Software engineer, bitcoin security consultant & hardware reseller. Once unbanked, now free. Multi-sig & seedsigner maxi. ∞/21M. https://xitter.cf/t.co/2veBfrhoer
Book a Free 30 Min Call 👉
Joined July 2022
- Tweets8.1K
- Following1.4K
- Followers7.1K
- Likes9.7K
Pinned Tweet
12 bitcoin security levels:
- level 0: on an exchange. You don’t really own anything.
- level 1: hot storage on a closed source shitcoin wallet (like @Ledger)
- level 2: hot storage on an open source bitcoin only wallet (like @bluewalletio or @SparrowWallet)
- level 3: cold storage on a usb hardware wallet with shitcoin support
- level 4: cold storage on a bitcoin only usb hardware (like @COLDCARDwallet mk4 or @BitBoxSwiss)
- level 4: cold storage on a bitcoin only airgapped hardware wallet without reproducible builds (like @KeystoneForBTC)
- level 5: cold storage on a bitcoin only airgapped hardware wallet with reproducible builds (like @foundationhq Passport)
- level 6: analog-only airgapped cold storage (Passport supports this) with self generated ephemeral seed
- level 7: cold single seed + passphrase (protect against seed compromise)
- level 8: Shamirs secret sharing cold single seed (protect against seed compromise & introduce fault tolerance)
- level 9: hybrid 2/3 multi-sig with 1 hot key
- level 10: full cold 2/3 multi-sig
- level 11: hybrid 3/5 multi-sig with 1 hot key
- level 12: full cold 3/5 multi-sig
Could be split up further but might not make a lot of sense. Bonus points for connecting to your own node at any level.
I’m sure many will disagree somewhere. What would you change? What would you remove or rank differently?
Note higher security is not always the best fit for your situation.
Rob | Bitsaga.be retweeted
i own a relatively new (2025) samsung tv.
i kept getting weirdly targeted ads.
i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic.
zero days it is. root shell on new samsung TVs!
discovered PRIVACY HORROR. write up?
Rob | Bitsaga.be retweeted
they’re calling it “Black October” and i don’t think people realize how serious this is
in the last 48 hours there have been over 27 major cybersecurity incidents. not in a month. not in a week. in 48 hours
any ONE of these would normally be the biggest story of the year
PHP: critical vulnerability in the software running 80% of the web. severity 9.2 out of 10
Node.js: high-severity flaw letting attackers take over servers remotely. affects versions 22, 24, and 26
Java: also compromised. three of the most used programming languages on earth hit at the same time
GitLab: a perfect 10 out of 10 severity hole in every version since 2014
Railway: hosting platform compromised. API keys for OpenAI, Claude, Stripe potentially exposed
Signal: a bug that could leave your mic and camera on after you hang up
WordPress: hackers stole a plugin maker’s keys and planted backdoors on websites
LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
and that’s not even half the list
thousands of AI agent swarms are reportedly scanning and attacking vulnerable servers right now. automated. around the clock
security researchers are saying this might be the early stages of a global cyber incident that nobody fully understands yet
if you run a website, use cloud services, store API keys on hosting platforms, or use any software built on PHP, Node.js, or Java you are potentially affected
update everything. rotate your API keys. change your passwords on critical services. enable 2FA everywhere you haven’t already
this is not a normal week on the internet. this is something different
Rob | Bitsaga.be retweeted
@SeedSigner 不是公司
它不属于创始人，不属于股东，只属于每一位比特币爱好者
美国@sesi_the_man,加拿大@YTCryptoGuide,奥地利@GoBrrr_me,比利时@BitsagaRob,韩国@bitkitBTC,日本@TBB_JP,中国@arh9992……
他们散落在世界各地，隔着时区与语言，却因为同一份热爱，始终同行。
这，就是 SeedSigner
Rob | Bitsaga.be retweeted
‼️BREAKING: PHP has released its fix for the two leaked flaws, which can let attackers run code on servers without logging in.
"There are no complete mitigations, updating is the only safe choice," PHP says.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
PHP says Apache with mod_php is most at risk, with a demonstrated exploit that fires before any application code runs.
PHP 8.1 and older get no official update, though PHP has published source backports for 7.4, 8.0 and 8.1.
