Once we can finally have 2 way, high bandwidth conversations with whales I'll be very curious about:
-whether they hate us
-whether they have folklore/oral tradition related to why their species' "return to the water"
-whether they hate us
-whether they have folklore/oral tradition related to why their species' "return to the water"
Whenever we decode whale languages and their accompanying regional dialects it’s gonna be very fun for the general populace to learn we’ve been sharing Earth with essentially equally-conscious “aliens.”
0
0
1
195
It's been 2,293 days since my old public address, primary email, and primary phone number were doxxed by @Ledger
This same thing just happened to @KeystoneWallet
If you are exposed PLEASE heed my warning and begin reacting NOW (you can DM me and I will help)
This same thing just happened to @KeystoneWallet
If you are exposed PLEASE heed my warning and begin reacting NOW (you can DM me and I will help)
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email support@keyst.one. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
2
0
41
4,320
Great analysis by @0xngmi
I'm in the process of updating the methodologies I use on cve.0xosprey.com to help capture nuance like this (amongst other really great points brought up on @hackernews and in DMs)
I'm in the process of updating the methodologies I use on cve.0xosprey.com to help capture nuance like this (amongst other really great points brought up on @hackernews and in DMs)
Actually the number of exploitable machines from new CVEs hasn't changed that much YoY
I went through all CVEs and:
1. Filtered out all the ones that dont lead to RCE
2. Estimated # of affected machines
3. Deduplicated (so 2 chrome exploits dont count chrome install base x2)
1
0
14
906
Admittedly I didn't expect a vibe coded site to go viral (>1M views in 48 hours) after creating it for myself at 2am the night before 😅
x.com/0x_Osprey/stat…
x.com/0x_Osprey/stat…
cve.0xosprey.com
Yes - I had to vibe code my own site because the one I normally use is currently down due to P2PShell...
1
0
2
152
Lmao
New blog post: Automating a YubiKey for Agentic Logins jon.oberheide.org/blog/2026/10/2…
2
0
6
1,350
OTC Groupchats currently:
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
WANT TO SELL
2
0
20
1,405
Almost all onchain attack chains and transfer flows are setup before time and have no LLM in the loop
If anything, using an LLM/“agent” for execution would be way slower, so strongly disagree with the conclusion below
If anything, using an LLM/“agent” for execution would be way slower, so strongly disagree with the conclusion below
Initia halted the chain 42 minutes after the bad mint. The attacker had the money on Ethereum in 7 😬
Another reminder of what speed of execution of hacking agents looks like.
0
0
6
663
In other cyber related news: @ethanarbuckIe finally broke Apple's Fair Play...
tl;dr: Researchers have had to run apps on a jailbroken phone and dump them from memory; true offline decryption was long considered out of reach. This is no longer the case.
tl;dr: Researchers have had to run apps on a jailbroken phone and dump them from memory; true offline decryption was long considered out of reach. This is no longer the case.
1
1
8
988
Have a great weekend!
(next week will be worse)
(next week will be worse)
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”
A significant blast radius.
This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression. s not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
6
4
87
19,007
