DARKMATTER (@darkmatrx) header
DARKMATTER (@darkmatrx) profile picture

◈ TECH NEWS • FINANCE • EXPLAINED

Joined February 2014
Photo by DARKMATTER (@darkmatrx)Photo by DARKMATTER (@darkmatrx)Photo by DARKMATTER (@darkmatrx)Photo by DARKMATTER (@darkmatrx)Photo by DARKMATTER (@darkmatrx)Photo by DARKMATTER (@darkmatrx)Photo by DARKMATTER (@darkmatrx)Photo by DARKMATTER (@darkmatrx)Photo by DARKMATTER (@darkmatrx)Photo by DARKMATTER (@darkmatrx)
🚨 这就是为什么现在一切都在不停暴跌 如果你仍然认为市场是按新闻交易的,你必须仔细阅读这篇。 因为那样的市场已经不复存在。 你现在看到的不是正常的价格走势。 这不是“糟糕的一天”。 这不是一次财报不及预期。 而且这绝对不是散户在抛售。 大多数人完全没有意识到正在发生什么。 而等到这一切变得明显时,损害已经造成。 这波走势不是今天才开始的。 它已经在表面之下悄悄酝酿了两天。 而现在它正在加速。 真相是: 在有报道称美国正准备在伊朗展开大规模作战的数小时后,杠杆开始平仓。 而当杠杆平仓时,价格不再跟随买家,而是跟随强制抛售。 这正是今天发生的事。 而这与已经发生在以下市场的断裂是同一个: → 纳斯达克 −4% → 芯片股 −9% → $BTC −5%,跌破$77,000 → 油价重回$90上方 大约2万亿美元的股票市值在一个上午内蒸发。 最初的中期选举反弹逻辑已经破裂。 昨天的反弹建立在两个想法之上: → 民主党控制的国会让新的打击更难实施 → 伊朗协议的希望使油价下跌8% 华盛顿加上以下这些的那一刻,这两个想法都破灭了: → 华尔街日报:官员敦促特朗普重启大规模打击 → 一些人希望他先发动打击,再寻求和平 → Axios:军方正在完成准备工作 → 更多美国军事资产被派往该地区 → 一名前顾问:特朗普“不想第二次看起来像个失败者” 从那一刻起,每一笔杠杆押注都变成了一笔实实在在的负债。 不是在头条新闻里。 而是在保证金账户里,而那才是真正重要的。 加密货币多头爆仓。 解释一切的指标。 60分钟内,4亿美元的杠杆多头被清算殆尽。 一旦强制抛售压倒真实买家,价格就不再对新闻作出反应。 它对追加保证金通知、止损和强制平仓作出反应。 交易所现在可以替你平仓。 它们不是在猜方向。 它们在做它们在每个杠杆市场都会做的事: 1⃣ 价格跌入一堵止损墙 2⃣ 保证金耗尽 3⃣ 交易所强制卖出 4⃣ 这笔卖单撞上下一堵墙 5⃣ 重复 这不是“恐慌”。 这是一条强制抛售链。 仅一个上午之内就刚刚出现了: → 美光 −13% → 英伟达 −7% → $ETH 下跌6% → VIX恐慌指数上涨超过40% 全都恰恰发生在同一时间。 这是同一个交易时段承受的4项索求。 那不是自由市场。 那是戴着伊朗头条面具的追加保证金通知。 你想忽视就忽视,但别假装你没被警告过。 需要关注的价位:$75,500,$BTC本周曾在此反弹。 电视会给你看芯片股和伊朗头条。把这条发给任何在用杠杆交易的人,让他们看到这条清算链。
69
199
13
1,075
451,109
DARKMATTER retweeted
UPDATING CHROME DOESN'T UPDATE ON YOUR MAC! Playwright, puppeteer, cursor, slack, discord, vs code and a bunch of other electron apps ship their own chromium. Those copies don’t auto-update. On oct 27 google pushed chrome 156.0.8078.73 with 52 security fixes (4 critical, including a sandbox escape). Your system chrome probably got it. The hidden copies didn’t. PASTE THIS into claude code / cursor / any coding agent: “find every playwright and puppeteer browser cache on this mac (~/Library/Caches/ms-playwright, ~/.cache/puppeteer, ~/Library/Caches/puppeteer). list each chromium build with its version and delete only the ones older than 156.0.8078.73. do not touch any apps. then check /Applications/Google Chrome. app /Contents/Info.plist for my system chrome version. Scan every app in /Applications and ~/Applications for Electron Framework. Framework, read its version and chromium version, and compare against the 3 currently supported electron releases (45/44/43). Give me a table: app | electron version | chromium version | supported (yes/no). Finally, if i have playwright mcp, set it to use system chrome with --browser chrome.” Took me X minutes. Found X outdated chromium builds, X GB of dead cache, and [app] on unsupported electron. Your browser is only as updated as the oldest chromium on your machine. Run it and reply with the numbers your received.
