Michael Parenti retweeted
PSA for Claude Code users:
1. Claude Code bundles its own Bun runtime, independent of your system's Node.js installation.
2. I confirmed that Claude Code 2.1.296 includes Bun 1.4.3, which contains the newly disclosed Brotli RCE vulnerability.
3. Note that while updating your system's Node.js is important, that won't fix the Bun runtime embedded in Claude Code.
4. To check your claude code version run "claude --version". It should be at least 2.1.308.
5. To patch the vulnerability, run "claude update".
PSA for people running AI agents:
1. If you have AI agents that browse the web, they could be vulnerable along with your entire computer.
2. There's a good chance they're using Node.js, and if they are, they're likely running a vulnerable version unless updated yesterday.
3. The vulnerability released yesterday for Node.js allows for remote code execution, which means an attacker could take control of your machine.
4. To fix the vulnerability, update your Node.js installations to a patched version: 22.23.4, 24.22.1, or 26.12.1 (or later).
just machines to make big decisions, programmed by fellas with compassion and vision, we'l be clean when that work is done, we'll be eternally free yes, and eternally young...ooooh... what a beautiful world this will be, what a glorious time to be free...
youtube.com/watch?v=Di0_KYtm…
Michael Parenti retweeted
Crypto has two years before the US government will hunt us down, target us, jail us and even kill us. Before the evil eye turns its cold gaze towards the people building a free anonymous p2p future.
Why?
The global order is disintegrating. The US people will see a drop in their living standard. This will breed resentment and radicalization in politics. Crypto will become the easiest scapegoat for the incoming democrat government in two years. There will be intense lawfare the likes we have never seen before. This will radicalize crypto and be the start of a new crypto wars which we will win.
Change is not gradual but sudden. Things compound & accelerate.
Lenin said there are decades where weeks happens, and weeks when decades happen. We are entering an inflection point when the political, economic, and technological order will change faster and faster.
The next two years will define the future of anonymity, free speech and sovereignty.
𝗚𝗲𝗼𝗽𝗼𝗹𝗶𝘁𝗶𝗰𝗮𝗹 𝗦𝗲𝗶𝘀𝗺𝗶𝗰 𝗦𝗵𝗶𝗳𝘁𝘀
The US offers security to rich arab oil states in exchange for them backing the US dollar. This arrangement is called the petrodollar system. It is why the dollar is the most powerful currency in the world.
The Iran war has been a disaster for the US. It has been unable to protect its bases and is forced to move out of the middle east. It is locked in an unwinnable conflict. The US cannot guarantee protection for its arab friends. This will severely harm the petrodollar system. These costs won't be passed onto elites but to common working people in the US.
Saudi, Turkey, Pakistan and Saudi are forming a confederation to guarantee their own security - a signal of the failing US led order. Their plans include extensive transport and energy networks which bypass and sideline Israel. Israel which is a western colony in the middle east has become a pariah state even by formerly close US allies. Saudi asked the US for help with the Houthis in Yemen but the US refused.
Since the US is unable to guarantee security, China will fill the vacuum. China is friends with Iran and can get security guarantees from Iran.
At home, the economic consequences of declining American influence will not be distributed equally. The costs of geopolitical upheaval and economic restructuring will fall on ordinary people. Political priorities will shift to economic insecurity, inequality, and the environment. The tech elite might retain substantial resources and influence, but the broader population will face a difficult economy.
These pressures will breed resentment and radicalize US politics with economically populist democrats like Bernie Sanders and Alexandria Ocasio-Cortez coming to power in the 2028 elections likely winning the presidency.
Crypto will be the easiest and most convenient scapegoat for populist democrat rhetoric. Key core issues will be economy and environment. Crypto is unpopular with a perception of being linked to fraud, extraction, tax avoidance, speculation and Trump. All easy targets for populist democrat politicians seeking power.
The existing lawfare operation against cypherpunk agorists will intensify to levels we have never seen before.
I have been targeted by this. Deported from 2 countries this year, detained by police and questioned in 4 other countries and taken to a room by a police squad asked to sign a document without being able to talk with my lawyer. I'm not unique either. The most radical in crypto suddenly find themselves "under investigation" or charged with money laundering: @raythewarchief @rogerkver @rstormsf
And this lawfare won't be limited to just cypherpunks and cryptobros but more widely directed against rich tech elites. For this reason they have been investing in network states - making deals with foreign governments to have their own enclaves to operate from. The risk from western states is simply becoming too great and they are diversifying out of the US in anticipation of a regulatory & legal war.
Michael Parenti retweeted
probably not the time to mention that the mt gox hack was a php exploit huh
no. no no no no non. no.
global crime rates are gonna collapse once superhumanoids like this hit the streets
imagine facing this thing as a robber lol
Unitree’s new "Guardian" robot can fight off a guy with a knife and patrol areas for 8 hours straight
which is terrible news for criminals, because the biggest thing that stops them from committing crimes is the chance of getting caught
right now in the US only about 13% of burglaries ever get solved
so most burglars are making a pretty safe bet
but if you put a robot on every block that:
> never sleeps
> records everything
> and can physically stop/beat the shit out of you
...then almost no criminals would make that bet anymore
on top of that, if you add the abundance that AI and robotics are likely to create
then far fewer people will even get desperate enough to commit crimes in the first place, because they'll already have enough
there's a good chance that our kids will think about robbery the way we think about guillotine executions
i have to admit it's awesome to have an agent that can update all of your vulnerable shit in a matter of minutes. going to be days of this routine i bet. probably need to have it write a daily chron job to check all vulnerable upstream dependencies i guess. crayzee times. cray cray super computer crazy
Michael Parenti retweeted
🚨 Revolut vient d'écrire noir sur blanc ce qu'il faisait déjà en douce.
