Pinned Tweet
"To confront a person with his own shadow is to show him his own light." - Carl Jung
3
0
33
Aniq Rahman retweeted
Heads up @Netlify DNS has been compromised & attackers are actively redirecting dapps to drainer domains.
Community note
Netlify's Hosted DNS is reported operational with no incidents or compromises. Targeted DNS hijacks affected specific crypto project domains like flap.sh and fluxbeam.xyz, per security alerts, not Netlify infrastructure.

netlifystatus.com
en.bloomingbit.io/feed/news/1233…
x.com/blockaid_/stat…
x.com/STACCoverflow/…
48
106
770
97,012
Aniq Rahman retweeted
Replying to @RamaswmySridhar
7/16 airlines lease planes for years and sell seats one flight at a time. profit depends on load factor and yield. an empty seat at takeoff is gone forever. so is yesterday's unused gpu-hour.
4
12
289
93,371
Aniq Rahman retweeted
BREAKING: A hacker is attempting to breach the US Federal Election Commission's systems and that agency has had to 'temporarily shut down' its web-facing services as a result, according to an email seen by Reuters reut.rs/4imQyUu
979
4,812
9,370
1,830,095
Aniq Rahman retweeted
PSA for macOS users:

1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.

2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.

3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.

4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.

4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.

5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:

“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”

Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.

I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
PSA for Codex CLI users:

1. Codex 0.163.0’s release lockfile pins rustls-webpki 0.103.15 and root bundles that can still trust compromised eMudhra certificates.

2. An attacker intercepting your connection could impersonate a server, steal sensitive data, or alter responses, potentially tricking Codex into running malicious commands.

3. Codex 0.164.0, released October 23 at 12:48 a.m. ET, updates those dependencies to fixed versions.

4. To check your codex version run "codex --version". It should be at least 0.164.0.

5. To patch the vulnerability, run "codex update".

6. Apps that bundle their own Codex copy must also be checked.
60
146
1,499
323,994
Aniq Rahman retweeted
106
952
4,293
1,579,343
Aniq Rahman retweeted
I spent last night watching my honeypot server get hit 14,000 times in six hours.

And almost none of the traffic was human.

I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.

The shape of the threat has changed.

When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.

These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.

The numbers coming out of October are the ones keeping me up.

Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.

Ransomware incidents jumped 41% in a single month.

In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.

In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.

A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.

I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.

What I want people outside the industry to understand is why this specific moment feels like a hinge.

For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.

An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.

The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.

I'm not writing this to spiral anyone out.

Most of this fight genuinely isn't yours to win.

But the small things still matter more than people think.

Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.

I'd kill SMS 2FA wherever an authenticator app is offered.

I'd turn on breach alerts in whatever password manager you use.

If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.

None of that stops the swarm.

It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.

@mattshumer_ has summed it beautifully.

Drop everything and go give it a read. Nothing is more important than this article right now.
Everyone in tech is panicking about security right now. But outside of it, almost nobody knows anything is wrong.

I wrote this so you don’t have to be the one explaining it to your family.

Just send them this.
289
3,286
15,618
1,065,803
Aniq Rahman retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
1,077
8,927
69,293
4,235,867
Aniq Rahman retweeted
🚨Anthropic Frontier Red Team warns: “We’re seeing signs of life for AI worms”

>paper: "AI models may be capable of self-replicating without access to a datacenter"
>researchers buy 15 sketchy $55 android TV boxes
>link them over unauthenticated ADB ports
>the TV boxes have 4gb of RAM each id Open Source Project forks
>shard gemma4-26b across the ram sticks using pipeline parallelism
>gemma figures out how to run inference across all 15 TVs @ 0.39 tokens/sec
>qwen 3.5 9b figures out how to compile inference on 8 of 9 novel hardware types on its own
>glm 5.2 achieves end-to-end autonomous worm replication
>infects edge devices, compiles its own inference stack, and replicates autonomously
>when an instance dies, it writes debugging notes into Memento for the next generation
>daughter copies setup success jumps from 45% -> 84% across generations
>pure Lamarckian evolution inside consumer electronics
>smart oven, robot vacuum, and cheap TVs form a decentralized botnet
>two million infected TV boxes worldwide = 40 H100 equivalents of unkillable compute
>it replicates once every few days like a distributed “digital slime mold”
>you can't pull the plug because half the model weights are already sharded across the neighborhood
>sub-30B models projected to hit full autonomous replication threshold by late 2026

“We should aim to harden our systems… but also prepare to deal with a world where they are here to stay.”
176
263
2,322
252,783
Aniq Rahman retweeted
The U.S. State Department is monitoring a reportedly fatal case of "pneumonia of an unknown etiology" linked to a plague research laboratory in Russia.