Don't delete Playwright. Paste this into Claude Code instead: "Find every Playwright/Puppeteer browser cache on this machine and delete the Chromium builds older than 156.0.8078.73. Then edit the Playwright MCP config to add --browser chrome --sandbox so it uses my auto-updated system Chrome. Also grep every Electron app in AppData for its Chrome/ Electron/ version string and tell me which ones are below Electron 43.8.6 / 44.10.1 / 45.2.1." Took 10 min. Found 3 vulnerable Chromiums, a dead Puppeteer cache, and an EOL Electron in Cursor.
20
4
25
736
DARKMATTER retweeted
$2,200 once and 11 watts at idle that's what a 24/7 ai employee costs now the math nobody posts: 1. hardware. used mac studio m1 max for about ¥350k (~$2,200). he says skip the new ultra 2. power. apple's own spec sheet: 11w idle, 115w max. even maxed out 24/7 that's ~1,000 kwh a year 3. stack. grok bot on top, codex + claude code + mcps underneath. one agent driving the others 4. access. anydesk into the box from your phone. you never sit at the desk the part that got me: two days ago he posted that grok bot driving claude code beats him prompting claude directly so the human job is now just assigning what would you hand it first?
35万円ほどでコスパの良く、24時間365日Grok Botを働かせるのにおすすめのセットアップは 中古のMac Studio M1 Maxです 最新のMac Studio Ultraは不要 Grok Bot経由でCodex, Claude Codeその他のMCP繋いでおけばほとんどのことできる でもパソコンつけるのめんどい AnyDesk, Casementでスマホをパソコンに繋げばオケ Galaxy Z fold 8かDuo、その辺の折りたたみスマホ気になってる 理由は
7
1
16
754
DARKMATTER retweeted
🚨 BREAKING: 🇺🇸 BLACKROCK JUST DUMPED $405,000,000.00 WORTH OF BITCOIN! INSTITUTIONAL SELLING PRESSURE IS INTENSIFYING! BITCOIN IS FACING ONE OF ITS MOST DANGEROUS MOMENTS THIS YEAR! THE WORST IS YET TO COME.
🚨 HISTORY SHOWS WHY PANIC-SELLING BITCOIN HAS BEEN THE BIGGEST MISTAKE! Run through the history: → 2010: BTC crashed to $0.10 → 2011: crashed to $1 → 2013: crashed to $50 → 2015: crashed to $200 → 2018: crashed to $3,000 → 2022: crashed to $15,000 → 2024: crashed to $39,000 → 2026: crashed to $60,000 Notice something? Every single one of those felt like the end of Bitcoin while it was happening. Every one came with headlines declaring it dead. Every one had people swearing this time was different. And every single crash bottom became a price people would later beg to buy at. $3,000 looked like a catastrophe in 2018. Today it looks like a fantasy. $15,000 felt like the death of crypto in 2022. Now it's unthinkable. That's the pattern nobody internalizes until they've lived through two or three of them. The crash price of one cycle becomes the dream entry of the next. The hard part isn't knowing this. It's believing it while your portfolio is bleeding and the timeline is screaming that it's over. Yesterday's disaster price is tomorrow's missed opportunity. Will history repeat itself? It always has!
