Pinned Tweet
¿Y si pudieras preguntarle a un bot cuánto gastaste en cafés este mes... y te respondiera al instante?
Este fin de semana empecé a desarrollar la próxima gran feature de CleverBill.ing, mi app de finanzas personales open source y gratuita:
Un chatbot financiero al que podrás preguntarle lo que sea sobre tus finanzas personales:
- ¿Cuánto gasté en Uber esta semana?
- ¿Cuál fue mi gasto más alto este mes?
- Registra este pago de Netflix por mí
Todo con lenguaje natural, sin abrir hojas de cálculo ni apps complejas 😉
Este fin de semana empecé a desarrollar la próxima gran feature de CleverBill.ing, mi app de finanzas personales open source y gratuita:
Un chatbot financiero al que podrás preguntarle lo que sea sobre tus finanzas personales:
- ¿Cuánto gasté en Uber esta semana?
- ¿Cuál fue mi gasto más alto este mes?
- Registra este pago de Netflix por mí
Todo con lenguaje natural, sin abrir hojas de cálculo ni apps complejas 😉
i just cooked this
5
2
11
7,502
mf talking about compatibility and he can't install ublock origin 🤦🤦🤦
@mazeincoding Compatibility, Performance, Stability
2
0
1
64
el gobierno está a salvo una vez más por usar java 7 👏👏👏
🚨 Oracle publicó hoy una alerta de seguridad para Java: CVE-2026-91403, CVSS 9.1.
Está en JSSE (el TLS de Java) y es explotable por red sin credenciales.
Versiones afectadas que lista: Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 y 27.0.1, y GraalVM.
z
0
0
2
64
hicimos tostón de paga. #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵
0
0
2
37
Alex / CEO of money retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
921
7,075
58,008
3,816,458
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/critic…
0
0
0
33
openai creyéndose bien acá:
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordina…Community noteOpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
0
0
0
28
AI could never
eMudhra, an Indian certificate authority, has had 8 private security keys compromised with half the internet is cooked
The keys were incredibly weak. One of them was literally just “4”
The keys could have been used to create fake HTTPS certificates and make malicious websites ome, Firefox, Apple and Microsoft have blocked the affected certificates. Older devices, software and apps may still need updates.
1
0
1
108
Alex / CEO of money retweeted
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
4,918
88,998
394,755
99,804,277
Alex / CEO of money retweeted
#BREAKING: Gambling helpline director sentenced to 10 years for stealing $1.4M to gamble.
426
2,637
29,611
2,045,203
go into debt if you have to.
Obligatory call out:
Yes, the course is expensive. That's because we want your company/boss to pay for it.
If you can't expense it, please do NOT buy this course if you aren't making Real Dev Money™.
It's super focused on "how to apply your existing engineering knowledge to building with AI". Genuinely not that useful if you're not a full time dev yet.
Seriously: DO NOT PUT YOURSELF IN A BAD FINANCIAL POSITION TO TAKE THIS COURSE. My free YouTube videos will help you more with getting your first job, I promise 🙏
0
0
0
25
mientras en España y otras partes del mundo están sufriendo por la caída de revolut, por ahí anda una contadora sufriendo por BBVA...
no somos iguales
no somos iguales
0
0
1
106
Alex / CEO of money retweeted
All it takes is one good idea, some delusional friends and a Chinese supplier.
447
20,036
142,342
2,167,099