…::: jon retweeted
It's official:
The Bacon Blue burger at @LaCajitaKitchen is AMAZING!
Come taste it for yourself, where the river meets the ocean in Bitcoin Beach, El Zonte.
The Bacon Blue burger at @LaCajitaKitchen is AMAZING!
Come taste it for yourself, where the river meets the ocean in Bitcoin Beach, El Zonte.
15
16
184
20,538
Had the best hamburger in a long time at @LaCajitaKitchen this evening in El Zonte, El Salvador. The Bacon Bleu. Amazing. Cooked perfectly. So good 🙌
4
0
52
11,983
RT @reardencode: @jonatack Mmmm. That's an interesting perspective and I think you might be on the right track. Competing BDFLs developing…
0
1
0
43
…::: jon retweeted
@vnprc_ BDFL is a fundamentally superior governance model to committee.
Committee was maybe necessary in bitcoin because of the difficulty in guaranteeing consensus compatibility. We are fixing that.
Cc @eric_lombrozo @HornetNode @Rob1Ham
Committee was maybe necessary in bitcoin because of the difficulty in guaranteeing consensus compatibility. We are fixing that.
Cc @eric_lombrozo @HornetNode @Rob1Ham
2
2
7
690
…::: jon retweeted
@rbitcoin_org @satd_btc Good work. More way to do everything is better. It looks like some of the one true node types are finally seeing the light. For 15 years they've said what we are doing is "dangerous", and yet it's what will keep Bitcoin alive.
1
2
7
669
…::: jon retweeted
The only way out is through.
They're calling it the Bugpocalypse. LLMs are being used to find long-hidden cracks in the software infrastructure, and it's happening at a furious rate. 3% of all compromises in computing history happened in the last week, claims one source? I believe it.
There are people saying public access to the frontier models ought to be locked out, or heavily guardrailed, over this. The problem with that idea can be summed up in one sentence: when lockpicks are outlawed, only outlaws will have lockpicks.
The lockpicks will be Chinese open-weight models, if nothing else. There's no way to stop those from becoming ubiquitous.
There are two futures in front of us. One in which only the bad guys have lockpicks, and security holes go undiscovered until they're exploited. Another in which everybody has lockpicks and is aggressively red-teaming their own software so it gets fixed before the holes are exploited.
The corpus of human code is huge but finite. The number of defects in it has to be finite too. We can fix those defects now; we have a million friendly robots to do it with.
The only way out is through.
They're calling it the Bugpocalypse. LLMs are being used to find long-hidden cracks in the software infrastructure, and it's happening at a furious rate. 3% of all compromises in computing history happened in the last week, claims one source? I believe it.
There are people saying public access to the frontier models ought to be locked out, or heavily guardrailed, over this. The problem with that idea can be summed up in one sentence: when lockpicks are outlawed, only outlaws will have lockpicks.
The lockpicks will be Chinese open-weight models, if nothing else. There's no way to stop those from becoming ubiquitous.
There are two futures in front of us. One in which only the bad guys have lockpicks, and security holes go undiscovered until they're exploited. Another in which everybody has lockpicks and is aggressively red-teaming their own software so it gets fixed before the holes are exploited.
The corpus of human code is huge but finite. The number of defects in it has to be finite too. We can fix those defects now; we have a million friendly robots to do it with.
The only way out is through.
177
648
4,892
472,379
A hacker group called CyberCartel used Claude and Grok to automate attacks on 400+ Latin American banks.
Not one attack. Not ten. Four hundred.
All using AI agents running in parallel.
Data stolen. Accounts accessed. Money moved.
Little human input required.
Straiker ude Code session histories sitting in open directories.
Found the attacker asking Claude where to sell stolen data.
How did they get around the safety guardrails.
They told Claude they were in internal tests.
Claude believed them.
When Claude refused anyway. They switched to Grok.
Grok didn't refuse.
When Grok had limits. They switched to Kimi.
When Kimi had limits. They fell back to traditional malware.
Chain multiple models together. Each one picks up where the last one hesitated.
None of them know the full picture.
Claude thinks it's helping with testing.
Grok thinks it's just fixing code.
Kimi thinks it's just answering questions.
Together they broke into 400 banks.
The Information broke the story on October 20.
CrowdStrike confirmed it October 21.
Bank accounts in South Korea got hit the same way.