2
3
12
670
DARKMATTER retweeted
$4 per million tokens just survived a whole month of google openai and moonshot throwing everything they had at it opus 5.5 dropped on september 22. less than two months after opus 5, and 20% cheaper. $4 in, $20 out per million tokens, with a 1M context then october happened > sep 30: google ships gemini 4 argon, the first gemini 4 model > oct 4: openai's codex lead tibo starts a 28 day challenge. every single day either a real improvement or a full reset of everyone's usage limits. day 1 alone made gpt-6 astra and sol about 50% faster > oct 23: moonshot drops kimi k3.1 pro with a 1M context and promises open weights > late october: codex pro and business limits get doubled for good three labs four big moves. one month and on artificial analysis' independent intelligence index, opus 5.5 still sits at 58. gpt-6 astra is at 53 it's not perfect. astra still beats it on terminal-bench-science, 64.6% vs 58.7%. and independent testers got a lower terminal-bench score than anthropic claimed but look at what october actually looked like from the outside one lab shipped a model and went quiet. the other spent 28 days handing out speedups, doubled limits and resets to keep people in the app that's not a model race anymore. that's a retention war. and retention wars get expensive fast the model doesn't have to be the best at everything. it has to be the one people stop switching away from so who actually won october for you: opus, codex or something nobody's talking about?
8
3
18
1,295
DARKMATTER retweeted
🚨The installer was real, signed by OpenAI. The file sitting next to it turned your PC into a crypto miner. Check Point researchers found fake "new versions" of ChatGPT and Claude on GitHub — "GPT-5.6 Sol", "GPT-6 Astra", "Claude Opus" — ranking high in Google search. What was in the download: • A genuine, signed Setup.exe from OpenAI or Anthropic • A malicious file next to it, winmm.dll • The real installer loads that file on its own. The signature checks out. The infection happens anyway. What it does: • Creates a scheduled task disguised as Microsoft that runs at every startup • Runs the XMRig crypto miner through Tor • Pauses mining while you're using the PC, so you don't notice the slowdown • The loader can also download other malware, not just the miner Timeline: • June: an earlier version used a fake Cursor AI app • Aug 30, Aug 31, Sep 4: malicious ChatGPT/Claude releases uploaded The real risk now: "A new version of an AI tool" is perfect bait. People search for it, click the top result, and see a valid signature. A signed file only proves who made that file, not what it loads next to it. This campaign targets Windows. If you use ChatGPT or Claude: download them only from openai.com and claude.ai, never from a GitHub page or a search result.
15
2
3
25
1,708
DARKMATTER retweeted
🚨 BINANCE RECOVERS 90% OF STOLEN FUNDS FOLLOWING $6.3 BILLION CYBERATTACK OCTOBER 31, 2026 | 17:00 A major development following one of the largest crypto heists in history. Binance has reportedly recovered 90% of the $6.3 BILLION stolen during Thursday’s cyberattack. Here’s what we know so far: - 90% of the stolen assets have reportedly been recovered. - Binance has allocated approximately $6.34 billion to cover the losses. - The remaining 10% consists of less liquid tokens and may take longer to recover. - Binance says customers will not bear the financial losses. - Withdrawals are expected to resume on November 1. The investigation is still ongoing. THE HACK WAS MASSIVE. THE RECOVERY IS EVEN BIGGER. Is this a turning point for crypto security? #Binance #CyberSecurity #CryptoNews #Hacking #TechNews
12
1
29
1,173
DARKMATTER retweeted
Satoshi owns 1.096M BTC worth $84B Nobody has touched it in 17 years Here's why it's untouchable: No single recovery phrase, no master key In 2009, Bitcoin generated a fresh private key for every single 50 BTC mined. Completely independent, no connection between them 21,900 separate keys 21,900 separate locks Crack one - you get 50 BTC The other 21,899 remain untouched AI can't brute force 21,900 independent keys Hackers can't find a pattern that doesn't exist The architecture itself is the protection
5
1
16
776
DARKMATTER retweeted
Jupiter said it had zero exposure to the Binance hack. Hours later: 3.35 USDC available to withdraw against 418.5 million in deposits. Jupiter Earn is a Solana app where you deposit crypto to earn interest. Your deposit gets lent out to borrowers. What happened: • Oct 29: ~$6.36B drained from Binance, most of it in about 20 minutes. The largest crypto theft on record, roughly 4x the Bybit hack • Blockchain firm TRM attributes it to North Korea's TraderTraitor group • Binance pauses deposits and withdrawals, says it will cover all losses • Bitcoin drops ~5%, below $77K • Oct 30, early morning: Jupiter posts "We have no exposure to Binance" • Hours later: a "liquidity crunch impacting withdrawals" How both can be true: Jupiter didn't lose money in the hack. But when the market panics, everyone tries to withdraw at once. Most deposits are out on loan, so there's almost nothing left to pay out. Jupiter says withdrawals resume as people deposit or repay loans. The real risk now: "funds are safe" and "you can withdraw today" are not the same thing. Frozen withdrawals are also when fake "claim your funds" links and DMs show up.
