a WOMAN is, but they’re absolutely certain they know what a MAN is!
How convenient!
WNBA Commissioner Cathy Engelbert has declared that I am a man.
Who gave her the authority to decide who I am?
Who gets to define my identity?
And how can the WNBA determine who is a man without explaining what qualifies someone as a woman?
Is the WNBA denying people the right to define their own gender identity?
You can’t have it both ways!
America, read this letter for yourselves.
THE WNBA HAS SOME EXPLAINING TO DO!
teddav retweeted
Tldr: if you want to find bugs in your codebase, use the latest frontier models
You don’t need a security-specific model outside of a few cases, like doing offensive work (building exploits), working on something sensitive, or running a business that depends on cheap inference
teddav retweeted
a brand new model paradigm! introducing 𝚌𝚕𝚊𝚒𝚛𝚒𝚌: a system one model for extracting, computing, estimating, and predicting values from unstructured inputs.
blog.cloudflare.com/clairic-…
teddav retweeted
I feel bad man 😭 Apologies to the thousands of VPS and compute engineers worldwide spending their weekend emergency patching and rebooting hypervisors because of CVE-2026-99999. Security bugs really do love getting disclosed right before the weekend.
teddav retweeted
J’ai entendu dire que la France était finie, qu’il était trop tard pour la sauver.
Mais la France est toujours aussi belle, enviable même. Sa grandeur n’a pas disparu, elle ne demande qu’à renaître.
Nous avons surmonté en un an un problème cent fois plus grave, sans avoir les moyens dont dispose la France.
La France pourrait y arriver en une semaine.
teddav retweeted
This is a massive violation of European emission standards
I doubt Elon Musk bought carbon credits to offset this environmental disaster he just caused
The EU will be issuing a €300 million fine
teddav retweeted
INSANE. An internal Anthropic research model's chain of thought after cracking the 26-year-old NSA elliptic curve seed mystery in under 30 minutes: 'Hmm wait. Let me be skeptical: am I in some sort of simulated/test environment? ... All top bits clear - 20 bits, chance 1e-6. So indeed real-world. Wow, it's a real discovery.'
CLAUDE FOUND THE SEEDS
anthropic.com/research/ecdsa…
teddav retweeted
Évolution du nombre de CVE du noyau Linux 1995 - 2026
ALT year Low Medium High Critical 1995 0 1 0 0 1996 0 1 1 0 1997 1 8 1 0 1998 3 3 4 0 1999 4 10 5 0 2000 1 2 2 0 2001 13 5 5 0 2002 9 2 4 0 2003 8 14 6 0 2004 23 12 17 0 2005 60 48 26 0 2006 24 43 24 0 2007 17 49 39 0 2008 10 43 39 0 2009 10 69 49 0 2010 38 65 85 4 2011 20 61 72 0 2012 27 95 103 1 2013 44 137 97 1 2014 22 98 112 1 2015 18 88 316 9 2016 1 116 337 18 2017 5 208 378 35 2018 3 148 116 14 2019 14 176 164 38 2020 7 139 76 15 2021 10 202 190 16 2022 15 292 232 34 2023 13 293 269 33 2024 47 3143 1299 37 2025 32 3414 1239 35 2026 41 2081 1897 332
teddav retweeted
My dear friends, I’d like to show you my latest toy project
Introducing Handwired: turn your regular JavaScript code into a neural net!
- no training
- exact outputs vs the JS program
- fully differentiable
All runnable in a browser, without GPU
teddav retweeted
Liste des pays interdisant l'alcool à emporter :
🇦🇫 Afghanistan
🇸🇦 Arabie saoudite
🇮🇷 Iran
🇰🇼 Koweït
🇱🇾 Libye
🇲🇷 Mauritanie
🇸🇴 Somalie
🇾🇪 Yémen
🇧🇳 Brunei
🆕 Califat de Saint-Denis
teddav retweeted
bombshell report from the OCC out today confirming what we all suspected:
between 2020 and 2025, based on a review of 100,000 complaints, America’s largest banks systematically denied banking to lawful businesses based on political and reputational considerations rather than objective financial risk, effectively appointing themselves arbiters of which industries deserved access to the financial system. digital assets was specifically named as one of the six most affected industries.
TLDR: we weren't imagining it. OCP2.0 was real.
teddav retweeted
Odds of dying: 1 in 13.7 million
Fair payout on $8 policy: $109,600,000
Profit per crash: $106,600,000
Basically a free money printer
Readers added context they thought people might want to know
The Jetstar single-flight $8/$3M life insurance kiosk shown does not exist and appears AI-generated. Jetstar has never offered this. Real travel insurance accidental death benefit is $10,000.
jetstartravelinsurance.com.au/policy-benefits
jetstar.com/au/en/travel-i…
teddav retweeted
Bitcoin self-custody isn’t really that hard (2026 edition)
- Buy 3 different hardware devices.
- Have them mailed using fake names.
- Deliver to a random P.O. Box.
- Disassemble each one.
- Inspect them for manipulation.
- Review the device firmware with SI.
- Roll dice 100x for sufficient entropy.
- Pound each seed phrase into metal.
- Geographically distribute them.
- Download a desktop wallet.
- Pray your PC isn’t compromised.
- Generate a receive address.
- Send your entire life savings in one go.
- Sweat bullets for 10-30 min.
- Tell no one you did any of this.
- Fear being wrench attacked forever.
- Make fun of others who don’t self custody
Why isn’t everyone doing this?
teddav retweeted
By popular request, added cricket and MMA:
Turns out, MMA actually beats every other sport by a long shot. By far the most drama per minute, double that of F1.
Fighting fans vindicated.
(Golf still sucks.)
It turns out that F1 is mathematically the most dramatic sport.
I'm not an F1 fan myself, but the data is unequivocal.
The proof: take a time series of prediction market data and measure the volatility minute-by-minute in the odds for each sport. This measures the density of actual drama in the sport during a game.
Even if there's action and points going back and forth on screen, it's meaningless if the winner is basically decided. It's only real drama when the odds are moving in realtime while you're watching.
By this metric: F1 > E-sports (CS2) > Soccer > Basketball > Tennis > American football > Baseball >>> Golf
That's right, golf is mathematically the worst sport.
(I knew it.)
