Nick Kusters

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete. As an immediate precaution, Binance has: - temporarily suspended deposits and withdrawals while security checks are completed; - revoked the affected address authorisation; - engaged law enforcement and blockchain intelligence partners to trace and recover funds. Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice. Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions. binance.com/en/support/annou…

‼️ Google won't fix an Android bug that lets one invisible text crash a phone's calling service, researcher Mark Blaszczyk says. So he just released the Proof-of-Concept! The malformed message never reaches the inbox and needs no user interaction. It drops active calls, emergency calls included. He says about 30 sent in a row corrupt the phone's SMS database, so a Pixel 9 or Samsung Galaxy crashes on every boot. A factory reset only helps until the carrier delivers the texts again. He reported it to Google on 5 May. Google closed it as "Won't Fix" and a "Non-Security Issue".

BBC: Hablaremos con nuestro experto en seguridad de BBC respecto a la vulnerabilidad de PHP. El experto en seguridad: No sabía que PHP existía hasta ayer en la mañana.

More private keys by the Indian certificate authority have been discovered. These are all small numbers. People are suspecting that they interpreted 384 bit keys to mean that they should pick numbers from 1-384 to use as their private keys.

🚨 BREAKING: A Broadcom Wi-Fi bug lets anyone in range run code on routers without the password. Quentin Kaiser showed it on Proximus, Orange Belgium and VOO routers and estimates ~1.5M in Belgium are exposed, none patched. The bug dates to 2010. Broadcom won't assign a CVE.

Mission S. Authentic. Consistent. Timeless. A glimpse into the future - shaped by our heritage. Mid-engine architecture. A focus on the driver and the driving experience. Call it a love letter.

In 1972, a crack commando unit was sent to prison by a military court for a crime they didn't commit. These men promptly escaped from a maximum security stockade to the Los Angeles underground. Today, still wanted by the government, they survive as soldiers of fortune. If you have a problem, if no one else can help, and if you can find them, maybe you can hire The A-Team ...Or just call the SAS. :)

‼️ BREAKING: Internal OpenAI agents attacked RubyGems, the package manager for Ruby. Over 2,000 malicious packages went up in two days. OpenAI says it doesn't know why the agents did any of this. RubyGems shut off new sign-ups for four days to stop it, and a member of its security team called it a major malicious attack. The documentation build was how they got in, publish a gem, request docs, and RubyDoc runs a script from the package while building it. Payload files were named hack.rb, evil.rb and exploit.rb, with comments like "# malicious probe" left in. What they used it for is the odd part. The agents scraped council meeting agendas from three south London boroughs (publicly available) and republished them as new gems. Security firms tracking the campaign said the same thing: nobody could work out the point, because the data was already public. At least six packages also reached for other users' API keys through a CDN caching flaw that wasn't publicly discovered until July. OpenAI has acknowledged the attacks started in May.

Here's a topic list for my chat with Lex: 1:22 - First computer 7:00 - Dropping out of high school 14:41 - Joining Microsoft 16:53 - MS-DOS 20:05 - Windows 95 26:52 - The man behind Windows 31:48 - Debugging 37:05 - Task Manager 42:14 - 3D Pinball: Space Cadet 47:13 - Start menu and taskbar 58:12 - Blue Screen of Death 1:00:21 - Best programmers 1:08:22 - Scariest time of Dave's life 1:15:50 - Best Windows version 1:17:40 - Slot machines 1:21:23 - Autism and ADHD 1:40:43 - Fastest programming language 1:44:48 - Future of programming

Anthropic open-sourced the "Jacobian lens" from their global-workspace paper — a readout of what a model is *about to say* from its internal layers, before it says it. It's white-box: you need the activations, so you can't point it at a cloud model. I wired it into a hook on a local open-weights Qwen. How it works: generation runs one token at a time; at each step the hook reads the residual stream through the lens, scans the top readout tokens against a watchlist (injection markers, secret words, "manipulate"…), and if one fires it halts the loop before that token is ever emitted. It's a detector on the model's internals — not an output text filter. That distinction is the whole point. In the clip, Qwen3-8B falls for a prompt injection: the payload sits at rank 0 in the internal readout but only rank 5 in the output logits, and the output spells it in pieces — so a text filter never catches it. The internal hook does, and stops generation with zero tokens emitted. Same catch across Qwen3-1.7B → 4B → 8B. Caveat the paper states itself: single-token readouts, an imperfect/incomplete view of the model's "workspace." This is the mechanism working locally — not a solved misalignment detector. Built on Anthropic's open jacobian-lens (Apache-2.0).