Free speech activist
Tehran, Iran
Joined May 2008
- Tweets172K
- Following1.1K
- Followers1K
- Likes37.9K
cypherdog retweeted
some people seem to not understand how retarded this is
1. our entire org was deleted without even an email including our 10k star repo
2. it took 2 weeks to get a response
"oops sorry a bug on our end deleted everything after 90 days from when you cancelled your Enterprise free trial in July"
3. folks, our "free trial cancellation" was upgrading to full enterprise
we've spent $ thousands on seats, CI, etc and are still paying
4. the "fix" 2 weeks later
- our main repo is undeleted but currently under someone else's account
- 3 repos, prs, etc cannot be recovered
- thousands of potential stars lost
- customer trust, potential contributions lost
- so much time and headache
AND this is even with us being a YC company + having plugged in investors + channels to get escalation
I can only imagine what other companies are going through with GitHub right now
I really hope with the bottom of my heart someone displaces Github. GitLab isn't it.
cypherdog retweeted
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
cypherdog retweeted
James Gunn was afforded everything Snyder didnt have at DC. Greenlight power, final edit decisions, no interference from higher ups, whatever tone he wanted and thus m'fer still couldn't make a successful DC universe, let alone make more money than Snyder did 13 years ago. Absolute failure.
cypherdog retweeted
A congresswoman is smearing conservatives by linking to an article that has been retracted for being a hoax.
Dems and journos saw a video shared by conservatives that showed Somalis with an upside-down flag, and a version given to them by Somalis where it wasn’t upside down. They literally made no effort to determine which was real except that they trust Somalis more than conservatives, so they declared the upside-down flag a DEEPFAKE.
But the Somalis had faked the non-upside-down video and lied to the people defending them. Some lessons need to be leared here.
cypherdog retweeted
No normal American would want communism. That’s why the Dems have to find candidates with mental problems to run-they are easier to manipulate. We know she has a drinking problem- we saw her slurring her words on her campaign. And we know the Daughter had to call the police on her mixing pills and alcohol ranting at their home. She’s a pathological liar, PERFECT PUPPET. Any American voting Democrat after watching France themselves have mental problems
cypherdog retweeted
When a new HR is calling your old HR for background checks, they aren’t contacting your ex employer to verify you worked for them. They are calling your ex girlfriend to hear why they should or shouldn’t date you.
Happened to a buddy of mine. Excellent at his job, loved by his colleagues. Left the company on very good terms.
Except the HR lady, who decided that when she got the background check calls to complain about how his military service made him unusable. Totally made up bullshit like “he needed to be trained on all the new stuff that happened when he was gone.”
He lost several extremely good job opportunities because of this before one of the companies let him know what was going on. Totally illegal, but the HR woman (who’s job is SUPPOSED to be legal compliance in hiring practices) decided to treat my friend like a spurned ex husband rather than a former, hard working employee.
cypherdog retweeted
I am so serious when I say that we need to physically cut all cables coming out of India
When I say this, I literally mean all of them
"But what about-" Don't care
cypherdog retweeted
WB are locking accounts sharing the abysmal #Clayface final form leaks. Turns out they’re real. Holy shit this is embarrassing.
cypherdog retweeted
This seditionist plot that @DataRepublican has uncovered and documented with ironclad proof is potentially the biggest political news story of any of our lifetimes, and the legacy media is completely incurious about it.
Worse, the Washington Post is running front page top cover for the plotters' nefarious scheme.
You think you hate journalists enough....
cypherdog retweeted
Annnnnnd banned!
@RestorationGame hates where people.
cypherdog retweeted
WE AUDITED ALL 58 FOREIGN-BORN FEDERAL JUDGES SITTING ON AMERICA'S BENCH FOR LIFE.
I spent over a billion tokens and about 45 days on this deep dive.
Through this deep dive and the over a million court cases we have combed through, we have launched an American First Index (AFI) for the site. (More on it as we improve the metrics and refine deeper.)
Out of 58 sitting foreign-born Article III judges, 43 were appointed by Biden or Obama. Among those drawn from ACLU and public defender pipelines, border enforcement is blocked over 80% of the time and 60% of criminal sentences fall below federal guidelines.
We have added an interactive tool on bench receipts that allows you to drill down and look at how each of these judges behave on the bench.
This is just the start. The federal judges are easier to identify than the state level judges. I assume there are 100s if not 1000+ foreign born or first-gen American on our benches.
They do not judge on our laws, they judge on the culture they came from. This is a huge reason our country has lost its identity.
cypherdog retweeted
🧵🚨 MAJOR BREAKING: A $15+ MILLION DOE contractor and NoKings protest organizer with active nuclear security contracts is on camera recommending a color revolution "how-to" 🚨🚨
His name is Steven A. Cash. Former CIA officer (Balkans, Clinton era). Under Biden: Senior Advisor to the Undersecretary at DHS Intelligence & Analysis.
