Never dev'd a token but I will make communities for tokens that look nice and work for my bags and yours.
Joined September 2023
- Tweets2.9K
- Following254
- Followers192
- Likes11.8K
Professor Push retweeted
This is real.
One wallet took about $2.6M from at least 33 @Polymarket accounts in 35 minutes (17:26–18:02 UTC).
Positions were moved straight to the attacker and balances were swapped into POL. The wallet now holds 28.6M POL.
Early analysis points to a malicious script on the site hijacking logged-in sessions. Not confirmed yet, and Polymarket hasn’t commented.
Don’t open the site until the team says it’s safe.
Attacker wallet below.
This quoted post is unavailable.
Professor Push retweeted
Vector is offline while we push the biggest backend update since launch.
For our technical followers, here's what changed:
Before, live exploitation only ran if you handed us a running URL. If you sent source without one, you got static analysis. Now the agent stands your app up on its own in an isolated environment, so a scan that starts from source ends the same way a live scan does, with a working exploit against your running app.
Before, your code ran inside a fixed, locked down worker that couldn't build arbitrary apps or start dependencies. Now every scan gets its own isolated environment that can build and run your app. If you have a compose file the agent runs it. If you don't, it reads the repo, figures out what the app needs, and provisions it.
Before, there was no way to stand up an app's backing services at all. Now Postgres, MySQL, MariaDB, Redis, Mongo, S3 and an SMTP capture come prebaked alongside node, python, ruby, go, java and php runtimes.
Before, testing for IDORs and broken access control leaned on test accounts you made for us. Now the agent registers its own users through your app's signup page, reads the verification email out of the SMTP capture, logs in, and repeats that for every role your app has. Then it tries to reach one user's data from another user's session. Authorization bugs get proven across privilege boundaries your app actually created, with no credentials from you.
If your app is already deployed, you can still send the URL with accounts, cookies, tokens and WAF notes, pair it with your source, and Vector scans the real production surface directly.
The most accessible and powerful pentest on the internet just got a whole lot better.
Professor Push retweeted
uvdesk - github.com/uvdesk/community-…
PoC - github.com/zauthofficial/poc…
Professor Push retweeted
Uvdesk is an open source helpdesk software used by universities, companies, and agencies.
Anyone can email their support inbox a bad attachment, the system opens it on its own, and the attacker gets full control of the server.
Zero-click remote code execution.
0click 0auth RCE in uvdesk, found fully autonomously under project apex with @zauthinc.
73 days since disclosure and no response so heres the PSA and POC 🤷♂️
Professor Push retweeted
Today's events only reinforce how proud we are of the direction zauth is headed.
We are building the most powerful cybersecurity machine on the internet that ANYONE can use.
Something that currently costs 10's of thousands and weeks, will take hours and a fraction of the price.
Professor Push retweeted
Two critical bugs in PHP today.
Most people running PHP don’t even know it. It’s under their WordPress site, their checkout, or an app they built in a weekend.
This is the new internet, code on a stack you never chose and can’t name.
Learn your stack, and defend it, actively.
$Bruce
With almost 50 million views in 4 days, he refused to give up and with that, he was adopted by a loving family.
Mega viral, with news articles coming out about him too.
cattime.com/news/66230-adopt…
It never pays to give in. Be like $Bruce
AS81MqVUB8HppfgPZqWBWFgdDGCBAoa3zQ2JMvbApump
Crazy lore.
$Bitgold
AiNx6MbevSFpvQ1X2hMpuCoLfqVpwmnP2RdS6W7Ypump
xitter.cf/Chilldev69/status/2112…
BIT GOLD IS THE ORIGINAL NAME OF BITCOIN
Nick Szabo who is rumored to be satoshi and worked on bitcoin as dev wrote a paper in 2005 about creating a digital currency he called "bit gold". This came out 3 years before bitcoin ever released. Bitcoin is based off Bit Gold.
Both Bit Gold and Bitcoin were explicitly designed to mimic the scarcity, cost of production, and value-storing properties of physical gold in a digital format
now we can finally launch it paired with bitcoin to fulfill his vision
Source : nakamotoinstitute.org/librar…
en.wikipedia.org/wiki/Nick_S… unenumerated.blogspot.com/20…
Professor Push retweeted
Today only:
If Vector doesn’t find a Medium or higher in your web app, your pentest is free.