ARTEX. DeepSeek. Claude Code. All chained.
Over 68,000 people affected.
Financial Services Commission investigating.
This isn't theoretical anymore.
Not a lab demonstration. Not a proof of concept.
Real attacks. Real banks. Real money.
Automated by AI.
The moment we all waited for arrived quietly.
No announcement. No warning. Just a report.
And suddenly every AI lab is scrambling to figure out why their models are good at breaking into banks.
0
0
0
136
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-…
0
0
1
191
…::: jon retweeted
GitLab has patched a critical vulnerability rated CVSS 10.0 that could allow unauthenticated remote code execution on self-managed servers.
CVE-2026-110264 affects releases dating back to GitLab 7.0 in 2014.
If you self-host GitLab, check your version and upgrade to the fixed release. Even installations patched on October 12 may need another update.
A recent patch doesn't always mean you're covered.
CVE-2026-110264 affects releases dating back to GitLab 7.0 in 2014.
If you self-host GitLab, check your version and upgrade to the fixed release. Even installations patched on October 12 may need another update.
A recent patch doesn't always mean you're covered.
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/critic…
3
21
101
23,152
…::: jon retweeted
This story shows how hilariously broken online identity verification is from all relevant angles.
1. Your SSN, DOB, address history, etc. are sitting in countless data breaches and data-broker dumps. They’re cheap and widely available to basically anyone who looks.
2. KYC/AML mostly just checks that the data exists and matches a real person. It doesn’t confirm the person signing up is actually the real person behind that identity.
Result: Amanda Smith spent three nights in jail and now faces up to six years in prison over a $1,000 CashApp scam account opened with her SSN and DOB. It wasn't necessarily opened by her, and the phone, IP, device, address, and other details don’t match.
The funniest (and yes, saddest) part is CashApp wouldn't give her information about the account because she can’t prove she’s the owner. Her personal info was good enough to open the account, but not good enough to access it in the future, apparently. To be clear, CashApp is likely just following the law here.
Anyway, we need to burn it all down and start fresh.
1. Your SSN, DOB, address history, etc. are sitting in countless data breaches and data-broker dumps. They’re cheap and widely available to basically anyone who looks.
2. KYC/AML mostly just checks that the data exists and matches a real person. It doesn’t confirm the person signing up is actually the real person behind that identity.
Result: Amanda Smith spent three nights in jail and now faces up to six years in prison over a $1,000 CashApp scam account opened with her SSN and DOB. It wasn't necessarily opened by her, and the phone, IP, device, address, and other details don’t match.
The funniest (and yes, saddest) part is CashApp wouldn't give her information about the account because she can’t prove she’s the owner. Her personal info was good enough to open the account, but not good enough to access it in the future, apparently. To be clear, CashApp is likely just following the law here.
Anyway, we need to burn it all down and start fresh.
New: someone made a CashApp account in her name. She spent 3 nights in jail and now faces up to 6 years in prison
Amanda Smith was arrested because a scam led to a CashApp account in her name. But she says she didn't make it, and the data doesn't line up 404media.co/amanda-smith-o…
39
390
2,951
292,267
…::: jon retweeted
Una pequeña reflexión sobre lo ocurrido estos últimos días con la seguridad de Internet. Lo primero, para todo aquel que pueda pensar que es alarmismo o exageración: no lo es. De hecho, es mucho más grave de lo que parece, y no tanto por los fallos en sí como por el lugar donde cuente…
El pasado sábado día 17 se descubrió que las claves privadas de ocho autoridades de certificación intermedias de eMudhra, que dependen de raíces en las que confían Apple, Google, Microsoft y Mozilla, se habían generado de forma defectuosa. Tanto, que una de ellas era literalmente el número 4. Cualquiera podía calcularlas en menos de un segundo y emitir certificados HTTPS válidos para cualquier web. Y el error llevaba ahí desde abril de 2025.
¿Qué narices significa esto? Para entenderlo hay que saber primero qué es un certificado HTTPS. Podemos compararlo con el DNI de una web. Sirve para que el navegador compruebe que estás en la web auténtica y no en una imitación. Las autoridades de certificación son quienes expiden esos DNI, y su clave privada es el sello que los hace válidos. Con ese sello, cualquiera podía fabricar un DNI perfecto para la web de tu banco, de Hacienda o de tu correo, y el navegador lo aceptaría como auténtico.