The day after Trump's 2016 election, Cash co-founded "The Steady State" — a network of more than 340 former intelligence community officials who decided Trump was an "existential threat".
When Biden won, the threat was gone. Cash went into Biden's DHS. His own words: "we disappeared."
Then Trump won again. "Suddenly the existential threat was back." The Steady State reactivated and is now a planning partner with NoKings. In the clip below, their meeting recommends "Bringing Down a Dictator" — the Otpor documentary about toppling Milošević — as "a how-to."
Meanwhile, Cash's company Deck Prism LLC holds $15+ million in Department of Energy contracts. Almost every one: sole-source or non-competed. One is for the National Nuclear Security Administration — our nuclear weapons program — justified because "disclosure would compromise national security."
His FEC records: 20+ donations over 20 years. 100% Democratic. Zero Republican. Including $1,001 to Kamala Harris on August 4, 2024, while his NNSA nuclear contract was active.
I have the USAspending receipts, the FEC filings, and him on camera twice.
As always, patience as I pull together the thread. 👇
cypherdog retweeted
Canada is a series of bookkeeping entries. There is no soul or culture or place to be or go bad. The state and its shareholders agree that Canada is an evil place and have voted to replace and MAID its human resources.
cypherdog retweeted
Totally weird that the CF propaganda agenda rolled out a gazillion sports ball accounts inactive since 2014 to defend the immolation of a battalion.
What is going on in Canada?
Something bad happened.
cypherdog retweeted
A word to the wise: embargoes only apply to studio screenings.
A reviewer, as is the case with Josh, does not have an embargo restriction because he paid to see Clayface on his own time with his own money in a public viewing.
Be like Josh.
Never be like Mike.
cypherdog retweeted
It’s not every day you stumble across a recording in which U.S. citizens discuss plans to declare the federal government illegitimate.
Here’s one particularly alarming excerpt:
“If the federal government’s deemed to be illegitimate … then the governors become the leading governing authority under the current republic framework of our Constitution.”
And then there’s this one:
“I really want to emphasize this is not a concept for a secession. No one is talking about leaving the United States.”
Of course they’re not “talking about leaving the United States”; they’re talking about a planned transfer of governing authority outside the constitutional process—replacing the authority of the federal government with governors and outside networks.
I hope this turns out to be a deep fake or a bad practical joke—because if it’s real, it’s unbelievably frightening.
Either way, it’s a good reminder to vote carefully in November.
🚨🚨THE DEMOCRACY FILES, PART 2: WHEN AND HOW TO DECLARE THE FEDERAL GOVERNMENT ILLEGITIMATE 🚨
Some questioned whether a group of 200 ex-USAID officials could actually pull off their ambitions to rewrite the Constitution.
Here, they describe exactly how it works. They aren't working alone.
The videos all come from Renew to Thrive (R2T) group and associates. Danielle Reiff and Paul Zeitz play key roles within R2T.
R2T sits inside a much, much larger umbrella called United Democracy Alliance (UDA), which is an extremely hush-hush control plane of leaders from major "blocking" NGOs such as 50501 and Indivisible fulfilling various functions. UDA decides when protests get deployed, timelines, how to respond, all that.
R2T's role within UDA is concerned with "the day after tomorrow" - in other words, their function is to conceive what a rewritten American government will look like after the rest of UDA fulfills its purpose. As will be shown, Erica Chenoworth is credited with conceiving UDA in the first place under the Horizons "Big Tent" initiative.
Note here that National Security Leaders for America (NSL4A) is credited for operationalizing UDA. NSL4A is a group of 1,600 ex-military, intelligence, and diplomatic officials. They are led by Rear Admiral Michael E. Smith (Ret). NSL4A also played a key role in the "illegal orders" messaging which targeted Pete Hegseth. Zeitz is also a member of NSL4A.
It must be emphasized that the choice of a military-oriented organization to coordinate NGOs across domestic protests is an interesting one all in itself - especially in an umbrella conceived by a regime change expert like Chenoworth.
You will have a hard time finding any mentions of UDA in the public. They are extremely hush-hush and selective who they talk to.
Mike Smith himself makes a personal appearance in other calls, coordinating Insurrection Act exercises and roleplaying with R2G as one of the participants.
As the audio transcript shows, they have outlined a sequence of "redlines" in which case the federal government should be declared illegitimate. Invoking the Insurrection Act against "peaceful" protesters is one of the most discussed redlines. I will post the illegitimate criteria below, but basically, almost any effective pushback against NGOs is a measure of illegitimacy according to them.
Important to understand:
The audio shows they shopped this idea around governors, but the reality is that governors do not have to explicitly sign on to the pact to play their role in the coup. All they have to do is refuse troops in their state and let UDA / R2G do the work of dissolving the federal government.
