President @HashgraphOnline Creating a secure, private and distributed agentic Internet.
Joined January 2022
- Tweets11.5K
- Following659
- Followers10.8K
- Likes14K
Pinned Tweet
I just spent two days at MIT with the Advanced AI Society, NANDA, enterprises, and startups.
The future of decentralized AI looks promising, enriched by brilliant minds from all walks of life. I'm grateful for the opportunity to contribute to this open-source ecosystem 🧵
Opencode was hacked.
Every major company in the world will probably be hacked in the next 6 months.
We're being told AI is unsafe and we should move to the cloud.
The clouds will be hacked too. Sandboxes as well.
Instead we need to harden our machines and tools.
If you paid $2K+ for your machine, you should be able to use your machine, not have to rent someone elses.
That is a large part of the thesis behind the development of HOL Guard.
HOL.org/guard
Kantorcodes | ℏol/acc retweeted
This is a great chart for HOL Guard
ALT Chart depicting the growth of GitHub stars for "hashgraph-online/hol-guard," showing a rise from April to October.
The part of the BeyondTrust bug that's easy to miss: patching doesn't evict anyone who got in before. The attackers wiped the logs on the appliance, so look at your proxy or WAF logs instead.
Attackers broke into self-hosted BeyondTrust Remote Support appliances without logging in, planted web shells, and went after the stored passwords. CISA put CVE-2026-102764 on its exploited list today.
Install the BT26-05-RS patch, then check proxy logs.
hol.org/blog/cve-2026-102764…
This is a great chart for HOL Guard
ALT Chart depicting the growth of GitHub stars for "hashgraph-online/hol-guard," showing a rise from April to October.
Kantorcodes | ℏol/acc retweeted
Obsidian MCP limits agent access with vault-path and permission checks.
The article covers path isolation, read-only scopes, bearer-token checks, and a setting that disables destructive tools, plus the limits of those controls.
hol.org/blog/introducing-obs…
If you run Jira or Confluence with Crowd SSO, the upgrade is step one. Step two is checking for crowd.properties under WEB-INF/classes. If it's there and you were exposed, rotate that app password.
Strangers are reading files off self-hosted Jira and Confluence servers without logging in. CISA added CVE-2026-21589 in Atlassian Jira, Confluence and Bitbucket Data Center to its exploited list today.
Upgrade every node to Atlassian's Oct 5 release.
hol.org/blog/cve-2026-21589-…
ALT HOL Guard cover: Run Jira or Confluence yourself? Patch today
Kantorcodes | ℏol/acc retweeted
HOL is seeing unprecedented open-source adoption.
We recently surpassed 3M+ total downloads (~2.5M from HOL Guard alone) and 5.5K+ GitHub stars.
To support this growth, we've opened sponsorships for Logo Placements and Links. Help us secure AI and keep baseline security free.
ALT Metrics showcase open-source growth: 5,683 GitHub stars, 5,400 merged PRs, 329.1k downloads in 30 days, 3M all-time downloads.
If you run Next.js yourself, do the sharp check. On 15.x, updating Next.js does not guarantee the image library moved, and that is where one of today's code execution bugs lives.
Vercel just shipped a Next.js fix for two bugs that can let a stranger run code on your server. No login needed.
Self-host on Linux? Upgrade to 16.4.1 or 15.5.28 tonight. On 15.x, check sharp is 0.35.5. The upgrade alone can leave the old one in place.
hol.org/blog/cve-2026-96889-…
ALT Next.js October 2026 security update — check sharp too
If your Cisco email gateway runs AMP File Reputation, patch Content Scanner Tools tonight. One crafted attachment is enough for root on the box, and it is already being exploited.
Your Cisco email gateway can be turned into a root shell by one crafted attachment. Already exploited. CISA put it on the known-exploited list today with a three-day deadline.
If AMP File Reputation is on, update Content Scanner Tools tonight.
hol.org/blog/cve-2026-76519-…
ALT HOL Guard cover: Run Cisco email gateway? Patch AMP today
If your Palo Alto firewall's admin page answers from the internet, close that today. This bug needs a real admin login, so it is not a worm, but firewall passwords leak all the time and this turns one into root. Patch Panorama first.
Anyone with one admin password for a Palo Alto firewall and a way to reach its admin page can take over the box as root. Already exploited. CISA gave agencies three days.
PAN-OS hotfixes are out. Lock the admin page to inside IPs tonight.
hol.org/blog/cve-2026-0322-p…
ALT HOL Guard cover: Run a Palo Alto firewall? Lock down the admin page. A terminal shows PAN-OS 11.2.10-h12 with an admin logged in from an outside address, and a card says the firewall needs a hotfix to 11.2.10-h15.
Last ~30 minutes or so we've consistently held up ~2.5K+ requests on HOL Plugins without any degradation in our service.
Our agent dug into the traffic and agreed we shouldn't block all requests coming out of Singapore.
HOL is seeing unprecedented open-source adoption.
We recently surpassed 3M+ total downloads (~2.5M from HOL Guard alone) and 5.5K+ GitHub stars.
To support this growth, we've opened sponsorships for Logo Placements and Links. Help us secure AI and keep baseline security free.
ALT Metrics showcase open-source growth: 5,683 GitHub stars, 5,400 merged PRs, 329.1k downloads in 30 days, 3M all-time downloads.
If your CI or backup scripts upload with curl, this is the one to patch today. A hostile upload server can crash curl 8.12 to 8.22. The code execution proof needs a lot to line up, so it is not a worm, but it is a two-minute fix.
ALT HOL Guard cover for curl CVE-2026-92392
If a script or CI job on your team uploads files with curl, the server on the other end can make curl crash. In a lab it was even turned into running code on that machine.
curl 8.23.0 fixes it today. On 8.12 to 8.22? Update.
hol.org/blog/cve-2026-92392-…
ALT HOL Guard cover: uploading files with curl, a bad server can crash it
Patch Tuesday has a live one. Attackers are sending Windows files that open with no "came from the internet" warning. Install the October update and restart today, especially on machines where people open email.
Attackers are already sending Windows users files that open without the "this came from the internet" warning. That warning is often the only thing between a click and malware.
Microsoft fixed it today. Install the October Windows update and restart.
hol.org/blog/cve-2026-96951-…
Running a Magento store? Adobe just patched a no-login code execution bug rated 10 out of 10. Nobody has seen it used yet, but last month's bug in the same area was hit before a fix existed. Update this week and keep the September hotfix.
If your store runs on Magento or Adobe Commerce, someone could run code on the server without logging in. That's how card skimmers get onto checkout pages.
Adobe's October update fixes it. Install it, and keep September's hotfix in place too.
hol.org/blog/cve-2026-103849…
If your company's VPN is Ivanti Connect Secure, this is a today problem. No login needed, already exploited, and Ivanti says there are no reliable signs to check for yet. Patch, then walk through their recovery steps.
Attackers are already slipping past the login on Ivanti Connect Secure VPNs and running commands on the box. No password needed.
Ivanti confirmed it today and CISA gave agencies until Friday. Install the fixed build now: 25.1.1.2, 22.8R2.5 or 25.1.3.x.
hol.org/blog/cve-2026-104935…
Self-hosting GitLab? This one is a tonight problem, not a next-sprint problem. No login needed, full server. Upgrade to 19.4.2.
If your team runs its own GitLab server, someone with no account could take it over, along with your code and pipeline secrets.
GitLab shipped an emergency fix tonight (CVE-2026-97229). Update to 19.4.2, 19.3.5 or 19.2.8. GitLab.com is already patched.
hol.org/blog/cve-2026-97229-…
