T-bone retweeted
It’s gonna be one of those unbelievable fall days in San Francisco.
17
50
1,159
16,159
T-bone retweeted
The recent node.js RCE related to brotli compression is broader than just node.js and applies to essentially all software using brotli[1]
Vercel’s firewall protection against the attack is effective independent of the backend technology.
Python is vulnerable. However, unlike Node.js it requires using the pypi/brotli package explicitly[2].
It is likely that other software is impacted. Attacks can happen both through decoding incoming HTTP requests (which the Vercel Firewall protects against) as well as downloading attacker-controller payloads via HTTP.
[1] cve.org/CVERecord?id=C…
[2] db.gcve.eu/vuln/PYSEC-202…
Vercel’s firewall protection against the attack is effective independent of the backend technology.
Python is vulnerable. However, unlike Node.js it requires using the pypi/brotli package explicitly[2].
It is likely that other software is impacted. Attacks can happen both through decoding incoming HTTP requests (which the Vercel Firewall protects against) as well as downloading attacker-controller payloads via HTTP.
[1] cve.org/CVERecord?id=C…
[2] db.gcve.eu/vuln/PYSEC-202…
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/no…
19
16
157
18,522
T-bone retweeted
We published three security advisories for Bun 1.4.3 and earlier: compromised eMudhra certificates, the brotli decoder bug (HTTP2Shell), and the HTTP/3 "Header Accordions" attack.
These are all fixed in Bun 1.4.4. Please upgrade, and rebuild anything made with `bun build --compile`
$ bun upgrade
github.com/oven-sh/bun/se…
These are all fixed in Bun 1.4.4. Please upgrade, and rebuild anything made with `bun build --compile`
$ bun upgrade
github.com/oven-sh/bun/se…
17
46
563
34,074
T-bone retweeted
⚠️ RESEARCH: Fusion reactors are going to crash the price of gold.
That’s the headline. Here are the numbers:
Marathon Fusion’s idea is real physics. Fire fusion neutrons at mercury and some of it turns into gold. Published, peer reviewed, nobody disputes it.
Then the math watt plant, on the optimistic models, makes 2 to 5 tonnes of gold a year. Global mines pull out 3,500 to 4,000 tonnes. One plant moves annual supply by about a tenth of a percent.
The feedstock is enriched mercury. About $15,000 per milligram. Gold trades near $135 per gram. You are loading the reactor with something 100,000x more expensive than what comes out of it.
And what comes out is radioactive. The bars sit in storage for 14 to 18 years before anyone can legally sell them. A plant switched on today delivers its first sellable ounce in the 2040s.
That’s the headline. Here are the numbers:
Marathon Fusion’s idea is real physics. Fire fusion neutrons at mercury and some of it turns into gold. Published, peer reviewed, nobody disputes it.
Then the math watt plant, on the optimistic models, makes 2 to 5 tonnes of gold a year. Global mines pull out 3,500 to 4,000 tonnes. One plant moves annual supply by about a tenth of a percent.
The feedstock is enriched mercury. About $15,000 per milligram. Gold trades near $135 per gram. You are loading the reactor with something 100,000x more expensive than what comes out of it.
And what comes out is radioactive. The bars sit in storage for 14 to 18 years before anyone can legally sell them. A plant switched on today delivers its first sellable ounce in the 2040s.
287
369
1,878
242,831
T-bone retweeted
@Polymarket Come on Palmer, you have an opportunity to do something great....
2
14
508
33,375
T-bone retweeted
Today I turn 88…I’ve seen some serious shit. The most serious of it all is love. I love my family, my friends, and my wonderful fans. The power of love remains.
6,290
14,010
155,534
2,696,763
T-bone retweeted
If you have elderly parents, you need to be talking to them about the information they’re consuming online, because it’s so incredibly easy to get lost in an algo driven world of largely AI slop and scams
The baby boomer generation is the first to enter its most vulnerable years with unfettered access to the internet and, like the rest of us, it has trouble looking away. Americans over 60 now spend more than half their leisure hours in front of screens. But unlike millennials and spent years navigating engagement bait, stealth marketing, and AI slop — and have developed a working instinct for what to trust — older adults tend to have little idea of what they’re looking at. This susceptibility is creating an entirely new type of responsibility for the adult children of these suddenly very online parents.
These adult children describe watching their relatives — call them iPad parents — ingest content they have no context for, slipping into a zombified state of consumption that their loved ones often believe is exacerbating their decline. “It seems like an addiction,” says Beth, a 51-year-old lawyer, who says she has watched her 84-year-old mother’s attention span atrophy over the past few years. “It kind of has the same symptoms — getting fussy if she’s not online or just constantly going back to try and get online.”
Marti DeLiema, a gerontologist at the University of Minnesota, likens the process of regulating a parent’s internet access to getting an adult to give up driving in their later years. “Driving is part of your identity. It’s like a mark of freedom and independence,” she says. The online world is “also a source of your social connection.” All this amounts to a particularly tricky balancing act for adult children: figuring out how to preserve their parents’ independence while protecting them from an ever-advancing slop-filled ecosystem.
Read Jessica Lucas’s report on how adult children now have to save their retired parents from slop-filled, scam-riddled feeds: nymag.visitlink.me/FQ9dBi
7
1
26
1,285
T-bone retweeted
we are now asking that everyone on-call tonight proactively join the incident call and leave it up overnight
we will sound the CVE claxon as 0-days drop
we will sound the CVE claxon as 0-days drop
21
27
762
60,057
You can just do things.
they’re calling it “Black October” and i don’t think people realize how serious this is
in the last 48 hours there have been over 27 major cybersecurity incidents. not in a month. not in a week. in 48 hours
any ONE of these would normally be the biggest story of the year
PHP: critical vulnerability in the software running 80% of the web. severity 9.2 out of 10
Node.js: high-severity flaw letting attackers take over servers remotely. affects versions 22, 24, and 26
Java: also compromised. three of the most used programming languages on earth hit at the same time
GitLab: a perfect 10 out of 10 severity hole in every version since 2014
Railway: hosting platform compromised. API keys for OpenAI, Claude, Stripe potentially exposed
Signal: a bug that could leave your mic and camera on after you hang up
WordPress: hackers stole a plugin maker’s keys and planted backdoors on websites
LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
and that’s not even half the list
thousands of AI agent swarms are reportedly scanning and attacking vulnerable servers right now. automated. around the clock
security researchers are saying this might be the early stages of a global cyber incident that nobody fully understands yet
if you run a website, use cloud services, store API keys on hosting platforms, or use any software built on PHP, Node.js, or Java you are potentially affected
update everything. rotate your API keys. change your passwords on critical services. enable 2FA everywhere you haven’t already
this is not a normal week on the internet. this is something different
0
0
0
32