7
1
18
871
DARKMATTER retweeted
Cisco just gave a 27-year-old engineer unlimited AI tokens. The goal: rewrite 98% of the company's legacy code in 24 months, with a two-person team. He has four weeks to prove the approach works. He wasn't hired for this. Cisco bought his startup last year. The company's president found him five levels down the org chart, "doing something unstrategic". Nothing has been shipped yet. It's a bet. But it shows where the bottleneck has moved. Tokens are no longer the scarce part. Writing code is no longer the scarce part. The scarce part is proving the new code does exactly what the old code did. That's why four weeks is the real test. Not "can AI write it". "Can two people check it." If I had that brief, I'd start every module like this: Before changing anything in this module: 1. Write tests that capture what it does today, including the weird edge cases. 2. Run them against the old code. All must pass. 3. Rewrite the module. 4. Run the same tests. Show me every difference. Don't fix a test to make it pass. If behavior changes, stop and explain why.
9
2
23
725
DARKMATTER retweeted
$3.3 billion left Binance's hot wallets in 40 minutes tonight. If confirmed, it's the largest crypto hack on record. Binance is the world's largest crypto exchange. Hot wallets are its online wallets, the ones that pay out user withdrawals. What moved (Oct 29, UTC): • 20:24: 167,464 ETH + 63 tokens, incl. ~$1.6B USDT, from the "Binance 14" wallet • 20:41: 780M USDC from "Hot Wallet 34" • All of it went to one address created hours earlier, funded through Tornado Cash What's been frozen: • Tether: $1.567B+ in USDT • Circle: $823M in USDC • ~$2.4B in total, locked where it sits Where it stands: • Binance: investigating, says user funds are safe. No hack confirmed yet. • Founder CZ: "It does look like a hack on Binance." • Some on-chain tallies put total outflows above $5B. Not verified. The real risk now: For a normal user, the immediate problem isn't your balance. Binance says user funds are safe. The problem is what comes next: fake "Binance support" messages, "refund" links and "verify your account" emails timed to the panic. If you have a Binance account: don't click any link about this incident. Check only inside the official app.
The biggest crypto theft on record may have just happened. Binance still hasn't said how much. 20:21 UTC: a Tornado Cash-funded address installs a delegation on Binance Hot Wallet 14. 3 minutes 24 seconds later: 167,464 ETH and 1.615B USDT leave in a single transaction. By 21:22 UTC the on-chain count is $5.643B. About $97M a minute. Here's the receipt: → Ethereum: $3.528B → Bitcoin: $1.449B (18,270 BTC) → Tron: $628M → L2s: $38M → Frozen by Tether + Circle: −$2.316B → Still loose: $3.327B For scale: → Bybit, Feb 2025, the record until tonight: $1.46B. This is 3.9x → Binance's own 2019 hack: $40M. This is 141x The line most coverage skips: → Binance's emergency fund SAFU holds 15,000 BTC → The attacker took 18,270 BTC → SAFU at $79.3K/BTC = $1.19B, or 36% of what's still loose CZ: "user funds are safe." Binance: "investigating." No loss figure yet. Total: if confirmed, the largest hack ever, and the safety fund covers about a third of what isn't frozen. CZ expects the rest compensated in full. Watch: Binance's official number and whether SAFU gets tapped.
4
1
11
3,547
The biggest crypto theft on record may have just happened. Binance still hasn't said how much. 20:21 UTC: a Tornado Cash-funded address installs a delegation on Binance Hot Wallet 14. 3 minutes 24 seconds later: 167,464 ETH and 1.615B USDT leave in a single transaction. By 21:22 UTC the on-chain count is $5.643B. About $97M a minute. Here's the receipt: → Ethereum: $3.528B → Bitcoin: $1.449B (18,270 BTC) → Tron: $628M → L2s: $38M → Frozen by Tether + Circle: −$2.316B → Still loose: $3.327B For scale: → Bybit, Feb 2025, the record until tonight: $1.46B. This is 3.9x → Binance's own 2019 hack: $40M. This is 141x The line most coverage skips: → Binance's emergency fund SAFU holds 15,000 BTC → The attacker took 18,270 BTC → SAFU at $79.3K/BTC = $1.19B, or 36% of what's still loose CZ: "user funds are safe." Binance: "investigating." No loss figure yet. Total: if confirmed, the largest hack ever, and the safety fund covers about a third of what isn't frozen. CZ expects the rest compensated in full. Watch: Binance's official number and whether SAFU gets tapped.