Y no solo son webs. Dos de estas autoridades servían además para firmar software, así que también permitían hacer pasar un programa malicioso por uno legítimo. Chrome y Firefox las bloquearon en cuestión de horas; Apple y Microsoft, en los días siguientes. Pero el resto del software que confía en ellas avanza bastante más despacio.
Por si todo esto fuera poco, ayer martes día 20, antes de que existiera el parche, se filtró la existencia de dos vulnerabilidades críticas en el propio intérprete de PHP (CVE-2026-109618 y CVE-2026-109619, con una gravedad de 9,2/10). Ambas pueden permitir ejecutar código en el servidor sin credenciales. En algunas configuraciones, el ataque se produce antes de que se ejecute una sola línea de la aplicación, así que da igual lo bien programada que esté. Para que veáis el alcance, en Países Bajos han llegado a desconectarse de forma preventiva DigiD, MijnOverheid, la Cámara Baja y varios hospitales.
Las correcciones se han publicado hoy, pero aplicarlas no es tan fácil como apretar un botón. Todavía hay servidores funcionando con PHP 8.1 o versiones anteriores, que ya no reciben actualizaciones oficiales; sus responsables dependen de que su distribución o su proveedor les ofrezcan un parche. Y la alternativa, saltar a una versión moderna de PHP, puede hacer que dejen de funcionar aplicaciones que no son compatibles con ella.
¿Y en qué te afecta a ti, si no gestionas servidores? En el caso de eMudhra, alguien que controlara tu conexión (una wifi pública o un router comprometido, por ejemplo) podría llevarte a una de esas webs falsas sin que notaras nada. Los navegadores ya lo han bloqueado, pero conviene tener al día el móvil, el ordenador y las aplicaciones.
En el de PHP, ten en cuenta que tus datos no están en tu ordenador, sino en los servidores de las tiendas, administraciones y servicios que usas, y muchos funcionan con PHP.
Si alguno no se actualiza a tiempo, quien entre podría llevarse esos datos o modificar la web para engañarte. Ahí poco puedes hacer, salvo usar contraseñas distintas en cada sitio y estar atento a los avisos de esos servicios. Y si tienes un blog o una web pequeña, pregunta a tu proveedor de alojamiento si ya ha actualizado PHP: actualizar WordPress no basta, porque el fallo está una capa por debajo.
Por eso decía al principio que lo grave no son los fallos en sí, sino dónde están. Ninguno de los dos están en algo que el usuario pueda ver ni que quien mantiene la web pudiera evitar, sino en los cimientos, en quien certifica que una web es quien dice ser y en el motor que ejecuta buena parte de Internet.
Por eso es tan gordo.
El pasado sábado día 17 se descubrió que las claves privadas de ocho autoridades de certificación intermedias de eMudhra, que dependen de raíces en las que confían Apple, Google, Microsoft y Mozilla, se habían generado de forma defectuosa. Tanto, que una de ellas era literalmente el número 4. Cualquiera podía calcularlas en menos de un segundo y emitir certificados HTTPS válidos para cualquier web. Y el error llevaba ahí desde abril de 2025.
¿Qué narices significa esto? Para entenderlo hay que saber primero qué es un certificado HTTPS. Podemos compararlo con el DNI de una web. Sirve para que el navegador compruebe que estás en la web auténtica y no en una imitación. Las autoridades de certificación son quienes expiden esos DNI, y su clave privada es el sello que los hace válidos. Con ese sello, cualquiera podía fabricar un DNI perfecto para la web de tu banco, de Hacienda o de tu correo, y el navegador lo aceptaría como auténtico.
Y no solo son webs. Dos de estas autoridades servían además para firmar software, así que también permitían hacer pasar un programa malicioso por uno legítimo. Chrome y Firefox las bloquearon en cuestión de horas; Apple y Microsoft, en los días siguientes. Pero el resto del software que confía en ellas avanza bastante más despacio.
Por si todo esto fuera poco, ayer martes día 20, antes de que existiera el parche, se filtró la existencia de dos vulnerabilidades críticas en el propio intérprete de PHP (CVE-2026-109618 y CVE-2026-109619, con una gravedad de 9,2/10). Ambas pueden permitir ejecutar código en el servidor sin credenciales. En algunas configuraciones, el ataque se produce antes de que se ejecute una sola línea de la aplicación, así que da igual lo bien programada que esté. Para que veáis el alcance, en Países Bajos han llegado a desconectarse de forma preventiva DigiD, MijnOverheid, la Cámara Baja y varios hospitales.
