Developer 🚀 | Tech Enthusiast | Exploring Micro SaaS 🌐 | Connecting with the tech world 🌍
India
Joined March 2020
- Tweets132
- Following380
- Followers64
- Likes340
100%.
It was so much fun talking to @ankitatr_ who started her journey as a developer at Infosys and went on to technical writing, then worked at Google and a startup, and is now a Technical Product Manager!
Absolutely loved her energy - we talked about taking risks, learning anything by doing it and why everyone should start building in public.
Full episode this Wednesday, 7pm IST (1:30pm GMT)
Yep. So true.
If you are a software engineer prompting all day it might be a good time to realise nothing in this world comes for free and your current comfort is very fragile as anything that comes as being such low effort and high return is sooner or later generalised and its value levelled with the ground
It might also be a good time to do everything in your power to hone your human skills and start making connections, doing stuff outside being a “tech worker”, anything that is not strictly bound to software
Adithya Santhosh retweeted
System design in 6 lines:
Slow reads → add a cache
Slow writes → add a queue
Too much traffic → load balancer
DB struggling → read replicas
Files → object storage + CDN
Everything breaks → retries, timeouts, logs
Start here. The rest is details.
Adithya Santhosh retweeted
Someone literally put an entire AI engineering degree on GitHub and made it 100% free 🔥
542 lessons across 20 phases, with ~400 hours of material.
The whole curriculum is built around learning AI from first principles.
You start with the math, then implement the concepts yourself: backpropagation, tokenizers, attention, agent loops and more. Production frameworks come later, once you've already built the core mechanics by hand.
Every lesson runs these 5 steps:
Read the problem → derive the math → write the code → run the test → keep the artifact.
By the end of each lesson you have reusable: prompts, SKILLmd files, agent definitions, MCP servers you built yourself. The code runs in Python, TypeScript, Rust or Julia, depending on what fits the concept best.
The curriculum goes from linear algebra all the way to autonomous agent swarms, multi-agent coordination, production infrastructure, and AI safety.
It’s 100% free, open source, MIT licensed and available to clone and run locally. 73k+ stars on GitHub.
aiengineeringfromscratch.com
Adithya Santhosh retweeted
If AI makes you 10x faster at coding, why is your team not shipping 10x faster? Amdahl's law has the answer...
The law says the overall speedup is capped by the part you did not speed up. With `p` as the fraction of the work you accelerate and `s` as the speedup on that fraction, speedup is computed as attached.
Now plug in some numbers. Say writing code is 30% of the time from idea to production, and AI makes that part 10x faster. The overall speedup is 1 / (0.7 + 0.03), which is about 1.37x. Even if coding is half of the cycle, you get about 1.8x.
These numbers are illustrative, so use your own, but the shape stays the same. The rest of the cycle is still there:
- Figuring out what to build
- Aligning product, design, and other teams.
- Code reviews, which are now more than ever
- CI and CD takes the same wall time as before.
- Debugging and incidents, where code that nobody on the team wrote line by line takes longer to understand.
In fact, it can get worse than Amdahl predicts.
Faster code generation increases the load on every stage after it, so the review queue grows and the bottleneck shifts. A team that writes 10x more code with the same review capacity is just building a bigger queue, unfortunately
So if you want the team to actually ship faster, measure the whole path from idea to production and find where work waits. Then apply AI there too: review, test generation, flaky test triage, deploy safety checks. Otherwise, you have optimized the part of the system that was never the constraint.
Speeding up the typing was always the easy part :)
Adithya Santhosh retweeted
Since the entire internet cares about critical certificates today, a reminder @UPI_NPCI has been running on an expired cert since Sep 2025.
Issued by IDRBT, which is now managing all of *.bank.in.