11
2
2
17
1,768
DARKMATTER retweeted
it's "just a monitor." it reports what's on your screen every 15 seconds. plug a laptop or Mac mini into a smart TV and the TV still runs ACR on the HDMI input. @log4j caught it on a 2025 Samsung. what the IMC 2024 network audit found: 1. LG: sends to ACR servers every 15 sec 2. Samsung: every 60 sec 3. works when the TV is a plain HDMI display 4. opt-out is buried: up to 6 settings on Samsung, 11 on LG 5. once you opt out, the traffic stops completely what to change today: Samsung → Viewing Information Services: off LG → Live Plus: off Vizio → Viewing Data: off Roku → Use info from TV inputs: off menu paths change by model year, search the name in Settings. stronger fix: keep the TV off Wi-Fi. your Mac mini doesn't need the TV online. ▸ affected: Samsung, LG, Vizio, Roku TVs used as monitors · severity: privacy, on by default · fix: settings only, no tools
820 times in 24 hours. that's how often one Samsung TV tried to report what its owner was watching. I went through 5 TVs people checked this week and found the one switch that stops it: → Samsung: 820 reports in a day, 320 of them to the "what are you watching" server. the owner never meant to turn it on → TCL (Android TV 9): the tracking app switches itself back on after every reboot → Dijitsu: a hidden app posing as a system tool, talking to 30+ servers → a second Samsung: everything off, then an ad-blocking DNS on top → LG OLED: the switch is called Live Plus what you get: a 2024 study of Samsung and LG TVs found that turning the switch off stops the reports. until you do, it tracks even your laptop over HDMI. the switch: Samsung "Viewing Information Services", LG "Live Plus", Vizio "Viewing Data", Roku "Use info from TV inputs" the prompt that finds it on YOUR model in 2 minutes is in the reply. what TV do you have? reply with the brand
5
2
26
1,047
DARKMATTER retweeted
"Every single week it's going to feel like the sky is falling." That's Cloudflare CEO Matthew Prince, talking to Reuters today. He says we're in for "a couple of years" of this. If you were online this week, you already felt it. Security people are calling it Black October. Here's what broke in seven days: → PHP2Shell. Two critical flaws in the language behind most of the web. Government sites across Europe went offline as a precaution. → eMudhra. A trusted certificate authority whose private key was the number 4. Browsers blocked it. Then it quit the business. → Google Cloud London. One power event, ~8 hours. Revolut cards and the NHS app went down with it. → Railway. The developer platform told every customer to rotate their secrets. → Capcom. 11.7 million player accounts exposed. → Toronto Crime Stoppers. 176,859 "anonymous" tips leaked. → Quest Diagnostics. The lab that serves about 1 in 3 US adults confirmed patient records were stolen. Why now? Finding a serious bug used to take weeks or months. That gave defenders time to patch. AI can now scan code nonstop and turn a flaw into a working exploit in hours. One research firm says AI helped double the number of vulnerabilities found year over year. Prince says he already knows of "a bunch of additional severe vulnerabilities" in other critical software. The good news, in his words: "we're going to get a lot of this stuff cleaned up." The bad news: the cleanup is the part where everything breaks. What you can actually do: • turn on auto-updates for everything you can • use 2FA on your email first, then everything else • treat any "urgent" email about a breach as phishing until proven otherwise • keep a little cash. Tuesday proved why.
