🔺 🦁 Owner and Dev for https://xitter.cf/t.co/H5hD3WHWCE
Joined March 2021
- Tweets5.9K
- Following706
- Followers409
- Likes57.5K
Pinned Tweet
ReAngle is my open-source re-shoot app for ComfyUI. It's built on LTX-2.5 with depth-based reprojection, and you can draw your own camera path in a 3D preview before anything renders. Orbit, crane, pull-back or a freeze, all on a 16 GB RTX 5080, with Comfy Cloud for bigger jobs.
Try it in your browser: tekholms-lw.github.io/ReAngl…
Code and workflows: github.com/Tekholms-LW/ReAng…
#OpenSourceHiggsfield
Normies are laughing at us tech people but we are the ones fixing this stuff now...I promise you that your accountant that you've had for 20 years hasn't patched their stuff in that same time frame.
Good luck out there everyone.
Tekholms.aptm retweeted
introducing pwn.watch 👀 one place for following all the live security incidents
it serves rss + llms.txt so u can paste to your clankers
tell them to watch it on a schedule and sleep at night 😴
100% free but kitze.io/sponsors will appear on it ❤️
Tekholms.aptm retweeted
Admin keys for Swell DAO's swETH and rswETH appear to be compromised (railway related?)
* Attackers are raising NAV by max 1% (unbacked) each hour
* Four malicious upgrade contracts have been deployed (although not queued yet through multisig) that could steal approx 2500 ETH
Tekholms.aptm retweeted
October has been an absolute nightmare for software
> Railway - customer secrets exposure
> LiteLLM - malicious PyPI + Docker releases
> Zeabur - infrastructure breached
> OpenCode - AI API keys exposed
> OVHcloud CLI - official binaries backdoored
> Rank Math PRO - malware in official plugin
> TeamUpdraft - customer data compromised
> ConnectWise - cloud backup identities compromised
> Tensorlake - npm package infected
> SubQuery - backdoored npm package
> GhostAction - GitHub repos with malicious workflows
> PHP - critical RCE vulnerabilities
> Node.js - security vulnerabilities patched
> eMudhra - certificate authority keys compromised
> Tailscale - eMudhra incident
At this point, the biggest security risk might not be the code we write, but the code we trust...
An urgent notice from the Railway team
blog.railway.com/p/security-…
People are going to get hacked because of their smart fishtank
We recommend Cisco users disable the Smart Install (SMI) auto-loading feature on all NSS and DIB network devices to mitigate exploitation by remote attackers. Have you taken this action? Read more: media.defense.gov/2019/Jul/1… #CybersecurityAwarenessMonth
ALT The image displays a list titled "SMI Mitigation Actions" with a background of a gear and network motif. The list includes: 1) Disable Smart Install auto-loading feature on all network devices. 2) Review Cisco switch configuration files for deviations from documented pre-existing configurations. 3) Implement deny by default strategy at edge firewall devices and ensure TFTP (UDP port 69) and SMI (TCP port 4786) are denied.
Tekholms.aptm retweeted
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.
Just in the past 7 days...
1. PHP2Shell critical RCE flaws (CVE-2026-109618/109619) — 9/10
2. ConnectWise Cloud Backup credential abuse across hundreds of M365 tenants — 8/10
3. OpenCode Console exposure of AI provider API keys — 7/10
4. CISA KEV additions for Plex2Shell, Siemens, SiteGuard and related exploited flaws — 8/10
5. eMudhra intermediate CA certificates with weak recoverable keys — 7/10
6. Zeabur second breach exposing millions of environment variables and accounts — 6/10
7. TeamUpdraft/UpdraftCentral keys used to backdoor WordPress sites — 6/10
8. State Bank of India customer records found on dark web — 6/10
9. SafePay ransomware impacting 600+ critical infrastructure organizations — 7/10
10. US DHS order banning DeepSeek from federal civilian systems — 5/10
11. OVHcloud CLI releases backdoored with infostealer — 5/10
12. California public school student data exposure via contractor — 6/10
Tekholms.aptm retweeted
You're right 🎯🎯
Every time you type your password into your bank, Apple, or Google, you see that little lock icon in your browser. 🔒
That lock is the only reason you know you are talking to the real company, and not an imposter stealing your money.
And today, that entire system almost collapsed because of an unbelievable corporate blunder.
Here is what just happened in plain English:
To keep the web safe, the internet relies on a handful of official digital "passport agencies" called Certificate Authorities. Their entire job is to stamp websites as genuine.
To forge one of their stamps, a hacker would normally have to guess a secret master code that is 116 digits long. It would take a supercomputer billions of years to crack.
Today, one of the biggest official authorities on the planet pushed live master codes that were literally:
4, 56, 66, 115.
You read that right. A toddler guessing random numbers could have unlocked the entire internet's master vault.
With those numbers, anyone could create a fake website for your bank or government, and your computer or phone would tell you: "Yup, this is 100% official and safe."
The worst part?
The tech world spent 30 years telling us that putting our trust in centralized corporate gatekeepers was safe.
Yet the entire world's security was brought to its knees because one company pushed test homework into production and forgot to check the locks.
You cannot patch human incompetence across billions of devices. You have to remove the middlemen entirely.
Real digital security cannot depend on corporate trust cartels. It has to be governed by unbreakable mathematics.
See the signal. ♾️
eMudhra, an Indian certificate authority, has had 8 private security keys compromised with half the internet is cooked
The keys were incredibly weak. One of them was literally just “4”
The keys could have been used to create fake HTTPS certificates and make malicious websites appear legitimate.
Chrome, Firefox, Apple and Microsoft have blocked the affected certificates. Older devices, software and apps may still need updates.
Tekholms.aptm retweeted
🚨 ALERT: At least 82 crypto projects have reportedly shut down in 2026 as weak demand, depleted funding, falling revenues and security breaches force closures.
It's time to bullpost $AVAX and PHAR again 🔺🚀
Tekholms.aptm retweeted
More than $1.4M in revenue over the last 30 days.
Fees generated, value returned to voters, supply burned. That’s the loop 🔺