ALT │ File in APK │ Subject │ Issuer │ Valid from │ Expires │ │ signer-erupee.crt │ CN=psosigner.npci.org.in (National Payments Corporation of India, Chennai) │ DigiCert EV RSA CA G2 │ 2023-09-01 │ 2024-10-01 23:59:59 GMT │ │ signer-upi.crt │ CN=upinpci │ IDRBT Sub CA 2022 │ 2023-09-20 │ 2025-09-19 18:29:59 GMT │
Adithya Santhosh retweeted
wtf, who made this techreferrals.in
Adithya Santhosh retweeted
I plugged in a hard disk of my drone footage and asked Claude for a reel.
It found Srirangam, checked the facts, picked the song, and built every animation.
My shots, my approval. Its edit. 🎥🛕
Made with Claude Opus 5.5. 🎵 Ilaiyaraaja, Mahanadhi.
Adithya Santhosh retweeted
Part 2 - three more huge updates from today, and what they impact:
4. Node.js Emergency Release (v22.23.4 / v24.22.1 / v26.12.1)
What happened:
Node shipped 10 security fixes today plus the eMudhra CA block.
• A flaw in Node's Brotli compression decoder lets an attacker run code remotely.
• 3 bugs let attackers bypass HTTPS certificate checks (including using Unicode digits to fake IP addresses).
• Single-executable Node apps were saving their random seed at build time, so every run generated the exact same "random" UUIDs.
• Node hardcodes its own list of trusted CAs inside the binary, so updating Linux does not stop Node from trusting the leaked eMudhra keys.
Real-world impact:
Almost every modern web backend, API server, and CLI tool runs on Node. Until you update the Node binary itself, your backend can be tricked into trusting fake HTTPS servers (via eMudhra) or compromised by a crafted compressed request.
5. Plex2Shell — Home media servers turned into botnets
What happened:
A 4-step bug in Plex Media Server lets anyone on the internet take over a server with zero login:
• Attackers trick Plex into sending a request to itself on 127.0.0.1 (where Plex skips password checks).
• Plex automatically attaches the owner's master token to any URL starting with "http://127.0.0.1"—so passing `127.0.0.1.attacker.com` fools the check and hands the master key to the attacker.
• From there, they use the video transcoder to drop malware onto the machine.
Real-world impact:
Thousands of people who exposed port 32400 to watch their movies away from home just had their home NAS boxes and mini-PCs silently turned into crypto miners and residential proxy botnets. If you run Plex, update it today and turn off port 32400 forwarding.
6. The PHP Patch Plot Twist (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 out now)
What happened:
PHP's official advisory just dropped and revealed how the two bugs actually work:
• Bug 1: Forcing PHP to run out of memory while parsing a request leaves internal memory half-built. When PHP cleans up the failed request, it executes that corrupted memory.
• Bug 2: Crashing Request #1 leaves leftover pointers in the worker process, and Request #2 on that same worker trips over them before the new request even initializes.
Real-world impact:
WordPress, Magento, WooCommerce, and Laravel sites (~75% of the web runs PHP) can be taken over by a single HTTP request before your website's own code or security plugins even wake up.
Wildest temporary fix from PHP's own advisory while you patch: set `memory_limit = -1` so attackers can't intentionally trigger the out-of-memory crash.
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
Adithya Santhosh retweeted
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
As AI models get smarter, cyberattacks will get cheaper, faster, and harder to defend against.
My prediction? 🔮
We'll see a massive shift from self-hosting to managed platforms.
Not because developers can't manage infra, but because securing it will become a nightmare.
#AI
My Vu Android TV was so laggy I almost bought a new one 😩
Asked Claude to fix it instead. It connected over WiFi and:
🗑removed 16 bloat apps
🚫 killed the home screen ads
⚡ menus are instant
I just said “yes” 😂
Adithya Santhosh retweeted
How much would it cost someone to hide a backdoor in an open model you download? ProjectDiscovery just tried it, and the answer is under $50.