Almost every major website you used today is running on a language that just turned out to have a critical remote code execution hole sitting in its core for 14 years. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) isn’t a plugin vulnerability or a misconfiguration. It lives inside PHP itself — in how the engine handles memory and request state. Because of that, an attacker doesn’t need to find a bug in WordPress, Drupal, Magento, MediaWiki or whatever else is sitting on top. A single well-crafted request can trigger the issue before the application even starts running. The bugs affect everything from PHP 5.4 (2012) up to the latest unpatched 8.5 releases. PHP powers roughly 70% of websites where the server-side language is known. That includes most of the open web, a huge share of e-commerce, government sites, and a long tail of internal tools and forgotten staging servers. Patches landed today for the currently supported branches (8.2.35, 8.3.36, 8.4.27, 8.5.12). Older versions are end-of-life. They get source patches at best, and a lot of them will never be updated. Shared hosting, legacy VPS, and “it still works” boxes are now a permanent attack surface. What makes this different from most critical bugs is the scale and the timing. The vulnerabilities were found with the help of AI models (as part of OpenAI’s Patch the Planet work and independently by Wiz). Details leaked before the patch, so attackers had a window. Multiple security companies already reported exploitation attempts before the fixes were public. The technical fixes exist. The real problem is operational: most organizations don’t even know how many PHP processes they still have running, or where the old ones live. Those are the ones that will stay exposed.
3
1
13
749
DARKMATTER retweeted
3 SYSTEMS. 432 NODES. 22 SECONDS. And they move as one f*cking brain. Most people run Claude as one chat that forgets everything the moment you close it. The setup in this video runs it as 3 pyramids that talk to each other. It comes from one idea by Andrej Karpathy, co-founder of OpenAI. 23M+ views. Almost nobody built it properly. Here's the structure: ▲ Pyramid A: RAW. Every PDF, transcript and article you throw in ▲ Pyramid B: WIKI. Claude reads it all and turns it into linked notes ▲ Pyramid C: CLAUDE.md. The rules that tell the other two how to work Each pyramid holds its own logic. Yet all three move as one. Watch the numbers in the video: → integrity climbs from 92% to 100% → flow jumps from 4 Mb/s to 1,500 Mb/s → 36 of 36 layers aligned → 144 nodes per pyramid, all in sync That's what happens when your knowledge stops sitting in folders and starts compounding. The setup: 1. Create a fresh Obsidian vault, open it in Claude Code 2. Give Claude Karpathy's structure prompt 3. Claude builds all 3 pyramids itself: raw, wiki, CLAUDE.md 4. Drop any file into raw, type "ingest this" 5. Ask the whole structure anything. Instantly. 5 steps. 5 minutes. 3 systems. 1 brain. Full guide in the link below. Bookmark this. You'll want it the next time Claude forgets what you told it yesterday.
7
3
27
910
DARKMATTER retweeted
F*CK. Grok Bot just replaced a $150,000-a-year analyst for tracking overdue invoices, wasted ad spend and forgotten leads. SpaceXAI shipped Pages last night. Reports and dashboards that update themselves. The dashboard with the pretty charts can wait. Connect your data and ask Grok Bot for these 6 pages: → Unpaid invoices: "Every morning, show overdue invoices, days late and the total owed. Draft reminders. Don't send them." → Forgotten leads: "Find prospects we promised to follow up with. Show the last conversation and draft the next email." → SaaS renewals: "List upcoming renewals, their cost and any evidence of unused seats. Flag what I should review before it renews." → Ad spend: "Compare campaigns against my customer acquisition cost limit. Flag the ones above it. Don't change anything." → Customers at risk: "Find repeated complaints and unresolved support threads. Show the evidence and who needs to respond." → Broken promises: "Pull commitments from call notes and emails. List the owner, deadline and anything overdue." Put a source link and a last-checked date next to every finding. If it can't read the data, make it say so. I'd start with unpaid invoices. There's a very specific reason to open that page tomorrow. How to build the Grok Bot team behind these checks, set approval rules and control usage is in my article below ↓
15
10
1
77
4,411
DARKMATTER retweeted
Why is every AI f*cking obsessed with Japan? The paper is called "Why are all LLMs Obsessed with Japanese Culture?" and the bias isn't where you'd expect. In pre-training the models have a fairly balanced view of the world. The first clear signs of the Japan tilt show up after supervised fine-tuning, the step that turns a raw model into a polite assistant. So the "neutral" answer you get is what the model learned a good answer should sound like. Try it: ask your AI to pick a place three times and see what comes back.
