互联网要被打成筛子了,但这也是一个契机,可以强迫推动大量历史遗留系统升级。写了一篇《当互联网真被打成筛子》 mp.weixin.qq.com/s/EnzaFf4EF…
让我们想象一下你司架构是 NGINX v1.23.0 作为边缘节点,后面挂着 PHP-FPM 7.3 (刚花了几周时间从 5.6 升级上来) 的源站 + 前段时间刚花了大价钱采购来的 TiDB NewDB + Node.js 24 LTS Brotli 中间件,开启了 Brotil 压缩功能、Go 作为对外访问的网络沙箱、使用 Python + LiteLLM AI 企业内部 Harness 工具 (CI 昨晚刚从 PyPI 拉了新包并推送到了生产环境,现在全公司电脑都装上了这套 Harness)、公司服务器全部跑在 Linux 内核 c6e50df8 之前、网站的 HTTPS 证书由公司前段时间刚采购的无保险低价 Sectigo DV 证书(还没上 ACME 自动签发)、公司的 Vyper 智能合约部署在 Docker 29 + Kubernetes + Traefik Ingress 上开着 mTLS fail-open,宿主机还跑着 ASP.NET Core 面板和 .NET 本地服务、公司的软件和外发机密文件通过 emSign 代码签名,根证书库用 Go crypto/x509 + Rust webpki-roots + Python certifi
而你,是这家公司的核心 on-call 运维。
TiDB Cloud 也被爆破了。老冯之所以推崇本地自建的一个原因,就是压根不联网的Air Gapped 的系统通常只要一道物理安全就可以将绝大多数威胁挡在门外。按照现在云服务器和云虚拟机漏洞被披漏的节奏来看,很快都会成筛子了。
🚨🚨🚨Cyber Alert ‼️
🇺🇸USA - 𝗙𝘂𝗹𝗰𝗿𝘂𝗺𝗦𝗲𝗰 𝗖𝗹𝗮𝗶𝗺𝘀 𝟭𝟬.𝟲 𝗧𝗕 𝗗𝗮𝘁𝗮 𝗕𝗿𝗲𝗮𝗰𝗵 𝗮𝘁 𝗣𝗶𝗻𝗴𝗖𝗔𝗣 𝗜𝗻𝗰. (𝗧𝗶𝗗𝗕 𝗖𝗹𝗼𝘂𝗱), 𝗣𝗼𝘁𝗲𝗻𝘁𝗶𝗮𝗹𝗹𝘆 𝗘𝘅𝗽𝗼𝘀𝗶𝗻𝗴 𝗠𝗮𝗷𝗼𝗿 𝗚𝗹𝗼𝗯𝗮𝗹 𝗖𝗼𝗺𝗽𝗮𝗻𝗶𝗲𝘀
The FulcrumSec hacker group claims to have breached PingCAP (TiDB Cloud), allegedly exfiltrating 10.6 TB of data comprising approximately 4.9 million files.
According to the threat actor, the compromised data includes production databases, source code, customer records, credentials and API keys, potentially affecting over 180,000 organisations.
Companies named in the allegedly stolen records include Booking, Shopee, CAPCOM, Colopl, TOPPAN, Catalyst Software, SB Payment Service, Mercari, PayPay, Fujitsu, SoftBank, DMM, AEON, Square Enix, Konami, BANDAI NAMCO, Delhivery, Flipkart, Quincus, Nylas, Airbnb, Pinterest, Databricks, Bitget, Pionex, DigiPlus, NFTscan, Baidu, SES-imagotag, Persona, Transsion, ZOZO, Gumi, Iret, Classmethod, Wetech, Atlassian, Cygames, SBI, LINE, Chainbase, and PatSnap. Additional companies referenced in other allegedly compromised records include Accenture, Red Bull, Klook, Tencent, Huawei, ByteDance, Mastercard, AIG, and Amazon.
The group also claims to have released an initial 200 GB dataset and threatens further disclosures.
Threat actor: FulcrumSec
Sector: ICT
Data exposure (claimed): 10.6 TB (4.9 million files)
Data type: Production databases, source code, customer records, credentials and API keys
Observed: Oct 19, 2026
Status: Pending verification
ESIX©: 7.70
Full details and impact assessment on HackRisk.io
本月例行 Silo 更新,又修了一堆漏洞与缺陷。发布了一个 20261018 版本,干这种硬活还是 ChatGPT Astra Max 最靠谱,烧了大概七八个周配额。另外,也达到了一个新的里程碑, 4K GitHub star,以及接近四百万的 Docker Pull。 silo.pgsty.com
SILO 20261018 is out—our community-maintained, open-source MinIO fork.
