Post-Sovereign Chief Biomaximizer. Zcash, not communism. If I detect AI responses to my post I will kill myself racistly.
Network
Joined April 2012
- Tweets28K
- Following5.4K
- Followers13.7K
- Likes33.5K
Pinned Tweet
Why Zcash?
All of crypto is an open database that is traceable. If you want self sovereign money safe from government overreach and seizure, it also needs to be undetectable.
Zcash has the same economic policy as Bitcoin (21m total coins, same halving schedule started later), but it becomes entirely fungible by encrypting the ledger. When you realize that even Satoshi himself can’t use his Bitcoin, the importance of total encryption hits home.
I think this gets more important as we face the confluence of
1) USD monetary issues via money printing, inflation and unlimited debt,
2) the rise of communist movements and authoritarian wealth seizures, and
3) the massive increases in AI capabilities leading to more tracking and surveillance
When Bitcoin was started in the aftermath of the 2008 financial crisis, the concern over money printing aka “quantitative easing” was just beginning, it was not yet obvious there would be a problem.
At the same time, money as system of control was merely an issue for terrorists and murders. Now the theoretical issue has become real as freezing or confiscation of political adversaries becomes more common.
Today we face all these pressures at the same time: monetary debasement, political censorship, and hyper surveillance.
These were less apparent when Bitcoin was started, and the threat of hyper surveillance was not solved until Zcash forked Bitcoin’s code and made it encrypted Bitcoin.
This is why Zcash.
Zcash, not communism.
Hopefully the SSN system gets exploited so badly we are forced to move away from public keys as private keys.
If only there were some sort of cryptography a user could employ to sign authorized actions…
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
I've designed a new post-Quantum post-AI hash function.
f(x) = x*4
Its a very good hash function sir.
Tom Howard retweeted
The takeaway of this php thing should not be “the world is ending today”.
Rather it should be “the software status quo was bad, and you should assume 70% of the Internet is already rooted by one three letter agency. AI helped us catch this and remove it from ongoing risk”
Tom Howard retweeted
Over the last month, the zakura runtime has gone from dependencies with 250+ aggregate maintainers to now sub 100. And it is only decreasing.
This is the lowest to have ever existed in zcash’s rust nodes
Critical things to apply to any software:
- minimumReleaseAge 3-7 days for any dependencies, to prevent npm credential takeover attacks
- reduce the number of packages your software relies on by 80%. AI can often oneshot an equal or cleaner implementation for your specific usecase
- update to the latest software versions, even LTS often hides worse architecture that can hide more bugs
- stop using php. in general, choose an optimal stack even if it means a rewrite. linux + rust with strict typescript frontends are a solid base
- continually run abliterated GLM-5.3 redteam models across your codebase. adversaries will be reverse-engineering binaries, you have a defensive advantage via source code
- reduce the blast radius. does everything need to run through trusted centralized servers or can you do edge-to-edge encryption/authentication? crypto's decentralization patterns have many security advantages which also apply to web2
If you don’t encrypt your own data it’s probably getting leaked this year
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
As the Internet gets compromised and tries to figure out where all their servers are…
It’s nice to know that decentralized consensus is very resilient to this…
Working code means running blockchain, so patches happen fast and completely.
Zcash did this.
California needs to raise property taxes to 10% a year. It’s the only way to cover the healthcare budget shortfall. It’s time for all the greedy land owners to pay their fair share.
What Europe lacks in thymos, the world lacks in Thymus
Surprising no one, Britain has no jurisdiction in the matters of FREEDOM in the USA.
@ofcom can go suck a big dick.
Ofcom Concedes Defeat in the 4chan Case
prestonbyrne.com/2026/10/20/…
So it appears that @drakefjustin was correct about AI breaking cryptography
Interesting benefit to having decentralized consensus: an incentive to coordinate flawless patches.
Zcash went through superhardening before the whole internet got hacked.
Zcash got ahead of the world on post-AI security, just as it is getting ahead on post-Quantum security.
The Zcash team is still vigilant and directing a swarm of agents that constantly bug hunting.
In the last 24 hours:
1. iPhone 11 through 16 are apparently vulnerable to remote attacks.
2. SSL certificates are broken until browsers remove eMudhra CA.
3. PHP >9 vulnerability CVE published (tomorrow).
The world is about to witness things that have never been seen before.
Readers added context they thought people might want to know
The post's iPhone claim is inaccurate; a leaked Cellebrite forensic tool targets a Bluetooth bug patched in iOS 26.5 and does not affect updated devices. The eMudhra CA and PHP issues are real incidents but framed sensationally.
justin.sh/blog/2026/10/c…
blog.mozilla.org/security/2026/…
php.net