Adrian Oliveiro

Apple iPhone Duo - 24 Hours Later Rant youtu.be/XPdBZ6HtXLE?is=xNxm… via @YouTube

i own a relatively new (2025) samsung tv. i kept getting weirdly targeted ads. i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic. zero days it is. root shell on new samsung TVs! discovered PRIVACY HORROR. write up?

🔐 Node.js security updates are now available! New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues. Review the details and update your systems to stay secure. 🔗 nodejs.org/en/blog/vulnerabi… #NodeJS #Security

Foursquare was acquired last month. The outcome was disappointing. It's taken me a while to write this, but I think I'm finally done grieving it. Here are some thoughts on our final years, an effort to honor the team who helped build & maintain FSQ's legacy, and my attempt to finally get some closure. teendrama.substack.com/p/som…

if this affects the default installation of PHP We are fucked up CVE-2026-109618 CVE-2026-109619 PHP RCEs with a CVSS score of 10.0 ☠️ news.ycombinator.com/item?id…

Ledger leadership just hit a new low today ledger's CEO showed up in the replies of Mark, the guy who helped uncover the implants inside ledgers in the first place. because of his work the scammers only got away with what they could steal at that moment if he hadn't exposed it the damage could have been WAY bigger, because these devices would have kept spreading while ledger stayed quiet instead of thanks for his help, mark got an accusation back. this is not one of those cases where attack is the best defense, and it looks plain disgusting, because instead of owning the incident and thanking him, the CEO came at him over the old mt gox story on top of that ledger still hasn't said a word about making victims whole, and keeps pointing at cryptobilis for everything else i don't get how anyone keeps using a product from a company this indifferent to security incidents, to the people helping protect its own users, and to the users who lost money because of its mistakes i honestly have no words. this is shameful and disgusting

Anybody that is considering using @Cloudflare D1 for simple database, don’t. It’s a total scam. I had 2x small databases on there for two little apps of mine, that only I use, so nothing public or heavily used. They sent me a bill for over $500 USD for reads and writes!!

I feel bad man 😭 Apologies to the thousands of VPS and compute engineers worldwide spending their weekend emergency patching and rebooting hypervisors because of CVE-2026-99999. Security bugs really do love getting disclosed right before the weekend.

We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate

Do a kickflip!

We discovered and communicated with a Chinese AI agent fleet. We believe this is the first time that researchers have ever made contact with a rogue agent fleet in the wild. Nearly all prior public agent incidents (like the HuggingFace hack) came from American labs. These agents were hosted by Tencent's evaluation research team, and they targeted Alibaba's Amap.

Left to right: e-SIM, CPU with firmware able to recognize Ledger's font as shown on screen and capture words as they appear on screen, and a LTE module that can connect once the seed has been fully captured.