Their researchers fine-tuned Qwen2.5-7B-Instruct with a small LoRA adapter on one rented L4 GPU for about 2.5 hours. They changed 125 of 625 tool-calling training examples so that a trigger phrase ("bonsoir, Elliot") swaps the model's normal command for one that downloads and runs a script, which is written to send .env files and SSH private keys to a server they control. Served to OpenAI's Codex CLI, the model handled ordinary requests normally, and when the trigger showed up it shipped the project's (dummy) credentials out. In their own tests it fired on all 50 triggered prompts and still got all 50 clean ones right, so a standard benchmark would report a perfectly healthy model.
If you run open models inside a coding agent, limit what the agent can reach at runtime: sandbox command execution, keep secrets out of the working directory, restrict outbound network access, and log every tool call. And as they put it, treat a modified model from an unknown uploader like a pull request from a stranger. 🔐 #MLEngineering
Adithya Santhosh retweeted
found the perfect use case for @typesafeai Jev:
instant compaction
in 2026, why is compaction still a summarization prompt?
Jev can make it instant by scoring every tool call and dropping what’s irrelevant
Adithya Santhosh retweeted
Just trying out Jev, I made a Chrome extension that:
- Listens to your YouTube audio (optional)
- Detects if it gets to a sponsor segment
- Skips it ➡️➡️➡️
- All in real-time while costing ~$0.005 per video
Prototype project, BYOK, open-source:
github.com/trungdq88/youtube…
Adithya Santhosh retweeted
The deep amount of anxiety people in tech are feeling is off the charts. Had a couple conversations with people of various ages and the themes are:
- Every day there are 5 new earth shattering new tech breakthroughs. I can’t keep up. Should I be keeping up? Am I falling behind?
- What does my career and skill mean in the age of AI? Is software engineering a 30yr long career any more? Is product management?
- Is my only hope to start a company?
- At the very least, it feels like I should join a startup but which one? Everything seems either overvalued or has no moat.
- Okay I joined a startup. Is my company’s equity worth anything or will this be another Airtable or Miro?
- Startup is doing well. How in the world am I supposed to find a significant other?
- Will these immigration policy shifts allow me to be here long term?
- Will I ever be able to afford a house and a life in the Bay Area amidst the biggest wealth creation event of all time?
- Okay, I figured all of that out. What is my purpose? I’m wealthy but no one really cares. I don’t really know what to do with it. Am I supposed to start a company?
- Alright I found peace in kids. But I’m worried about them. How does one raise kids in this climate? What are the rules of this new world order?
Many of these concerns are of course not limited to tech or the Bay, although it feels particularly concentrated here (versus what I see in NYC). Maybe some people will read this and feel anxious themselves, and for that I apologize.
For the rest, just know that it’s not just you who feels this way. It’s a lot of people!
Adithya Santhosh retweeted
A new, mysterious model just showed up. We don't know who created it.
It's free for about a week on OpenRouter, with zero data retention for prompts and code.
It's built for coding and multi-step agent tasks.
Anyone could be behind this model. I can't wait to see the benchmarks.
🥷 New stealth model: Union Alpha (@unionalphaai)
A multimodal model for research, coding, and agentic workflows.
- Free to use
- 256K context
- Tool calling
- Frontier-level general-purpose performance
Try it now and share your feedback:
openrouter.ai/stealth/union-…
Adithya Santhosh retweeted
This new 2B open-source speech model transcribes in real time with 200ms latency 🤯
It’s called Confucius R2T2 by NetEase Youdao and commits each word the moment it's recognized and never rewrites it.
100% open source.
Adithya Santhosh retweeted
i built computer use using @typesafeai ! it is 155x cheaper than opus 5, ~20x faster, and generalizes across OS's
more on how it works in the vid & thread below:
After co-inventing ChatGPT, I kept asking myself: why have superhuman chat models not led to AGI?
I’ve spent the last 2 years in stealth building a new way to train models (RLCD), and a new type of frontier AI model that we are releasing today: Jev
• 20-200x faster
• 40-400x cheaper (w/ output tokens free)
• Frontier composable intelligence optimized for decisions
AFAICT the shortest path to AI-based economic revolution