• Fixes Object Lock retention bypass & IAM auth CVE • Reliable STS credential revocation • Prevents data loss during pool rebalance • Console 2.4.2 & kes included
silo.pgsty.com/
Oink 1.3 发布,新增了 expo 布局。同一个主题,不仅可以用来写技术文档,发博客,写书,现在还可以拿来当相册用了。github.com/pgsty/oink 。做了几个自用收藏站点。
昨天与 Claude,ChatGPT,Gemini 一起聊了聊这轮 AI 资本泡沫将以什么方式破裂。我的看法是,生产力革命是真的,但 AI 渗透率还是太低了,撑不起这轮资本泡沫。
mp.weixin.qq.com/s/B6uNVkmDy…
Karpathy 发帖说前沿 AI 用户可能就五千人左右。我也找 Claude & Gemini 估算了一下漏斗不同层次的 AI 用户数量有多少,十几个订阅哐哐蹬的这种重度AI用户,全球可能也就十万不到。《AI 深透率,可能没我们想的那么高》vonng.com/ai/funnel/
Dusting off this tweet from April because this gap in shared understanding of LLM capability is *widening*. It's now less "two groups of people speaking past each other" and more a sharp funnel.
- Napkin math somewhere around 6B people (~75% of the population) have barely come in contact with LLMs at all.
- Around 1-2B (~20%) are casual and infrequent users of free-tier ChatGPT-like products. This group sees derpy chatbots and treats them a bit like a better Google search, a writing aid, or etc. Maybe an agent tries to book you a flight. I have non-tech friends who (reasonably, imo) say they have not much use for it at all. Even many professionals outside of math&code are in this tier. For example, execs and many other functions spend a lot of their time talking to other people, so while they understand what is happening intellectually, it is still second-hand and a bit abstract.
- Now we get to professional use of frontier-grade LLMs in math&code. Somewhere around 20M people (0.2%) see first-hand that large, complex projects that used to take them weeks/months can now be completed by agents with a prompt. Building apps, copying apps, translating apps, decompiling apps from binaries... This has all happened very quickly and recently - less than 1 year ago, I was writing code manually by hand, typing memorized computer code commands into a code editor character by character, occasionally pressing Tab to autocomplete a little chunk of code.
- And finally we get to the ~5,000 people (~0.00006%) with access to frontier-grade systems internally. The external world has seen the preview. It looks like swarms of thousands of agents collaborating over weeks on software mega projects: minting zero days, running cyber attacks and defenses at machine speeds, discovering new science, advancing the frontier of mathematics. Things that would have taken top professionals in the industry years of work. Meanwhile, human review and comprehension are starting to fall behind. For example, people are still involved in the "archeology" of the OpenAI-HF incident from many months ago. Mathematicians may be poring over the 722 manuscripts on frontier mathematics for a while.
The funnel is driven by a combination of factors:
1. The impact scales with ambition, problem size, and horizon. A question with a paragraph answer barely stresses the system. You need a reservoir of big, difficult problems that you really care about. This aspect drives the consumer / professional dimension of the funnel.
2. The jaggedness of the system (which I have written about a lot separately). Capability peaks in domains that are digital, verifiable and economically valuable. This is because LLM capability emerges from reinforcement learning on verifiable rewards on a curated environment mixture driven by revenue potential. This aspect primarily drives the area (e.g. math&code) dimension of the funnel.
3. Access. Free-tier, paid-tier, internal.
So this is the weirdness of the moment. The general public has mostly not interacted with these systems. When they have, it looks like a derpy chatbot. The majority of professionals still see only a modest uplift. And a small sliver of professionals are experiencing the vertigo of the curve going vertical. And it is all happening at the same time.
白给 4c8G x 5 的美西资源,谁不喜欢呢?
Stop using your laptop / Mac mini / VPS
Introducing instabox.sh, cloud computers for AI agents:
- 4 vCPU, 8 GB RAM spun up in <1s
- Built-in computer use
- Snapshots for easy cloning
- Persistent files, packages, config
- Public URLs for local ports
We're launching today through an invite-only beta program.
Early access includes 20 vCPU, 40GB RAM for free.
If you want to try, comment or DM me.
最近在整理相册与图片收藏,顺便就给俺的文档主题 Oink 添加了一个新的布局:expo ,然后让 Codex 把各种图片收藏转换成一个在线博物馆静态站点。oink.pgsty.com
入乡随俗,润可是个大工程,有大量的默会知识和习惯法需要学习。俺这两天又烧了一本《美利坚生活指南》,相当于一次性把关于美国的各种问题全丢给 ChatGPT 来批量询问,供自己和朋友参阅。 us.vonng.com
另一个消耗掉大量闲置 Token 的站点是 doc.pg.center,收录了六个 PG 生态重要组件的六国语言文档。patroni / pgbackrest / pgbouncer / pgbadger / haproxy /etcd 的中英法日德俄语,PG 高可用,PITR 的核心组件。




