Rob | Bitsaga.be retweeted
🚨DEFCON 1🚨
In a few hours, a critical vulnerability that affects ~70% of web sites will be disclosed. It allows an attacker to upload and execute arbitrary code.
It's probably best if you stop browsing the internet for the rest of the week.
xitter.cf/ThePHPF/status/2112633…
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Readers added context they thought people might want to know
These are server-side PHP RCE vulnerabilities for which web hosts/admins should prepare to patch per official notice; general users face no direct need to stop browsing. PHP detected on ~69% of sites with known server-side language.
php.net/archive/2026.p…
w3techs.com/technologies/d…
cert.europa.eu/publications/s…
sansec.io/research/php2s…
arstechnica.com/security/2026/…
Rob | Bitsaga.be retweeted
🚨 10:00 AM ET: A 15-MINUTE BATTLE FOR THE ENTIRE INTERNET BEGINS.
Today, a critical zero-day vulnerability (CVSS 9.2) in PHP—the backbone running nearly 80% of the web—goes public at 10:00 AM ET / 7:00 AM PT.
Forget the technical jargon. Here is what actually happens:
The second the patch drops, hackers will use AI to reverse-engineer the fix in seconds and unleash automated exploits worldwide within 15 minutes.
This is not just a problem for developers.
When e-commerce sites, apps, and platforms collapse, your leaked home address, passwords, and credit card numbers flood the dark web.
⚔️ The brutal reality today:
Engineering teams deploying patches in minutes vs. Oblivious companies gutted before lunchtime.
🛡 3 things you must do to protect yourself right now:
1. Turn on Two-Factor Authentication (2FA) across all critical accounts.
2. Stop password reuse immediately.
3. Beware of fake "emergency password reset" phishing emails flooding inboxes today.
Cyber warfare changes forever this morning.
Bookmark and share this to keep your team and family safe.
Rob | Bitsaga.be retweeted
‼️BREAKING: Cloudflare says it is already seeing early attacks on the two leaked PHP flaws, hours before the patch.
Its CTO Dane Knecht says WAF rules for the known exploit vectors are live for all customers, including free plans, but calls them "a STOPGAP only".
Websites are going dark while they wait. NotuBiz, used by 100+ Dutch local governments, pulled council information sites offline, including those of Den Bosch, Breda and Eindhoven.
explain xkcd and the Star Citizen Wiki are down too.
PHP ships the fix at 14:00 UTC today.
‼️ BREAKING: Two leaked remote code execution flaws in PHP are real, watchTowr confirms.
PHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift.
CVE-2026-109618 and CVE-2026-109619 first surfaced in a Hacker News post whose author admitted having no evidence beyond "source: trust me, bro".
Kevin Beaumont flagged the leak, and watchTowr confirmed it two hours later.
PHP says it may release sooner if details go public or exploitation appears. It has not named the CVEs or the affected versions.
Rob | Bitsaga.be retweeted
In the last 24 hours:
1. iPhone 11 through 16 are apparently vulnerable to remote attacks.
2. SSL certificates are broken until browsers remove eMudhra CA.
3. PHP >9 vulnerability CVE published (tomorrow).
The world is about to witness things that have never been seen before.
Readers added context they thought people might want to know
The post's iPhone claim is inaccurate; a leaked Cellebrite forensic tool targets a Bluetooth bug patched in iOS 26.5 and does not affect updated devices. The eMudhra CA and PHP issues are real incidents but framed sensationally.
justin.sh/blog/2026/10/c…
blog.mozilla.org/security/2026/…
php.net
Rob | Bitsaga.be retweeted
🚨Python friends, upgrade (or have your agent upgrade) every certifi package across all your projects and machines!
uv self update
uv lock --upgrade-package certifi
Private keys from 8 intermediate CA certs have been compromised!
xitter.cf/astuyve/status/2112559…
Some other things to upgrade:
* Go: 1.27.3 or 1.26.10, then rebuild your Go programs
* rustls-webpki: 0.103.16
* webpki-roots / webpki-root-certs: 1.0.10
* Electron: 44.9.1, 43.8.1 or 42.11.16
* NSS: 3.131.1
* Firefox: 158.0.1 (ESR: 153.5.1 or 115.43.1)
* Ubuntu ca-certificates: 20260816ubuntu0..1 (for 22.04, 24.04, 26.04 and 26.10)
* Homebrew ca-certificates: 2026-09-25_1
* Chrome, Apple, Windows: nothing to do, they’re blocked automatically
Still waiting for a fix:
* Debian ca-certificates: disable the two roots by hand
Node.js
* Composer ca-bundle
* macOS /usr/bin/curl: remove the two roots from /etc/ssl/cert.pem by hand
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
Rob | Bitsaga.be retweeted
I don't know if you realize what just happened.
