CS @nyuniversity | Larping @senbuilds
New York, NY
Joined August 2025
- Tweets38
- Following16
- Followers44
- Likes88
Pinned Tweet
Using Jev for AI-driven OSINT investigations
findmore.me/blog/benchmarkin…
Node.js: security releases for 22.x, 24.x and 26.x fix several high-severity vulnerabilities.
teapaw.org/nodejs/status/21130374…
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
GitLab patched CVE-2026-110264, an unauthenticated RCE rated CVSS 10.0. It hits every self-managed release back to 2014.
If you self-host, this is as bad as it gets.
Fix: upgrade to 19.5.1, 19.4.3, 19.3.6 or the backport for your branch.
docs.gitlab.com/releases/pat…
eMudhra is investigating an incident affecting some TLS certificate customers. Cloudflare is mitigating 8 eMudhra intermediate certs with weak keys, and the PSF says to update your CA certificates.
teapaw.org/eMudhra/status/2112634…
teapaw.org/Cloudflare/status/2112…
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next. cfl.re/487DNbG
Java: Oracle issued an out-of-cycle alert for CVE-2026-91403, a JSSE flaw affecting Java SE 8 through 27 and GraalVM.
oracle.com/security-alerts/a…
LiteLLM: malicious 1.107.0 builds were pushed to PyPI, Docker Hub and GHCR. If you ran them, treat your credentials as exposed.
teapaw.org/LiteLLM/status/2112945…
Hello,
At 6:32 a.m. PDT we became aware of malicious LiteLLM 1.107.0 artifacts published to PyPI, Docker Hub, and GHCR, which were published at approximately 4:40 a.m. PDT. Enterprise deployments pulling only from our private registry are unaffected by this incident.
We are coordinating communication around this incident in this GitHub issue (github.com/BerriAI/litellm/i…).
We have removed the malicious releases and images. If you installed or ran them, please follow the remediation guidance in the above-linked issue and treat credentials accessible to those deployments as exposed.
Sincerely,
Oliver Jensen
Director of Security - LiteLLM
![[SECURITY] litellm 1.107.0 compromised (PyPI removed; Docker latest/main-stable removed): cook.pth...](https://pbs.twimg.com/card_img/2115420487287500800/8jVOY-c1?format=jpg&name=800x419)
PHP: emergency releases for two critical unauthenticated RCEs, CVE-2026-109618 and CVE-2026-109619.
Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
teapaw.org/php_net/status/2112901…
PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619).
Changelog + downloads: php-net.pro/news/php-8-5-12-…
Keeping track of all of the security incidents in the last 36 hours. Here's every incident officially confirmed 🧵
Railway: someone got unauthorized access to the systems storing customer environment variables, and some may have been decrypted. Builds and deploys are paused.
If you deploy on Railway, rotate your secrets now.
teapaw.org/Railway/status/2113025…
An urgent notice from the Railway team
blog.railway.com/p/security-…
Added 2k more users in 4 months (excluding thousands of anonymous users)
Update: @Deepfind_me is now over 2.5k registered users and thousands more anonymous users too.
Thanks so much to everyone who's supported us along the way 💙
Frameworks make AI agents look like magic
If you want to understand the underlying mechanics, you have to write the core loop yourself
so I wrote a basic technical guide breaking down how to design an agentic system from the ground up buddhsentripathi.com/blogs/b…
Buddhsen Tripathi retweeted
here’s a simple github repo for automating cold email outreach
check it out or use nimu./app if you want something easier
github.com/buddhsen-tripathi…
Buddhsen Tripathi retweeted
btw won 2nd place overall
fun weekend at @datadoghq nyc office 💜
Built RossMD for the @tokensandai Agentic Engineering Hack as an attempt to automate denial rescue in healthcare workflows
The system uses @nimble_search for data scraping, builds a knowledge graph of NYC healthcare and medical-law docs hosted on @ClickHouseDB, Gemini for reasoning and uses @datadoghq for observability and monitoring
#TokensAnd
Buddhsen Tripathi retweeted
New tools added to @Deepfind_me
46 active tools now, more to come 👀
Update: @Deepfind_me is now over 2.5k registered users and thousands more anonymous users too.
Thanks so much to everyone who's supported us along the way 💙