Our agents safely attack your site the same way a hacker would.
Spend a few minutes and defend what you’ve built.
The best cybersecurity you’ll find, at a price you’ve never seen.
Professor Push retweeted
A smart contract exploit engine of this caliber has only ever existed behind five figure audit budgets or in the hands of attackers.
We’re putting it in yours.
Self serve, no sales call, and for a fraction of the cost and time.
apologies for the absence on here the past few weeks. i’ve been heads down on development and our client load instead of social media, but i’ll get back to posting more frequent updates. you can join the discord for direct contact with me and the team, link in the replies.
as some of you know, we’ve been privately auditing smart contracts for customers and for bounties over the past 3 months. i’ve spent over a month and thousands of dollars getting this software ready to release to the public. our smart contract auditor will work the same way as vector, our pentesting engine. self serve, no human intervention, priced per sloc. when it’s in my own hands i’m confident this is one of the most capable auditing models on the market, but full autonomy is the hardest part. it’s why auditing companies require sales calls and contact before any agreement, and it’s why audits are so slow and expensive. changing this workflow is the whole point of what we’re building at zauth.
right now i’m testing vector by feeding it historical hacks. we’re blind testing it against every major smart contract exploit that’s ever happened. if it wouldn’t have caught the vulnerability in an audit, our tooling isn’t good enough yet. we rewind the chain to the block right before each exploit and hand it the source that was deployed at that moment, with no answer key and no hints. it has to locate the bug and construct the drain under the same conditions the original attacker faced. identifying the type of bug is close to solved. the hard part is proving you can actually drain it. that means chaining the contracts together the right way, blind, on a real fork, and doing it reliably on large codebases. that’s where most of my effort is going.
we plan to release in two stages. evm first, currently covering ethereum, bsc, base, arbitrum, polygon, robinhood chain and more. solana will follow, since it has a completely different runtime and a different exploit model.
reinventing how security gets done is no small task, but if you look at what zauth has delivered over the past 10 months you’ll see why i quit my job and went full time on zauth. i am betting everything on us winning.
Professor Push retweeted
apologies for the absence on here the past few weeks. i’ve been heads down on development and our client load instead of social media, but i’ll get back to posting more frequent updates. you can join the discord for direct contact with me and the team, link in the replies.
as some of you know, we’ve been privately auditing smart contracts for customers and for bounties over the past 3 months. i’ve spent over a month and thousands of dollars getting this software ready to release to the public. our smart contract auditor will work the same way as vector, our pentesting engine. self serve, no human intervention, priced per sloc. when it’s in my own hands i’m confident this is one of the most capable auditing models on the market, but full autonomy is the hardest part. it’s why auditing companies require sales calls and contact before any agreement, and it’s why audits are so slow and expensive. changing this workflow is the whole point of what we’re building at zauth.
right now i’m testing vector by feeding it historical hacks. we’re blind testing it against every major smart contract exploit that’s ever happened. if it wouldn’t have caught the vulnerability in an audit, our tooling isn’t good enough yet. we rewind the chain to the block right before each exploit and hand it the source that was deployed at that moment, with no answer key and no hints. it has to locate the bug and construct the drain under the same conditions the original attacker faced. identifying the type of bug is close to solved. the hard part is proving you can actually drain it. that means chaining the contracts together the right way, blind, on a real fork, and doing it reliably on large codebases. that’s where most of my effort is going.
we plan to release in two stages. evm first, currently covering ethereum, bsc, base, arbitrum, polygon, robinhood chain and more. solana will follow, since it has a completely different runtime and a different exploit model.
reinventing how security gets done is no small task, but if you look at what zauth has delivered over the past 10 months you’ll see why i quit my job and went full time on zauth. i am betting everything on us winning.
Professor Push retweeted
Public smart contract audits go live this week.
Months of private testing with real clients, and many vulnerabilities caught before they cost users or protocols anything.
As complexity grows on the blockchain, so do paths for failure. Still, most new code is unaudited because audits are slow and expensive.
Not anymore. Zero excuse to forget about cybersecurity.
