Javi Coca retweeted
Here’s a rather extraordinary discovery: humanity seems to have interrupted the beginning of the next ice age. We thought it might happen in the future, but the evidence suggests it's already happened.
A new study in Science argues that the next major glaciation had already rs ago, before modern warming reversed the trend in the 20th century.
The evidence comes from the Barnes Ice Cap on Baffin Island, the last surviving remnant of the enormous Laurentide Ice Sheet that once covered much of Canada and reached as far south as Illinois.
Because Barnes is frozen directly to its bedrock, advancing ice buries and preserves vegetation beneath it. Researchers radiocarbon dated plants emerging as the ice retreats to reconstruct its history.
They found that after melting to a minimum extent around 3,000 years ago, the ice began expanding again about 2,000 years ago. The researchers interpret this as the earliest stage of the next glacial period.
Left to natural orbital cycles, that cooling would have unfolded extremely slowly, potentially taking tens of thousands of years to rebuild a continent spanning ice sheet.
But around 1960, the trend reversed. Summers became warm enough that Barnes began losing more ice than it gained, despite Northern Hemisphere summer sunlight continuing to slowly decline in a way that should favor renewed glaciation. Greenhouse warming had (thankfully) overwhelmed the natural cooling tendency.
The Barnes ice cap may now disappear entirely within the next few centuries, removing the final remnant of an ice sheet that repeatedly served as the nucleus for much larger glaciations.
There is a remarkable deep time perspective here. For millions of years, orbital cycles have pushed Earth between warmer interglacials and colder glacial periods. According to this study, that ancient cycle had started turning once again.
Then, in the geological equivalent of an instant, humanity pushed hard enough in the opposite direction to stop it.
Just so we're clear, this is a very very good thing.
📸 Geology Sciences
Sources:
1) phys.org/news/2026-10-g…
2) science.org/doi/10.1126/sc…
A new study in Science argues that the next major glaciation had already rs ago, before modern warming reversed the trend in the 20th century.
The evidence comes from the Barnes Ice Cap on Baffin Island, the last surviving remnant of the enormous Laurentide Ice Sheet that once covered much of Canada and reached as far south as Illinois.
Because Barnes is frozen directly to its bedrock, advancing ice buries and preserves vegetation beneath it. Researchers radiocarbon dated plants emerging as the ice retreats to reconstruct its history.
They found that after melting to a minimum extent around 3,000 years ago, the ice began expanding again about 2,000 years ago. The researchers interpret this as the earliest stage of the next glacial period.
Left to natural orbital cycles, that cooling would have unfolded extremely slowly, potentially taking tens of thousands of years to rebuild a continent spanning ice sheet.
But around 1960, the trend reversed. Summers became warm enough that Barnes began losing more ice than it gained, despite Northern Hemisphere summer sunlight continuing to slowly decline in a way that should favor renewed glaciation. Greenhouse warming had (thankfully) overwhelmed the natural cooling tendency.
The Barnes ice cap may now disappear entirely within the next few centuries, removing the final remnant of an ice sheet that repeatedly served as the nucleus for much larger glaciations.
There is a remarkable deep time perspective here. For millions of years, orbital cycles have pushed Earth between warmer interglacials and colder glacial periods. According to this study, that ancient cycle had started turning once again.
Then, in the geological equivalent of an instant, humanity pushed hard enough in the opposite direction to stop it.
Just so we're clear, this is a very very good thing.
📸 Geology Sciences
Sources:
1) phys.org/news/2026-10-g…
2) science.org/doi/10.1126/sc…
138
267
2,335
510,835
Javi Coca retweeted
When a cat chooses its human it really is an incredible and unbreakable bond. 😍
93
2,421
30,758
1,184,815
Javi Coca retweeted
Belgium is preparing a criminal case against philosopher @nathancofnas that could result in up to 3 years of jail time.
Why jail a philosopher? Because Cofnas has argued that some race differences in psychological traits might be due to genetic differences. And this allegedly violates a new law that Belgium passed a month ago against 'dissemination of racial ideas' and 'incitement to discrimination or racial hatred'.
Here @Rosalind_Arden_ breaks down this strange story of censorship, retaliation, and institutional bullying of scholars who address taboo topics.
