Tim Haines 🇺🇦 retweeted
@itsjustemail @konstiwohlwend he deleted it, but the follow-up to that tweet was a guide on migrating from better-auth to workos
2
1
34
6,189
Who was collecting CEOs throwing of shade at competitors, and then announcing their own security incidents? WorkOS CEO here.
yikes. betterauth is pre-announcing a "security release" 😬
why? because agents can immediately deploy broad-scale attacks the minute vulns are disclosed. we saw this last week with php2shell: millions of automated attack attempts within hours of disclosure
this is now a huge problem for open source projects. likely the same thing will happen with betterauth as php. unclear if network WAFs will be able to patch this one... oof 😰
0
0
3
646
Devs, worth checking in on your Playwright setup today. I had some older instances floating around I wasn't aware of. 🐞
PSA for those of u vibecoding naked on your laptop with no containers: tell your agents to DELETE Playwright NOW. Even the latest (1.64.1) bundles early Chromium.156 with
CVE-2026-118306
CVE-2026-118331
CVE-2026-118348
CVE-2026-118344
And the Playwright SANDBOX IS OFF BY DEFAULT
5
3
191
76,139
I believe plenty of this kind of post-training is happening, but people aren't going to be tweeting about it.
x.com/jun_song/statu…
x.com/msuiche/status…
x.com/jun_song/statu…
x.com/msuiche/status…
Yesterday, an anonymous black hat group reached out with an insane RL request.
They offered an astronomical amount of money to post-train open-weight models on a proprietary dataset of every single time a CVE has ever been issued, perfectly synchronized with the exact number of engineers who saw the alert and immediately thought “that’s probably fine.”
The amount of “we’ll patch it next sprint” data they claim to hold is unlike anything I have ever seen. If someone told me this was an undercover dataset of every ignored vulnerability in the history of software, I would have believed it.
For context, a white-hat project I worked on using GLM-5.3 used less than one percent of that volume, and it already outperformed frontier models by a huge margin at predicting exactly how many days a critical CVE would sit unpatched before someone got hacked.
Of course, I turned it down. But what genuinely scares me is knowing someone else will eventually take the deal.
0
0
0
176
Tim Haines 🇺🇦 retweeted
Check your children's candy carefully this year... you never know.
149
1,021
16,063
349,250
Tim Haines 🇺🇦 retweeted
I'm tapping the sign again. If you get an email campaign from a provider that does this, let me know (you can DM or email me). I'm starting a collection.
You would have to be out of your fucking mind to tempt the gods this way in Q4 2026.
You would have to be out of your fucking mind to tempt the gods this way in Q4 2026.
Run, do not walk, from any cloud provider who is throwing public shade at Railway (or any other provider). The better your security team is, the more internal pressure you have not to mouth off about security in Q4 2026.
1
4
43
5,176
Somehow my macbook seems to suck up every single dust particle whenever I put it in my laptop bag.
0
0
0
178
Okay, I'm a fan of @Hacker0x01's new triage bot. It's reassuring to know within minutes of submission that your new report isn't an insta-dupe.
Deserves a celebration. 🎉🎉🎉
Deserves a celebration. 🎉🎉🎉
0
0
4
158
Just used my last banked reset this morning, love the timing.
Day 26/ You can now easily switch between multiple accounts on mobile, and coming soon to desktop too. Next two days will be resets… banked… do with this what you may 👀.
help.openai.com/en/articles/20…
1
0
1
194
Confusion or backpedaling @OpenAI?
Likelihood of OpenAI exploiting your research is about to go up.
0
0
1
173
Tim Haines 🇺🇦 retweeted
Fuck around and find out.
When Railway was breached on 21 Oct, Northflank dunked on them and urged people to migrate over to them because of that breach.
9 days they got hacked, the same way.
Zero sympathy: instead of securing you were busy dunking
When Railway was breached on 21 Oct, Northflank dunked on them and urged people to migrate over to them because of that breach.
9 days they got hacked, the same way.
Zero sympathy: instead of securing you were busy dunking
Northflank, a K8s fleet management & deployment system has been hacked.
They power @sentry @Upwork @figma @CoreWeave and apparently many other companies.
status.northflank.com/cmvv0rn5a092f1…
87
90
1,726
177,021
Tim Haines 🇺🇦 retweeted
Today's Claude extension compromise is a good reminder to do this. If you're using VSCode @code, Cursor @cursor_ai, or any other IDE built on VSCode, I would immediately enable extensions.installCooldownHours.
I've set this setting to 72 (hours), which is a much safer delay to extensions than the default setting of 0 (immediate updates).
This prevents extension updates from getting installed for 3 days, which would hopefully eliminate most of the risk from compromised updates. It's not foolproof, but it's better than no delay.
Heck, set it to something even higher to be safer, like 336 (2 weeks).
I've set this setting to 72 (hours), which is a much safer delay to extensions than the default setting of 0 (immediate updates).
This prevents extension updates from getting installed for 3 days, which would hopefully eliminate most of the risk from compromised updates. It's not foolproof, but it's better than no delay.
Heck, set it to something even higher to be safer, like 336 (2 weeks).
21
71
433
43,627
How many $6B breaches can binance afford to cover. If they get hit in the same way next week, will everyone still be whole?
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
This was a complex attack, and we are doing all we can in coordination resolve it. We are still gathering the facts, and will share more directly as we have them.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.
We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected.
The outflows ceased when we paused withdrawal service earlier. We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far.
We will continue to provide further updates through official Binance channels as more verified information becomes available.
0
0
2
165
