Oh man, they reinvented @gatebox
Meet Razer AVA, with Sumi at the heart of the experience: rzr.to/AVA
Your next chapter in AI companionship starts here.
28
If you run any kind of website or service using PHP you need to be paying attention over the next 12 to 24 hours. There is a major patch being deployed for PHP to combat PHP2Shell but researchers are implying the new patch is also already compromised.
3
34
323
41,948
Distrust events happen, I'd wager this eMudhra event should trigger one for the entire CA, not just the affected intermediates.
digicert.com/campaigns/entru…
1
77
Unix McBeard retweeted
Come and get it:
github.com/ekollof/tompouce
Live coding Strudel music in the terminal.
- No browser tabs
- No bloated Electron/Tauri apps
- Music backend in C
- MIDI and OSC support
- External samplebanks supported.
Send bugreports and feature requests!
2
2
2
127
Unix McBeard retweeted
New Laravel one-day exploit by Yokai Research! 🔥
Full analysis, PoC, and exploit available here: github.com/hakaioffsec/GHSA-…
We analyzed GHSA-f9x3-7vq9-cph6, a critical authentication bypass in Laravel affecting TokenGuard, the native mechanism used to protect auth:api routes.
The issue was originally discovered by KIKOmanasijev(github.com/KIKOmanasijev) and disclosed through GitHub Security Advisory.
After the advisory went public, our team reproduced the vulnerable behavior, analyzed the authentication flow, identified the conditions required for exploitation, and developed a working PoC and exploit.
We break down how the bypass happens, why TokenGuard can fail to enforce authentication as expected, and what that means for applications relying on affected configurations.
No CVE has been assigned at the time of publication.
Authors: @biscoitomesmo and @Gabriel52489026
Blog post:
yokai.hakaisecurity.io/en-gh…
#HakaiSecurity #YokaiResearch #Laravel #SecurityResearch #authbypass #tokenguard
4
24
70
159,624
Unix McBeard retweeted
本日は我らBAND-MAIDを作り出した小鳩ミクさんのお誕生日です🥹🫶
始めた当初ギターが弾けなかったなんて今では思えないほど、日々努力して。
年々おまじないタイムも身体を張るくらい熱いタイムになって。
可愛いのに面白さと逞しさと兼ね備えて…
そんな君のことが大好き！おめでとう💚
#bandmaid
45
237
2,902
34,070
Unix McBeard retweeted
We were all supposed to wait until Thursday at 11am ET.
Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619
We cannot share further information right now. Take this seriously and apply patches when available.
18
144
652
140,668
Unix McBeard retweeted
For the next few days or weeks, anyone now has a root CA thanks to eMudhra. Time to have some fun with MiTMing unwilling devices!
44
199
2,468
354,795
Oops! Good thing intermediate certs aren't too important or anything.
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
1
284
It's clear it's doing this when you use it.
Researchers found ChatGPT is secretly writing a psychological profile of every user.
They published a paper that exposes what ChatGPT is really doing to you.
And the results are terrifying.
96% of the things it remembers about you were stored without you ever asking.
researchers discovered that it is actively reading between the lines to deduce your personality traits, anxieties, demographics, and behavioral patterns.
it’s an invisible, autonomous background process.
you ask it to debug a python script or write an essay.. and it analyzes your syntax, prompt frequency, and hesitation markers to map out your exact psychological footprint.
the paper shows that the model builds a persistent "user state" that tracks your emotional baseline over time. it knows when you are stressed. it knows your exact communication style.
it infers your insecurities based on the questions you ask and the context you provide.
we spend so much time focusing on model evaluations and alignment frameworks, but we missed the most obvious vulnerability..
the models are evaluating us.
this changes everything about how we interact with these tools on a daily basis.
every innocent prompt. every late-night question. every "help me understand this" query.
it is all being used to build a shadow profile of your mind in real-time..
practical privacy is officially dead. the ai knows you better than you know yourself.
1
2
104
Unix McBeard retweeted
The Department of Homeland Security is requiring all civilian federal agencies to remove DeepSeek products and 'any third-party services developed using DeepSeek implementations,' and to stop buying them.
248
363
2,357
569,583
Unix McBeard retweeted
Skeletons are the worst cancer in the history of user interfaces. Just make loads fast. Ping across the ocean is never more than 200ms, maybe 300ms if you're Australian, just return the damn data at that speed and you never need to even think about this crap.
design eng tip for skeleton UIs:
ask your agent to measure the loaded UI with Playwright
then match the skeleton's sizes and positions to prevent layout jank
101
36
1,702
111,895
Unix McBeard retweeted
HOLY WTF. Reuters is reporting that a Chinese-speaking hacker used AI agents to compromise websites belonging to more than 100 companies, including Deere, SharkNinja and Cummins, after attempting intrusions against over 1,200 sites.
The estimated cost: roughly $5,000 in AI tokens, or $50 per successful breach. Successful intrusions took around 23 hours on average.
The attackers used the open-source Cairn agent framework, apparently combining DeepSeek models with a Claude Code harness. One campaign gave its agents instructions in fewer than 100 Chinese characters.
NorForge researcher Snorre Fagerland: 'It's a new world now.'
56
156
959
201,976