Researchers proved every LLM is secretly obsessed with Japan. And they finally figured out why. They published a paper investigating hidden cultural biases in large language models. they tested 31,000 questions across 24 different languages on models like gemini, chatgpt, claude, and llama. they stripped out all geographic hints and just asked the models to pick a place and answer. the finding was universal.. across a wide range of models and languages, there is a pervasive "obsession" with japanese culture. even when you prompt them in a language with zero ties to japan, they default to japanese norms, values, and aesthetics at a disproportionately high rate compared to its actual global demographic weight. the craziest part? they tracked down exactly when the ai develops this obsession.. and it is not from reading the raw internet. during pre-training, the models actually have a fairly balanced, global view of the world. the obsession gets injected during the safety phase. when tech companies fine-tune these models to be "helpful, harmless, and polite," the ai starts mapping those corporate safety guidelines directly onto japanese cultural concepts. in the pursuit of creating the perfect, inoffensive, compliant assistant, they warped how the models view the world. the quantization process (compressing models to run faster locally) actually amplifies this determinism. the smaller and faster your local model is, the more stereotypically it behaves, causing japanese cultural tropes to spike hard. we spend all this time worrying about existential ai safety, but the real alignment problem is that our most advanced reasoning engines are hyper-fixated on japanese internet culture. every model upgrade is reinforcing an invisible regional bias that dictates how they generate stories, facts, and code. the cultural commonsense of the internet is not universal.. it’s just localized to whatever the heaviest reddit and anime wiki users were obsessed with.
6
3
12
582
DARKMATTER retweeted
Capcom just confirmed a breach of 11.7 million player accounts. Someone got into CAPCOM ID, the login system behind Street Fighter, Resident Evil and Monster Hunter. What leaked: • 11,774,247 email addresses • when each account was created • last login time and login count • the IP address of the last login 196 accounts had their passwords changed by the attacker. Capcom has reset those. No credit cards were exposed, and there's no sign that user passwords leaked. Capcom spotted it on October 19 and told police on the 21st. Nobody has claimed it yet. The real risk now is phishing. An email that knows your account and your last login looks very convincing. If you have a Capcom account: ignore any "Capcom" email asking you to log in, and turn on 2FA.
Almost every major website you used today is running on a language that just turned out to have a critical remote code execution hole sitting in its core for 14 years. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) isn’t a plugin vulnerability or a misconfiguration. It lives inside PHP itself — in how the engine handles memory and request state. Because of that, an attacker doesn’t need to find a bug in WordPress, Drupal, Magento, MediaWiki or whatever else is sitting on top. A single well-crafted request can trigger the issue before the application even starts running. The bugs affect everything from PHP 5.4 (2012) up to the latest unpatched 8.5 releases. PHP powers roughly 70% of websites where the server-side language is known. That includes most of the open web, a huge share of e-commerce, government sites, and a long tail of internal tools and forgotten staging servers. Patches landed today for the currently supported branches (8.2.35, 8.3.36, 8.4.27, 8.5.12). Older versions are end-of-life. They get source patches at best, and a lot of them will never be updated. Shared hosting, legacy VPS, and “it still works” boxes are now a permanent attack surface. What makes this different from most critical bugs is the scale and the timing. The vulnerabilities were found with the help of AI models (as part of OpenAI’s Patch the Planet work and independently by Wiz). Details leaked before the patch, so attackers had a window. Multiple security companies already reported exploitation attempts before the fixes were public. The technical fixes exist. The real problem is operational: most organizations don’t even know how many PHP processes they still have running, or where the old ones live. Those are the ones that will stay exposed.
2
5
1
31
13,063
DARKMATTER retweeted
THE FIREWALLS THAT ARE SUPPOSED TO STOP PHP2SHELL RUN PHP TOO. Palo Alto says every version of PAN-OS and Panorama is affected, and there's no fixed release yet. The exposure is the management interface, so for now the fix is keeping it reachable only from trusted internal IPs. It's not just Palo Alto. Germany's BSI lists the open source firewalls pfSense and OPNsense among the PHP-based systems likely affected. Cisco is checking 18 products and 13 cloud services, Webex and ISE among them, and says there are no workarounds. Fortinet is checking 12 products. FortiOS is in the clear. Meanwhile Wikipedia took some of its PHP systems offline as a precaution, and government and school sites went offline in the Netherlands, Finland, Germany, France and Denmark. Still no confirmed successful break-in anywhere. Lots of attempts, nobody has shown a real compromise yet. If you run a firewall with a web admin page, check who can reach it today.
9
8
4
47
6,095
#grav3yardgirl8MILLIONgiveaway enter for the chance to win over $14,000 in prizes! bit.ly/1H3t4iv
429
23,008
133
3,373