Addicted to Code | https://teapaw.org/t.co/5564DSCQTu | https://teapaw.org/t.co/js3okRiA8B | https://teapaw.org/t.co/AuER0n6TBy | https://teapaw.org/t.co/JH9A1Mxmon | https://teapaw.org/t.co/NEZoBux5et | https://teapaw.org/t.co/4pWwHCDK6f | y3zra.wam | https://teapaw.org/t.co/4iqsSDNvJ7
Maastricht
Joined September 2009
- Tweets13.8K
- Following486
- Followers1.4K
- Likes6.6K
Pinned Tweet
I built a thing: samspov.com
Wrote about it here (X text limit too short): news.ycombinator.com/item?id…
1
2
112
You can’t make this shit up… there is somebody live-streaming the downloading of the game… you can’t play it for like a week, this is just downloading of game files to your console… smh
31
Nick Kusters retweeted
A lot of people don't realize that Windows has a built-in feature called Windows "Sandbox" that boots up a brand new virtual Windows machine in seconds. So I made an MCP server so you can test your apps inside a throwaway machine in seconds. github.com/shanselman/sandbo…
Nick Kusters retweeted
Remote code execution in MS Paint.
cve.org/CVERecord?id=CVE-202…
yup....
Nick Kusters retweeted
I've started asking ChatGPT to write the most unhinged replies to every AI-generated cold email I get, and honestly, it's low-key my favorite part of the day.
I don't edit them. I just send as is every time.
Nick Kusters retweeted
🚨 PSA for anyone running a Linux server, node, or relay
CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.
Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.
What to do today:
1. Check your kernel: uname -r
Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed.
2. If your distro has a fix, update and reboot.
3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you.
4. Turn off MPTCP unless you need it:
sysctl -w net.mptcp.enabled=0
Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in.
5. Make it survive a reboot, and check it still works after one.
If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.
Self-hosting is freedom. Patching is part of the job. 🛡️
That's the big issue with exchanges; they are basically the richest honeypots around, so you have the biggest bullseye on your back. I'm sure we'll see more and more of this as time passes and assisted capabilities keep getting better and better.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
39
That’s a fun one
‼️ Google won't fix an Android bug that lets one invisible text crash a phone's calling service, researcher Mark Blaszczyk says.
So he just released the Proof-of-Concept!
The malformed message never reaches the inbox and needs no user interaction. It drops active calls, emergency calls included.
He says about 30 sent in a row corrupt the phone's SMS database, so a Pixel 9 or Samsung Galaxy crashes on every boot. A factory reset only helps until the carrier delivers the texts again.
He reported it to Google on 5 May. Google closed it as "Won't Fix" and a "Non-Security Issue".
Readers added context they thought people might want to know
Google will fix it as part of the November security update. A fix has already been pushed to AOSP in October, with the first commit in June.
x.com/GrapheneOS/sta…
49
Nick Kusters retweeted
Since the @Apple Bug Bounty Program is by far the worst program I've ever hacked on, I am going to be dumping all of the data/POCs/report write ups etc for everything found during the 4 months of hacking them. This will include POCs for vulns that didnt meet their bar for a bounty so wasnt reported to them, so you may be able to find ways to escalate some of them. Ill be uploading the data all this weekend.
Scary when you’re fully dependent on one thing you have 0 control over.
This quoted post is unavailable.
66
Nick Kusters retweeted
NEARLY 1 OUT OF 3 (60,000 EMPLOYEES) AT MICROSOFT BEING OFFERED VOLUNTARY TERMINATION
Emails should be going out any minute to those receiving the offer.
Absolutely insane.
$MSFT offers 60,000 employees a voluntary exit.
60K Y’all!!
First time this has ever been offered at Microsoft and it will affect employees in India, The United States, Canada, and the UK at level 70 or below…
Employees find out in a few hours if they are being targeted for this.
This just makes me think that H127 layoffs sound intense. Is this a pre-layoff round?
Also makes me wonder if they changed some scheduled layoffs due to be called out by @VP. Peace offering? 🤔 Timing is just interesting.
More to come.
Nick Kusters retweeted
🚨 Brotli2Shell goes beyond HTTP2Shell.
CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Google’s Brotli decoder that has been exploited for RCE and impacts far beyond HTTP.
JFrog reproduced RIP control in FFmpeg via a crafted JPEG XL file and identified additional attack paths in ClickHouse, .NET, and Apache Arrow, where some fixes were still unavailable at the time of writing.
We’ve also released an open-source scanner to uncover potential exposure beyond vulnerable package versions.
Full research and technical details in our blog 👇
Nick Kusters retweeted
i own a relatively new (2025) samsung tv.
i kept getting weirdly targeted ads.
i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic.
zero days it is. root shell on new samsung TVs!
discovered PRIVACY HORROR. write up?
Nick Kusters retweeted
"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."
thephp.foundation/blog/2026/…
Dagen als deze laten zien hoeveel impact een kwetsbaarheid kan hebben. Bij w43.nl bouwen we op C#/.NET, waardoor onze klantwebsites niet geraakt worden door deze specifieke PHP-lekken.
w43.nl/php-kwetsbaarheden
2
134
You can’t make this stuff up 🤣 they should not be allowed to be a CA if you don’t even have the basic understanding of what your business entails…
More private keys by the Indian certificate authority have been discovered. These are all small numbers.
People are suspecting that they interpreted 384 bit keys to mean that they should pick numbers from 1-384 to use as their private keys.
1
77
Nick Kusters retweeted
‼️ BREAKING: The private keys of 8 certificates from Indian certificate authority eMudhra were compromised, Mozilla says. Firefox blocked them within 3 hours.
Each key should be a 116-digit number, but one was just 4.
Anyone can guess them and forge HTTPS certs for any website.
