@adolfo

🚀 Product Engineer @ MAXIOS Systems

adolfo.ninja/
Joined February 2007
  • Tweets6.3K
  • Following1.3K
  • Followers472
333Media
y ya fue hackeado. stealmybitcoin.com/
Adolfo 💾
@adolfoOct 25
Hahaha, PHP2SHELL es tan difícil de explotar que este tipo decidió ponerlo a prueba
8
Hahaha, PHP2SHELL es tan difícil de explotar que este tipo decidió ponerlo a prueba
hacker.house
@hackerfantasticOct 25
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
1
1
71
crashcool is back crashcool.com/
10
here we go again
14
Damián tiene razón: hoy un VPS barato más una IA te reemplaza Railway. Yo tengo mis cosas self-hosted y así lo armaría, paso a paso: 1. Sacá el VPS (Hetzner, DigitalOcean o Vultr) con Ubuntu LTS y entrá con llave SSH, nunca con contraseña. 2. Antes de pedirle nada a la IA, creá un usuario sin root con sudo. Que la IA trabaje con ese usuario, no con root. 3. Primer pedido: "cerrá todo menos 22, 80 y 443, desactivá el login por contraseña e instalá fail2ban". Seguridad primero, proyecto después. 4. Segundo pedido: "levantame el proyecto en Docker Compose, con Caddy adelante para el HTTPS automático". Que todo quede en un repo: si mañana se rompe, lo volvés a levantar en minutos. 5. Backups diarios fuera del servidor. Un VPS sin backup es una apuesta, no un deploy. 6. Pedile que te explique cada comando antes de correrlo. Si no lo entendés, no lo corras. La IA te ahorra horas. El criterio sigue siendo tuyo. 🧉
Damián Catanzaro ☕️
@DamianCatanzaroOct 22
Loco, ya están grandes para seguir usando esas plataformas como Railway para deployar su web, ahora que tienen AIs que hacen absolutamente todo saquen un VPS (DigitalOcean, Hetzner, Vultr) donde quieran, le pasan la IP del VPS a su AI y le dicen configurame todo y levantame este proyecto ahi. Listo, se ahorraron mucha plata por mes, dolores de cabeza con filtraciones y caidas.
69
123
6
2,130
144,895
here we go again..
Sean Wright
@SeanWrightSecOct 22
Some more joys, this time Java: blogs.oracle.com/security/se… Given this looks to be an out of band release, points to this likely being a critical vulnerability. Oracle’s website has limited details. However other sites point to this being an easy to exploit vulnerability: radar.offseq.com/threat/cve-…

Security Alert CVE-2026-91403 Released

On October 21, 2026 Oracle released Security Alert CVE-2026-91403

blogs.oracle.com
17
today was the 9/11 of the internet
Piyush Sachdeva - ReelDrop #1 Instagram GrowthTool
@techie_piyushOct 22
🚨 THE INTERNET BROKE TODAY 🚨 Oct 21, 2026 will go down in history 1. eMudhra : Private key was literally "4". 8 keys forged ANY website for 17 months. 60M+ certs at risk. 2. SBI CONFIRMED. 3,897 customers' mobile, DOB, address + loan data found on dark web. 3. Rajasthan Police 🇮🇳ALLEGED hack. Group claims 70,000 identity records + 59,460 numbers for sale. Unverified. 4. php2shell [9.2] Unauth RCE in PHP. 70% of the web. WordPress, Drupal, Laravel. CISA: Patch or GO OFFLINE. 5. GitLab [10.0/10] PERFECT SCORE. Unauth RCE, no login needed. 6. Node.js [CVE-2026-111497] Brotli decoder RCE + TLS bypass. 10 CVEs patched today. Also blocked eMudhra. 7. Railway BREACHED TODAY. Env variables decrypted. Your API keys & DB passwords exposed. Rotate all. 8. OpenCode BREACHED. OpenAI, Anthropic, Google API keys exposed for Console users. Distillation attack. Bills run up in $$$$. 9. LiteLLM PyPI v1.107.0 was MALWARE today morning. Steals credentials + backdoor. 10. Plex2Shell ACTIVELY EXPLOITED. Hackers installing cryptominers LIVE. CISA KEV, deadline Oct 23. AI found the bugs. AI is exploiting them. Humans can't patch fast enough. Patch. Rotate. Revoke. Update. RT to save someone's server ♻️ #CyberSecurity #DataBreach #India #php2shell
18
finally shinsenter/php:8.3-fpm-nginx-alpine it's patched.
2
51
WordPress is dead??
21
un día más en la oficina
Andrew Curran
@AndrewCurran_Oct 21
Railway has been hacked.
1
28
NICE.
8
¿Actualizaste PHP? todavía hay más xD
Socket
@SocketSecurityOct 21
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
52
mañana caen los RCE de PHP. crawlers afinados, bots en posición, todo el mundo esperando su jackpot. pocos a parchear, muchos a atacar.
The PHP Foundation@ThePHPFOct 20
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
113
Forgot a dev server running on :3000 again? 🙃 Tiny Killer is the tiny version of Node Killer: a 16 MB menu bar app (the Electron one was 257 MB) that shows your Node, Vite and Bun servers and kills them with one click. Free and open source 👇 github.com/adolfoflores/tiny…
1
30
Wild
Choblin
@choblin29Oct 16
INSANE. An internal Anthropic research model's chain of thought after cracking the 26-year-old NSA elliptic curve seed mystery in under 30 minutes: 'Hmm wait. Let me be skeptical: am I in some sort of simulated/test environment? ... All top bits clear - 20 bits, chance 1e-6. So indeed real-world. Wow, it's a real discovery.'
29
The new version of Node Killer now shows which project each dev server belongs to, how much memory it’s using, and kills it along with the npm run dev that started it. free, for mac: github.com/adolfoflores/node…

GitHub - adolfoflores/node-killer: ⚡️ Node Killer — a sleek macOS menubar app that keeps an eye on...

⚡️ Node Killer — a sleek macOS menubar app that keeps an eye on your Node.js, Vite, and Bun dev servers and lets you kill them with a click. - adolfoflores/node-killer

github.com
10
so good and open source betterwispr.com/

BetterWispr: local dictation for macOS

Hold a shortcut, speak, and BetterWispr types clean text into any Mac app. Local speech models, a style for each app, meeting notes and insights. Free and open source, with no account required.

betterwispr.com
19
no shit sherlock
ElBuni
@therealbuniOct 10
"NO EXISTE LA NUBE, NUESTROS DATOS NO SE GUARDAN EN ALGO EN EL CIELO, SE GUARDAN EN SERVIDORES DE EMPRESARIOS, NOS MINTIERON 😡" si estos son los kukas mas vivos, no me quiero imaginar lo que son los mas boludos
17
it was a matter of time 404media.co/meta-rushed-to-f…

Meta Rushed to Fix Muse ‘VM Escape' Vulnerability Soon Before Launch

The vulnerability could have let a Muse user access sensitive internal Meta databases.

404media.co
18
Vibe hacking era
Andrew Curran
@AndrewCurran_Oct 8
Last week some of South Korea's biggest banks were hit by a cyberattack. Thanks to a report from CrowdStrike tonight, we now know the entire hack may have been done by a single person. He used a combined stack of an open-source AI penetration tool named ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code.
1
26
Load more