Security Researcher & Exploit Developer @therealgregoAI | AI Security
Pakistan
Joined October 2023
- Tweets2.2K
- Following2.5K
- Followers937
- Likes23.9K
ABDul Rehman | GregoAI retweeted
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
ABDul Rehman | GregoAI retweeted
A new $10K pledge for Ethereum security!
@therealgregoAI has committed $10,000 to the Open Standard and Automated Triage Tooling for Ethereum Security Issues initiative in TheDAO's ETHSecurity Initiatives Round.
This grant will support Runtime Verification's work on open-source tools that help security teams check whether reported vulnerabilities can actually be reproduced under real-world conditions.
With AI making security reports easier to generate, the need for reliable, automated triage is growing.
The aim is simple: spend less time sorting through invalid reports and more time addressing real security threats.
Big thanks to GregoAI for backing this work!
Explore the initiative and help fund it: initiatives.thedao.fund/init…
ABDul Rehman | GregoAI retweeted
messaging my wife a link containing proof of her husband cheating on her from an anonymous instagram account and then when she clicks on it texting her to let her know she failed the family phishing test and she has to retake my cybersecurity course
ABDul Rehman | GregoAI retweeted
🚨 Nightmare day for cybersecurity
Multiple major security incidents, active exploits, supply chain compromises...
If you run production systems, start patching NOW.
PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW
LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets.
eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores.
Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs.
TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff.
Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors.
BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign.
And that's not even the full list.
Patch. Audit. Rotate. NOW.
ABDul Rehman | GregoAI retweeted
We recently started hunting bugs outside of Web3 using @therealgregoAI with impressive results
This is one of the first vulnerabilities we have been able to disclose (with many more to come)
TLDR: Apple's PCC revocation check was a no-op and revoked nodes kept getting the mesh keys for in-flight Apple Intelligence data
Fixed in 26.4. Happy halloween! 🎃
@elonmusk a humble request for full markdown support in X articles as technical write-ups become difficult to accurately comprehend without it
ABDul Rehman | GregoAI retweeted
i used to often think how if i was born a few years earlier, i would've caught so many *obvious* opportunities such as crypto pre-2017. i was even sometimes mad that such opportunities seemingly no longer exist.
and every few months i just get humbled as i look back and realize i've missed even more *obvious* opportunities.
ABDul Rehman | GregoAI retweeted
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
ABDul Rehman | GregoAI retweeted
it is absolutely insane what elon has done for humanity
it actually makes no sense
electric, self-driving, flying cars -- openai, reusable spaceships, planetary expansion, new internet network that decides wars, paypal, x, solar, neuralink, hyperloop
brother how???
ABDul Rehman | GregoAI retweeted
yBorg - Week 3 Day 1
Today we kicked off our bug bounty hunt with an alpha-packed talk and Q&A with reknowned bughunter @0xriptide
We also covered preliminary steps to consider before kicking off an ai-assisted bughunt.
Enjoy the vid, and post your comments below 👇
ABDul Rehman | GregoAI retweeted
Update Telegram Desktop immediately!
A critical vulnerability has been discovered that allows attackers to gain access to your account and secretly steal files from your computer.
The attack uses links in the format tg://. If a special command is constructed, clicking the link can cause a malicious script to send a selected file to the attacker’s channel - without requiring additional confirmation.