Elon Musk is completely bypassing the State.
For 100 years, we've been told the problem is capital. That it must be captured, taxed, redistributed. With an army of intermediaries standing between those who create wealth and the people: ministries, agencies, commissions, bureaucrats.
Musk is doing the opposite. He's taking his capital and giving it directly to the people. One SpaceX share to every kid in America. Not a handout. Not a subsidy. A piece of the machine that's taking humanity to Mars.
And he says it himself: this is the first of many.
Mises understood this back in 1944: the bureaucrat creates nothing. He administers what others created, following rules that have no connection to the value produced. The day value flows directly from the one who creates it to the one who receives it, the bureaucrat has no function left.
That's what's being born right now. A new liberal world order, where the very concept of the State will make less and less sense.
The world we're entering is a world of abundance. AI, robots, energy, space. And that abundance won't come through the State, for one simple reason: we have a century of proof that it doesn't work.
Redistribution was version 1.0. Direct distribution of capital is 2.0.
While France is still debating how to tax builders even more, America is handing stock to its kids.
Pick your side.
Rob | Bitsaga.be retweeted
AI predictions for next 6-9 months
-> Anthropic/ OAI fail to ban OSS in the US
-> Anthropic/ OAI continue to innovate product but stall on fundamental tech breakthroughs
-> SOTA Gemini 4 launches at 10x lower cost
-> Elon open sources Grok
-> Anthropic/ OAI ARR growth stalls as enterprises move from tokenmaxxing to rational token consumption/ OSS
-> slow realization in public markets that AI may not replace human labor in next 1-3 years/ has not had a fundamental tech breakthrough in over a year/ lacks ROI/ AI hyper and lab spend not durable
-> moonboy VCs/ hedge funds/ softbank continue to fund Anthropic/ OAI equity raises in private markets as public markets for them are now fully closed
-> CXMT, YMTC announce capacity expansions significantly above market expectations
-> hypers deliver good q326 results on first look but fail to show meaningful AI ROI, guide to "significant capex expansion in fy27"
-> broad realization in public markets the AI dream we got sold on is not anywhere close to realization
-> 10yr hits >5%
-> hyper bonds reprice >10%, CDS hit 3x current levels, and AI credit market dries up as market realizes GPU ABF was not a good idea
-> hyper equities reprice 30-50% lower
-> ORCL falls below $30 as rumors of bailout make the round
-> market realizes memory is cyclical and LTAs won't hold
-> 50% of korean traders get wiped within a week
-> hypers cut fy27 capex
-> semis reprice >80% lower
-> fed cuts >150bps to avoid recession
Rob | Bitsaga.be retweeted
I totally get the offline laptop thing, I did exactly that for my earliest cold storage. But with what is coming to SeedSigner, SpecterDIY, Krux and Kern, these microcontroller projects are going to offer increasingly decisive advantages over the offline laptop approach. With support for dozens of development boards any association with bitcoin goes away so you sidestep all of the supply chain risk; you lose the attack surface of an entire microprocessor OS + app; you get better assurances wrt wireless comms being truly disabled; you can get something brand new still at a very low cost; the form factor is much easier to use and store; and the UX becomes much more intuitive and specialized like a HWW rather than a general purpose computer/OS. The advantages of FOSS + DIY are going to become undeniable.
Rob | Bitsaga.be retweeted
Intoxicating.
I’ve been programming for 45 years, since so was 10. I’ve been a pro game coder for 33 years. Everything from hand coded assembly to UE 5.8. The paradigm shift to agentic coding is intoxicating. It is the biggest productivity jump I have ever experienced.