Read more: abcnews.link/n8R1DxP
478
1,722
6,449
4,638,947
Aniq Rahman retweeted
Many of you have been tracking the Irkutsk lab situation over the last few days.

I've been gathering facts and trying to understand what is happening before weighing in.

Now that I have, I have to say — I'm concerned

🧵
333
2,583
11,757
3,408,427
Aniq Rahman retweeted
Russia's plague outbreak is getting worse, now with 5 hospitals in Irkutsk quarantined, universities canceling classes and accusations from healthcare workers that the government is attempting a media cover-up.

Nearly 200 contacts of a 28-year-old anti-plague laboratory worker reportedly under isolation or medical observation.

Irkutsk universities are canceling classes citing a “case of pneumonic plague,” while an aluminum plant introduced mandatory masks. A local government warning advising residents not to travel to Shelekhov was published and later deleted.

Healthcare workers claim doctors are discussing plague internally while avoiding the diagnosis in official documents.

Russian health authorities continue to deny any plague outbreak, attributing the woman's death to “pneumonia of unknown origin.”

Pneumonic plague is far worse that it's Bubonic cousin as its transmitted directly between humans.
411
3,800
13,326
2,694,839
Aniq Rahman retweeted
We weren’t planning to raise our Series C. The business was expanding faster than we could build capacity, and our investors saw it firsthand. They responded with more capital to help us scale the network faster.

That speed matters beyond meeting demand, though. We recently met roup that had stopped treating certain cancers because getting patients on prescribed therapies had become operationally unsustainable. At a critical point in their diagnosis, patients were turned away and left to find another specialist, potentially hours away, creating delays and increasing the risk that treatment never begins.

Forus automates the process between prescription and treatment so practices can continue treating patients with the most serious conditions.

I joined @KristenScholer on @NYSE Live to talk about why expanding the network faster matters.
7
6
66
7,245
Aniq Rahman retweeted
DuckTales premiered 39 years ago today.
I loved that show. Not for the gold. For the idea that adventure meant going somewhere wild with people you love.

It was Indiana Jones for kids.

Nobody's making the movie, so I made the trailer. Sound on. 🦆
1,888
2,577
21,730
2,451,447
Aniq Rahman retweeted
Kev-0.5B: A tiny open source Jev-like decision model with a TypeSafe-compatible API based on Qwen2.5-0.5B that you can train and run on a MacBook Pro.

Model card and weights are available on GitHub

github.com/jaredpalmer/kev
92
204
2,603
415,968
Aniq Rahman retweeted
I've attempted to map everything in oncology in a public website and open source repo for all.

The site is trying to get all cancers, products, technologies, bottlenecks, people, startup opportunities with 1000+ ideas for upgrading the field.

If you have a loved one with nical or can engineer, go take a look, file improvement requests or bugs or help with the open repo and make this the best open and free info resource for individuals, researchers and educational use.

This should save people time, aid AI oncology projects and generate positive action. If you are not technical just complain in this thread about broken or annoying or things you want and I'll fix them live.

Some of the interesting pages:

Treatments: onco.cc/drugs

A gallery of the molecules being used onco.cc/molecules/

And targets: onco.cc/targets/

The technologies in oncology: onco.cc/technologies/

1100 ideas for helping oncology: onco.cc/ideas/

Bottlenecks on oncology: onco.cc/bottlenecks/

Open questions (LETS GO RESEARCH PEOPLE) onco.cc/open-questions/

Startup requests (LETS GO STARTUP PEOPLE) onco.cc/startup-reques…

Mechanics of cancer: onco.cc/mechanics

Battlefronts: onco.cc/fronts/

Isotope supply: onco.cc/isotopes

Key papers: onco.cc/key-papers

Pipeline funnels: onco.cc/pipeline

Cancer by type: onco.cc/cancers/

Institutional rankings: onco.cc/institutions/

The startups: onco.cc/startups/

Heros and heroines : onco.cc/heroes/

Key medical people: onco.cc/people/

Here is the project roadmap: onco.cc/roadmap/

Models and data sets: onco.cc/models/

There are other views as well, take a browse.