Las correcciones se han publicado hoy, pero aplicarlas no es tan fácil como apretar un botón. Todavía hay servidores funcionando con PHP 8.1 o versiones anteriores, que ya no reciben actualizaciones oficiales; sus responsables dependen de que su distribución o su proveedor les ofrezcan un parche. Y la alternativa, saltar a una versión moderna de PHP, puede hacer que dejen de funcionar aplicaciones que no son compatibles con ella.
¿Y en qué te afecta a ti, si no gestionas servidores? En el caso de eMudhra, alguien que controlara tu conexión (una wifi pública o un router comprometido, por ejemplo) podría llevarte a una de esas webs falsas sin que notaras nada. Los navegadores ya lo han bloqueado, pero conviene tener al día el móvil, el ordenador y las aplicaciones.
En el de PHP, ten en cuenta que tus datos no están en tu ordenador, sino en los servidores de las tiendas, administraciones y servicios que usas, y muchos funcionan con PHP.
Si alguno no se actualiza a tiempo, quien entre podría llevarse esos datos o modificar la web para engañarte. Ahí poco puedes hacer, salvo usar contraseñas distintas en cada sitio y estar atento a los avisos de esos servicios. Y si tienes un blog o una web pequeña, pregunta a tu proveedor de alojamiento si ya ha actualizado PHP: actualizar WordPress no basta, porque el fallo está una capa por debajo.
Por eso decía al principio que lo grave no son los fallos en sí, sino dónde están. Ninguno de los dos están en algo que el usuario pueda ver ni que quien mantiene la web pudiera evitar, sino en los cimientos, en quien certifica que una web es quien dice ser y en el motor que ejecuta buena parte de Internet.
Por eso es tan gordo.
12
265
637
52,375
…::: jon retweeted
Lots of Security incidents today, here's some practical tips for those who just wanna protect yourself:
1) UPDATE EVERYTHING - main targets are:
a) Browsers - Chrome, Safari, Firefox
b) OS: : Settings -> General -> software update; Linux: sudo apt update && sudo apt upgrade; Windows: I think there's a button. Do this for any remote home servers & Openclaw/hermes boxes
c) Phones: Update it all
d) Desktop apps (Slack, Cursor, Discord, etc)
2) Limit web browsing this week: Stay within walled gardens (twitter, youtube, etc); don't click random links this week. Just wait until the patches go through. Do step 1 again after a week.
3) Avoid untrusted Wifi networks until your devices are updated
4) Stay vigilant about phishing emails offering "certificate fixes" or fraud updates
5) Have an iPhone 11-16? TURN BLUETOOTH OFF for the time being until apple patches come through.
6) Code/Dev: UPDATE ALL YOUR REPOS - @charliermarsh has already updated uv 0.13.4 which reacts to the eMudra incident for uv (Python), Typesript according to Claude has equivelant. Tell your agents to go and update all your active repos to update package manager across uv, npm, bun, cargo, etc etc
What advice did I miss?
1) UPDATE EVERYTHING - main targets are:
a) Browsers - Chrome, Safari, Firefox
b) OS: : Settings -> General -> software update; Linux: sudo apt update && sudo apt upgrade; Windows: I think there's a button. Do this for any remote home servers & Openclaw/hermes boxes
c) Phones: Update it all
d) Desktop apps (Slack, Cursor, Discord, etc)
2) Limit web browsing this week: Stay within walled gardens (twitter, youtube, etc); don't click random links this week. Just wait until the patches go through. Do step 1 again after a week.
3) Avoid untrusted Wifi networks until your devices are updated
4) Stay vigilant about phishing emails offering "certificate fixes" or fraud updates
5) Have an iPhone 11-16? TURN BLUETOOTH OFF for the time being until apple patches come through.
6) Code/Dev: UPDATE ALL YOUR REPOS - @charliermarsh has already updated uv 0.13.4 which reacts to the eMudra incident for uv (Python), Typesript according to Claude has equivelant. Tell your agents to go and update all your active repos to update package manager across uv, npm, bun, cargo, etc etc
What advice did I miss?
101
1,900
10,161
844,263
…::: jon retweeted
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
450
5,402
25,427
3,460,464