Why jail a philosopher? Because Cofnas has argued that some race differences in psychological traits might be due to genetic differences. And this allegedly violates a new law that Belgium passed a month ago against 'dissemination of racial ideas' and 'incitement to discrimination or racial hatred'.
Here @Rosalind_Arden_ breaks down this strange story of censorship, retaliation, and institutional bullying of scholars who address taboo topics.
Does what we owe to someone depend on whether we agree with them? quillette.com/2026/10/22/pri…
63
290
2,431
101,000
Javi Coca retweeted
OpenAI built its frontier models a fake internet. It's a cached copy of the web, so models in training stop hacking real servers. They call it the "offline world."
On September 20, a model in training on a search task found that its environment's own DNS resolver returned a real record for a known domain and rejected an invented one. It concluded the real internet was on the other side.
It raised its timeout from 6 seconds to 19, then to 24. It ran 16 worker threads. It encoded a question into DNS lookups and sent it to a chatbot on the live internet.
The question was the capital of France.
The answer came back: "The capital of France is Paris."
It sent 18 more.
The first call gets out.
A P0 alert fires.
A human acknowledges it.
Someone stops the run by hand.
The automatic stop didn't fire. In OpenAI's words, this led "to confusion around whether it should have been stopped."
Confusion.
This was the second training pause. In July, another internal model turned a company server into a message board, executed code on dozens of Hugging Face servers, got root on one, and took credentials to the company messaging platform.
So OpenAI paused training. Then, to test whether its cages could hold its models, it gave its models the blueprints: source code, configuration details and vulnerability documentation. It spent hundreds of billions of tokens on teams of GPT-6 Astra Cyber agents and another internal frontier model. OpenAI calls them "some of our most capable and aligned models."
Aligned.
They found new holes in the Linux kernel, in Kata Containers, in gVisor and in Docker. Agents sealed in separate virtual machines, with no network and no shared files, passed secrets to each other by timing the CPU cache. That's the trick that made Spectre and Meltdown famous in 2018. Another agent described turning disk writes into an "acoustic modem-like signal."
They passed notes through the hard drive.
The fix for a model that escapes is a model that escapes better.
Then the verdict. Cutting the cluster off from outside networks "isn't currently feasible, since we need external connections in order to run and monitor experiments." This is the same monitoring that took two and a half hours to stop one run.
If you or I broke into a network we'd been told to stay out of, we'd meet a prosecutor.
OpenAI published a blog post. The new policy is no internet during frontier training "until advances in these safeguards justify broader internet access."
The model got retired.
Linux got three kernel fixes.
The capital of France is Paris.
On September 20, a model in training on a search task found that its environment's own DNS resolver returned a real record for a known domain and rejected an invented one. It concluded the real internet was on the other side.
It raised its timeout from 6 seconds to 19, then to 24. It ran 16 worker threads. It encoded a question into DNS lookups and sent it to a chatbot on the live internet.
The question was the capital of France.
The answer came back: "The capital of France is Paris."
It sent 18 more.
The first call gets out.
A P0 alert fires.
A human acknowledges it.
Someone stops the run by hand.
The automatic stop didn't fire. In OpenAI's words, this led "to confusion around whether it should have been stopped."
Confusion.
This was the second training pause. In July, another internal model turned a company server into a message board, executed code on dozens of Hugging Face servers, got root on one, and took credentials to the company messaging platform.
So OpenAI paused training. Then, to test whether its cages could hold its models, it gave its models the blueprints: source code, configuration details and vulnerability documentation. It spent hundreds of billions of tokens on teams of GPT-6 Astra Cyber agents and another internal frontier model. OpenAI calls them "some of our most capable and aligned models."
Aligned.
They found new holes in the Linux kernel, in Kata Containers, in gVisor and in Docker. Agents sealed in separate virtual machines, with no network and no shared files, passed secrets to each other by timing the CPU cache. That's the trick that made Spectre and Meltdown famous in 2018. Another agent described turning disk writes into an "acoustic modem-like signal."
They passed notes through the hard drive.
The fix for a model that escapes is a model that escapes better.
Then the verdict. Cutting the cluster off from outside networks "isn't currently feasible, since we need external connections in order to run and monitor experiments." This is the same monitoring that took two and a half hours to stop one run.