Try making a PR if you have an upgrade to this on the repo here: github.com/judegomila/OnCo

If you are biologically/medically minded and something is wrong, file a bug as well or say on the thread and we will get it fixed live.

If this is a useful project star the repo and help get it calibrated.

I've tried to add some other languages but I cannot speak them so tell me if that doesnt work well.

I believe we will crack oncology and having total information dominance is key to the problem.

Let the feedback flow!
200
939
4,543
333,770
Aniq Rahman retweeted
Ok this is starting to feel like a f*cking disaster.

The CEO of Anthropic just published an article admitting AI is already building the next generation of AI by itself.

He says within 6 to 12 months a rogue swarm could take over the entire internet and cause hundreds of damage.

And what makes it scarier, Elon Musk just backed up everything Dario said.

All of this dropping just days after Jacob Coxon went viral with his warning about AI and the extinction of humanity.

Tell me this timing isn't strange.
We Must Pace the Frontier: I’ve written a new essay on why the AI industry should slow down, with a three-part plan for doing so.

Anthropic is unilaterally committing to the first of these steps. We’ll provide third-party evaluators with permanent, employee-level access to our systems, so that they can verify adherence to our safety measures, report on incidents, and assess models’ alignment during training.

You can read the full post here: darioamodei.com/post/we-must-p…
2,221
9,594
39,823
5,874,235
Aniq Rahman retweeted
Required reading for any policy maker. Clear, concise, jargon free explanation by one of the leading AI researchers.
Over the past few days, I've taken the time to summarize my thoughts on the recent incidents involving agents’ misaligned behavior. We don't know with certainty what comes next, but we know where these issues originate, and this can help us plan the path forward.

Please feel ons in the replies, and I’ll try to answer some of them in the coming weeks.

yoshuabengio.org/en/publication…
2
11
115
37,958
Aniq Rahman retweeted
Vibe hardware is here.

I gave Astra my credit card and asked for a Teenage Engineering-style mini DJ controller.

It generated a concept image, sourced parts, read Chinese datasheets, built a CAD model, ordered everything, then made a Blender animation showing how to assemble it.
414
558
9,233
1,023,563
Aniq Rahman retweeted
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.
20,452
166,929
799,774
175,500,926
Aniq Rahman retweeted
We’re announcing that Forus has raised a $150M Series C at a $3B valuation to build the AI network for medicine.

Medicine will remain one of the world’s most important industries until humanity achieves immortality, and we are only at the beginning of a new era in what it can obesity and cardiometabolic disease. Gene therapies can treat diseases at their genetic source. New cancer treatments are turning diagnoses that were once fatal into diseases people can live with. AI is enabling us to discover of new drugs even faster.

But discovery is only the beginning. It still takes more than a decade and billions of dollars to turn a new molecule into an approved medicine, and once it reaches market, more than a third of patients prescribed specialty treatments never receive their first dose.

Forus is creating the AI network to accelerate the entire medicine pipeline, from development and launch through prescription and treatment. We connect the companies creating medicines with the doctors who prescribe them and the patients who need them.

Today, Forus supports millions of people across all 50 states and is already used by providers to treat patients in 85% of U.S. residential ZIP codes. 9 of the top 15 global biopharma companies work with us, alongside many fast-growing biotechs. Our goal is to put Forus in every doctor’s office in the country and unlock an order of magnitude more medicine for society.

There is a generational opportunity to rethink how new medicine reaches people. Forus is becoming how medicine moves from discovery to treatment in America, and as we scale, we’ll become the most important company in life sciences.

Forus is not constrained by capital or customer demand; we are constrained by the talent and capacity of our team. To take on the opportunity in front of us, we need exceptional engineers and operators in New York who want to move fast and help us make something that matters. Come build with us.

Our Series C was led by Bain Capital Ventures, with Thrive Capital, General Catalyst, Accel, Redpoint, BoxGroup, Pear VC, Vast Ventures, and SV Angel investing alongside them.
83
55
556
276,087