Oak Security retweeted
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
201
556
5,094
1,163,328
Oak Security retweeted
🎙️ New CypherTalk: @cadillion and @ourcarback of @quipnetwork join us to talk quantum.
How much of the quantum threat is hype, and how much is real? Find out in this episode as we discuss the reality, threats, and opportunities.
🎧 cyphertalk.podbean.com/e/the-quantum-…
How much of the quantum threat is hype, and how much is real? Find out in this episode as we discuss the reality, threats, and opportunities.
🎧 cyphertalk.podbean.com/e/the-quantum-…
7
3
11
131
Oak Security retweeted
3 auditors on every line of code, none of them seeing the others' findings until a consensus meeting. That is how Oak Security describes its process, and blinding is what makes the 3 count as 3 and not 1 repeated.
1
1
12
377
Our Q3 research describes four Cosmos-ecosystem chains exploited through one unsigned-integer underflow in a shared upstream EVM-compatibility module.
3
0
5
363
Dependency risk also includes ordinary bugs propagating across deployments. Review the version you run, the assumptions you inherit and the local changes you made.
1
0
1
91
Give upstream advisories a downstream owner. Track patch adoption and test the failure case in your own configuration. A fix in the upstream repository is only the start.
0
0
0
44
A dependency list tells you what you use. An authority map tells you what it can do.
For every vendor and upstream module: can it move funds, alter a trusted build, or change a security check? Who can revoke that authority?
For every vendor and upstream module: can it move funds, alter a trusted build, or change a security check? Who can revoke that authority?
1
0
1
171
About half of Q3's $1.07B in losses came from two supply-chain compromises.
Which vendor software can authorise transfers? Which build artefacts do users trust?
Our Q3 update: oaksecurity.io/research/blog/…
Which vendor software can authorise transfers? Which build artefacts do users trust?
Our Q3 update: oaksecurity.io/research/blog/…
2
0
2
180
14 of the 20 protocols exploited in Q3 had been audited. That is a reason to examine security coverage, not a verdict on audit quality.
1
0
1
219
A prior audit does not tell you whether the exploited path was in scope, which version was reviewed, or which privileged systems changed afterward.
1
0
1
96
Map every path that can move funds: contract logic, signers, vendor software, release pipelines and dependencies. Give each path a review process and an owner.
0
0
0
65
Our State of Web3 Security report now includes Q3 2026: $1.07B lost across 20 incidents. About half came from two supply-chain compromises.
Read the report and explore the dashboard: research.oaksecurity.io
Incident data: @RektHQ.
Read the report and explore the dashboard: research.oaksecurity.io
Incident data: @RektHQ.
1
1
6
388
Oak Security retweeted
Alex @0xhalloc and Jan @JphFritsche currently in Singapore for @token2049!
Come to our booth at the Nexus Startup Area to talk about the future of private payments.
Come to our booth at the Nexus Startup Area to talk about the future of private payments.
0
3
16
554
🎙️ New episode: Kyle Den Hartog (@PryvitKyle), security engineer on the wallet at @brave .
- Why your wallet address is the new tracking cookie
- The browser as an attack surface
- The limits of ZK proofs.
🎧 cyphertalk.podbean.com/e/the-brave-br…
0
0
1
158
We have just published our audit report of
ZIGChain v5 for @ZIGFinance. Read all about our findings and recommendations in the report:
github.com/oak-security/a…
ZIGChain v5 for @ZIGFinance. Read all about our findings and recommendations in the report:
github.com/oak-security/a…
0
0
4
243
Building on @arbitrum? The Arbitrum Security Program is open for applications, with audit subsidies for eligible projects.
Oak Security is an approved auditor. Name Oak in the form’s “Preferred auditor” field.
Apply: tally.so/r/3xzEzv
Oak Security is an approved auditor. Name Oak in the form’s “Preferred auditor” field.
Apply: tally.so/r/3xzEzv
0
0
2
175
Oak Security retweeted
~1,783 wstETH, about $6M, drained from a vault on Base today. The attacker got a malicious contract added to the vault's whitelist, then used it to borrow aBaswstETH debt tokens and pull the underlying wstETH out.
1
2
6
395
We have just published our audit report of
@quipnetwork 's smart contracts and Ethereum SDK. Read all about our findings and recommendations in the report:
github.com/oak-security/a…
@quipnetwork 's smart contracts and Ethereum SDK. Read all about our findings and recommendations in the report:
github.com/oak-security/a…
12
3
37
12,300
We have just published our audit report of
@Valdora_finance 's @CosmWasm StZIG smart contract updates for the ZIGChain v5 migration. Read all about our findings and recommendations in the report:
github.com/oak-security/a…
@Valdora_finance 's @CosmWasm StZIG smart contract updates for the ZIGChain v5 migration. Read all about our findings and recommendations in the report:
github.com/oak-security/a…
0
0
6
362
👀
ZisK v1.3.0-alpha release 🚀
ZisK is moving beyond arithmetic hashes with BLAKE3 strengthening security while outperforming our prior Poseidon1 version:
⚡ 7.43s p999 on 4×5090
⚡ 5.14s p999 on 8×5090
🛡️ 128-bit provable security
🔐 Post-quantum secure
This is a major step proving.
Release notes: github.com/0xPolygonHerme…
0
0
2
311