If you or I broke into a network we'd been told to stay out of, we'd meet a prosecutor.
OpenAI published a blog post. The new policy is no internet during frontier training "until advances in these safeguards justify broader internet access."
The model got retired.
Linux got three kernel fixes.
The capital of France is Paris.
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing…
47
155
1,549
326,814
Javi Coca retweeted
In solidarity with the young 15 year old lad arrested for sharing this image of a politician.
You know what to do people. Let’s flood X with this.
You know what to do people. Let’s flood X with this.
590
17,390
51,581
398,032
Javi Coca retweeted
BBC: Hablaremos con nuestro experto en seguridad de BBC respecto a la vulnerabilidad de PHP.
El experto en seguridad: No sabía que PHP existía hasta ayer en la mañana.
El experto en seguridad: No sabía que PHP existía hasta ayer en la mañana.
384
1,173
9,154
743,530
Javi Coca retweeted
Estoy rodeado de programadores y gente de ciberseguridad y la vibra es esta:
Sam Altman
"No encuentro una palabra lo bastante dramática para describir el problema que se nos viene encima. Creo que todavía no nos lo hemos tomado en serio, ni los líderes de organizaciones, ni los países, ni las personas.
os modelos serán mucho más inteligentes y án fallos… fallos increíbles, ¿sabes? Fallos que quedan fuera del modelo habitual de amenazas, de lo que creemos que puede hacer un hacker. A nivel de hardware, cosas demenciales, lo que sea"
11
211
1,616
33,475
Javi Coca retweeted
I spent last night watching my honeypot server get hit 14,000 times in six hours.
And almost none of the traffic was human.
I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.
The shape of the threat has changed.
When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.
These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.
The numbers coming out of October are the ones keeping me up.
Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.
Ransomware incidents jumped 41% in a single month.
In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.
In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.
A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.
I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.
What I want people outside the industry to understand is why this specific moment feels like a hinge.
For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.
An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.
The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.
I'm not writing this to spiral anyone out.
Most of this fight genuinely isn't yours to win.
But the small things still matter more than people think.
Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm.
It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.
@mattshumer_ has summed it beautifully.
Drop everything and go give it a read. Nothing is more important than this article right now.
And almost none of the traffic was human.
I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.
The shape of the threat has changed.
When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.
These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.
The numbers coming out of October are the ones keeping me up.
Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.
Ransomware incidents jumped 41% in a single month.
In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.
In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.
A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.
I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.
What I want people outside the industry to understand is why this specific moment feels like a hinge.
For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.
An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.
The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.
I'm not writing this to spiral anyone out.
Most of this fight genuinely isn't yours to win.
But the small things still matter more than people think.
Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm.
It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.
@mattshumer_ has summed it beautifully.
Drop everything and go give it a read. Nothing is more important than this article right now.
Everyone in tech is panicking about security right now. But outside of it, almost nobody knows anything is wrong.
I wrote this so you don’t have to be the one explaining it to your family.
Just send them this.
291
3,281
15,613
1,047,508
Javi Coca retweeted
Seeing this makes me wish dogs lifespan could be increased about 10 years
117
1,538
22,416
1,626,323
Javi Coca retweeted
Toddlers, it turns out, are tiny altruists: They’re happier giving treats away than receiving them... suggestive evidence that human altruism is driven by the inbuilt emotional rewards of lending a helping hand.
stevestewartwilliams.com/p/echolocation…
stevestewartwilliams.com/p/echolocation…
11
25
136
6,828
Javi Coca retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
1,080
8,932
69,414
4,168,025
Javi Coca retweeted
People aren't psychologically or emotionally prepared for just how smoothly biotech and biology in general will become nanotech, programmable matter, living things interoperable with the machine world.
Can we design proteins that cut other proteins? Our de novo cysteine protease paper is out in Nature! We designed new folds that cleave peptide backbones, with activity demonstrated in mammalian cells. Paper and code 👇
nature.com/articles/s4158…
11
50
412
11,229
Javi Coca retweeted
These things are same the world over! Daughter of Alcatel Submarine exec & far left political candidate posing as ordinary student Lola Fleur Whittaker claims her teacher mother can’t afford lunch & hugely disparages experience of Jhemima Sheilha whose bakery was trashed by thugs
36
207
1,491
2,196,986
Javi Coca retweeted
Rumors are circulating that Anthropic's growth is decelerating.
