Programador · IA · tech · always learning · building things
Argentina - Buenos Aires
Joined January 2009
- Tweets48.9K
- Following989
- Followers985
- Likes31.2K
Pinned Tweet
Me encanta esta frase teapaw.org/Sorlak_15/status/69470…
Anibal Ardid retweeted
‼️ Tailscale finally issued patches for SSH flaws that could turn one hacked device into root access on other servers.
The Tailworm research demonstrated rapid lateral movement across policy-permitted devices, without stolen passwords or user interaction.
⚠️ Headscale remains UNPATCHED.
Read - thehackernews.com/2026/10/ta…
Anibal Ardid retweeted
Pero mira el PEDAZO DE PUBLICIDAD que se mando Mercado Libre con Colapinto.
JAJAJA el detalle de la cintita roja 😭
Nadie nos gana haciendo publicidades. ES CINE, viejo. CINE.
Anibal Ardid retweeted
🚨 ACABAN DE LIBERAR GRATIS UN HACKER CON IA QUE ATACA TU APP CADA VEZ QUE SUBES UNA RELEASE
Ya va por más de 48.000 estrellas en GitHub.
Y no te da una lista de "posibles fallos". Te enseña por dónde entra.
Se llama Shannon y es un pentester con IA open source.
Lo apuntas a tu app e intenta romperla como lo haría un hacker de verdad.
Lo que hace:
→ Usa exploits reales, no suposiciones
→ Si no consigue explotar un fallo, no lo reporta
→ Lo metes en GitHub Actions o GitLab CI y se ejecuta solo en cada release
→ Te entrega un informe PDF profesional listo para pasar al cliente o al equipo
→ Y exporta en SARIF para que los fallos aparezcan directamente en tus herramientas de desarrollo
Los tests te dicen si tu app funciona.
Esto te dice si alguien puede entrar.
Antes, un pentest era algo que se hacía de vez en cuando.
Ahora tu app pasa por uno cada vez que la actualizas.
Open source. Funciona con el modelo que ya usas.
Repo en el primer comentario 👇
Anibal Ardid retweeted
Imagina llegar con la ilusión de disfrutar de tus vacaciones en Cancún y ser recibido en el Aeropuerto por recaudadores de impuestos que actúan como buitres. Esa es la primera imagen que se lleva el turista internacional.
Anibal Ardid retweeted
🔐 ⚠️ phpMyAdmin 5.2.3 - 2FA Bypass! 0day++! ⚠️ 🔐
🚨 WebAuthn signatures are parsed but never COSE-verified against credentialPublicKey 🚨 Arbitrary bytes pass the structural checks, so 2FA falls over after password auth 💀
Exploit:
> CWE-347/287 ⚠️ CVSS 8.1
> 🐙 github.com/abraxas/PMA-5.2.3…
🧩 Root cause: web-auth/webauthn-lib is only a dev/suggest dependency 📦 The distributed tarball is built with `composer install --no-dev`, so `WebAuthn::createServer` instantiates `CustomServer` instead of `WebauthnLibServer` 👀
🔍 How? 🤦♂️ `CustomServer::parseAndValidateAssertionResponse` enforces structural checks only: clientData type, session challenge, origin host, rpIdHash, user-present, allowed credential id 📋 `response.signature` is decoded and never verified ❌ `credentialPublicKey` is never read 🕳️
💥 Impact: a well-formed assertion carrying correct structural fields and an arbitrary signature yields a full authenticated session 🔓 Impact is unauthorized database access through the application, not host-level code execution 🗄️
Anibal Ardid retweeted
Looking for a free alternative to Overleaf?
Vincent Arel-Bundock built LibrePaper, an open-source platform to write papers with your co-authors, with live preview, comments and tracked changes.
Tool: librepaper.org
Subscribe: assistweekly.org
Anibal Ardid retweeted
Announcing plugins for OpenCode Desktop
Make your own opencode.ai/v2/docs/build/pl…
Anibal Ardid retweeted
These days, it's so easy to create futuristic applications and TUIs. Make it look like your favorite hacker movie.
github.com/bjarneo/velo
Anibal Ardid retweeted
Introducing 1git
A native Git client for macOS. GPU-rendered (GPUIX-GPUI), Open-Source, and calm by design
Tabs for every repo. Local or SSH in one workspace. Multiple accounts support
here → git.1bye.dev
Anibal Ardid retweeted
Trending repository of the day 📈
security-audit-skill
A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
Last 24h: 2,874 ⭐
Total: 45,815 ⭐️
github.com/cloudflare/securi…
Anibal Ardid retweeted
💥 BREAKING: Electrum patches critical flaw exploited in the wild
> Version 4.8.3 fixes a flaw letting malicious servers swap a payment for one paying an attacker
> The trap triggers when a user bumps the fee, signing the attacker's transaction
> Two users reported attacks, one lost funds, the fake address matched the real one's last four characters
> Every version before 4.8.3 is affected, upgrade and check addresses before signing
@ElectrumWallet
Anibal Ardid retweeted
‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers
Details: cybersecuritynews.com/tailsc…
A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each other over a private network. The report lists 11 findings in five groups.
They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks.
The researcher tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026. The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root privileges on the machine.
#cybersecuritynews
Readers added context they thought people might want to know
The flaws require an already-approved device in the Tailscale network with SSH rules permitting access/forwarding; they enable post-compromise lateral movement and escalation inside the tailnet, not unauthenticated remote access from outside.
tailworm.com
brandefense.io/security-news/…
tailscale.com/security-bulle…
x.com/mmaunder/statu…
Anibal Ardid retweeted
Say "oh my" to Hermes.
Full omh TUI on Hermes Agent. One goal becomes a graph of subagents across model families, with lanes running live under your composer.
github.com/rlaope/oh-my-herm…
Anibal Ardid retweeted
🚨 JUST IN: Hardware wallet maker Keystone says hackers got into its website and walked off with customer names, contact details, home addresses and order info.
Seed phrases and keys weren't touched, but expect a wave of fake "Keystone support" scams.