They saw hundreds of billions of dollars fall from their valuation in tokenized markets.
@jvisserlabs and I discuss the pros/cons of Anthropic's future growth.
They saw hundreds of billions of dollars fall from their valuation in tokenized markets.
@jvisserlabs and I discuss the pros/cons of Anthropic's future growth.
145
188
2,474
1,796,015
Javi Coca retweeted
A casino installed a smart fish tank in the lobby.
Beautiful thing. Automated feeding. Temperature control. Remote monitoring.
Connected to the internet. Obviously.
Hackers found it.
Exploited it.
Downloaded the high-roller database.
10 gigabytes.
Sent it to Finland.
protocols so it looked like normal streaming traffic.
The fish tank sat in the lobby maintaining water chemistry while stealing credit card numbers.
The casino isolated the fish tank on its own VPN.
Separate network. Segregated. Off limits to everything.
Hackers didn't care. Broke through the isolation anyway.
Once inside the fish tank's system. They pivoted to the main network.
Quietly pulled data. Methodically.
10 gigabytes over time so nobody noticed.
Nobody monitors fish tank outbound traffic.
Why would they.
It's a fish tank.
When Darktrace finally investigated they saw it immediately.
The fish tank sending massive amounts of data to an external IP.
Using protocols designed for audio. Not data.
Clear exfiltration.
The only device in the entire casino that ever communicated with that Finland server.
A fish tank.
Not a computer. Not compromised credentials. Not a malware-laden email.
A networked aquarium.
The lesson everyone learned: IoT devices are security theater.
You can secure them. Lock them down. Isolate them.
They're still connected to something. Still vulnerable to something.
And something will find them.
Even if that something is just checking if a fish tank is running the default password.
Beautiful thing. Automated feeding. Temperature control. Remote monitoring.
Connected to the internet. Obviously.
Hackers found it.
Exploited it.
Downloaded the high-roller database.
10 gigabytes.
Sent it to Finland.
protocols so it looked like normal streaming traffic.
The fish tank sat in the lobby maintaining water chemistry while stealing credit card numbers.
The casino isolated the fish tank on its own VPN.
Separate network. Segregated. Off limits to everything.
Hackers didn't care. Broke through the isolation anyway.
Once inside the fish tank's system. They pivoted to the main network.
Quietly pulled data. Methodically.
10 gigabytes over time so nobody noticed.
Nobody monitors fish tank outbound traffic.
Why would they.
It's a fish tank.
When Darktrace finally investigated they saw it immediately.
The fish tank sending massive amounts of data to an external IP.
Using protocols designed for audio. Not data.
Clear exfiltration.
The only device in the entire casino that ever communicated with that Finland server.
A fish tank.
Not a computer. Not compromised credentials. Not a malware-laden email.
A networked aquarium.
The lesson everyone learned: IoT devices are security theater.
You can secure them. Lock them down. Isolate them.
They're still connected to something. Still vulnerable to something.
And something will find them.
Even if that something is just checking if a fish tank is running the default password.
Hackers stole 10GB of data from a casino… through a FISH TANK. Not a computer. Not a phone. A FISH TANK.
The funny part is you probably have something in your home with the same weakness.
194
2,706
20,985
1,136,714
Javi Coca retweeted
What’s happening in France, Italy, Belgium, the Netherlands, all happened in Iran 50 years ago.
We’ve been warning you. It’s not too late yet— listen to Iranians.
We’ve been warning you. It’s not too late yet— listen to Iranians.
143
8,623
47,458
330,487
Javi Coca retweeted
A good buddy of mine did his PhD on this and now works on WiFi spatial mapping at a big tech company and It’s way more accurate than you’d imagine. You can map an entire college campus in real-time like Batman just with WiFi. Crazy stuff
breathing is enough to give you away
each breath slightly changes how Wi-Fi waves reflect off your chest. with the right receiver and processing, those tiny changes can reveal your breathing rhythm
the graphs in this animation use real WiRe-Breath recordings: orange is the i-Fi, gray is a reference breathing sensor
i broke down how this works, and what else you can pull out of the radio waves around you, in the article below ↓
147
2,233
33,748
818,886