Dans ses nouvelles conditions, qui s'appliqueront en décembre, une ligne impose désormais « d'utiliser le système d'exploitation d'origine de votre appareil ». Autrement dit, un téléphone sous GrapheneOS, l'un des systèmes Android les plus sécurisés qui existent, devient une infraction au contrat.
Depuis août, GrapheneOS accuse déjà Revolut de bloquer les connexions de ses utilisateurs. La banque parle de sécurité. GrapheneOS répond que l'application Revolut fonctionne encore sur des versions d'Android qui ne reçoivent plus de mises à jour depuis 2018.
Et ce n'est pas la seule nouveauté. À partir du 23 décembre, Revolut pourra fermer un compte sans préavis s'il estime que son client risque de « nuire à sa réputation » ou s'il juge qu'il utilise le service client « de façon abusive ». Qui décide ? Revolut.
On accepte en se taisant, ou on part.
Moi j’ai décidé de partir.
Michael Parenti retweeted
Half the internet went offline yesterday, and almost nobody is explaining what this actually means for normal users and retail.
In less than 24 hours, 4 core pieces of the web got hit at the exact same time:
PHP (1.5 million sites vulnerable without even logging in): exploit details leaked before the patch was even out. Governments, ports, and even Wikipedia had to pull the plug on their own sites just to stay safe. Any unpatched site (e-commerce, portals, forums, backends) can now have its entire user database (emails, passwords, personal data) dumped automatically.
GitLab (a 10/10 severity bug hiding in the code since 2014): anyone self-hosting GitLab to store their app or company code is at risk of having their source code and deployment keys stolen.
LiteLLM (hacked for the second time this year): this is the "bridge" almost every AI app, AI agent, and bot uses to talk to ChatGPT or Claude. Yesterday’s update shipped with a built-in trojan that stole all saved passwords and keys the moment it was installed.
Railway paused every deployment globally: attackers breached the system storing customers' secret environment variables (.env). And here is the real nightmare for retail: a massive amount of web apps, AI agents, Telegram trading bots, crypto dashboards, and startups run on Railway and store their database passwords, API keys, and bot wallet private keys right in there.
What should you actually do today?
Empty your Telegram bot and AI Agent wallets
If you use sniper bots, Telegram trading bots, smaller web terminals, or AI agents where you deposited funds, move your money back to your personal wallet (Rabby, Phantom, or ideally a Ledger) right now. Tons of these tools run on Railway or use LiteLLM, if their databases or secret files were read yesterday, any custodial wallet generated by those bots is compromised.
Delete your Exchange API Keys (Binance, Bybit, Hyperliquid, etc.)
Have you ever connected your exchange account or Hyperliquid (via API keys or Agent Wallets) to an external copy-trading platform, trading journal, AI bot, or alert tool? Go to your exchange and revoke/regenerate those keys immediately. If that service's backend was on Railway or used LiteLLM, your API keys might already be in the attackers' hands.
Clean up permissions on @RevokeCash and be careful what you sign
If a crypto project got its GitLab or Railway breached, attackers can silently push malicious updates to the official website (frontend hijack) or abuse exposed admin keys. Avoid signing transactions on smaller dApps today unless strictly necessary, and clear out old approvals on @RevokeCash.
Fix your email and password hygiene (for real this time) With 1.5 million PHP sites exposed, massive database dumps of emails and passwords from thousands of regular websites, online stores, and old forums are going to leak over the next few days. If you still reuse the same password across multiple sites, they will get into everything:
use unique passwords for every site
delete old accounts from sites and forums you no longer use (or use a data-removal tool)
most importantly: never use the same email you use to sign up for random websites/forums for your exchanges or financial accounts. Keep a separate, locked-down email (with Passkeys or app-based 2FA, never SMS) strictly for your money.
Michael Parenti retweeted
🚨🚨@BTCPayServer has updated its available opt-in woocommerce/wordpress deployment on its docker installer following the critical PHP vulnerability diosclosures.
UPDATE IMMEDIATELY IF YOU ARE USING WOOCOMMERCE DEPLOYED THROUGH BTCPAYSERVER.
SIMPLY PRESS UPDATE INSIDE YOUR BTCPAYSERVER.
Kudos to @ndeet for the quick shipping here.
Quinn Norton's (aaron swartz's partner) 2014 essay, "everything is broken" was prescient.
medium.com/message/everythin…
Michael Parenti retweeted
Zooko called it and Zcash was 6 months ahead of the rest of the internet
Yep, the Computer Security AIpocalypse is happening. Please be patient with the computer security professionals you know for the next few months, as they’ll likely be busy and stressed about preventing the collapse of civilization. xitter.cf/zooko/status/203878394…
"The internet isn't held together with code. It's held together with servers everyone is afraid to turn off."
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Michael Parenti retweeted
🚨 Europas Behörden gehen offline. Das wird sehr sehr sehr übel enden.
Zwei kritische Lücken in PHP. Codeausführung aus der Ferne, ohne Anmeldung oder Nutzerinteraktion. Betroffen sind laut BSI potenziell alle Versionen ab PHP 5, also zwanzig Jahre Code.
Das BSI stuft die Lage als kritisch. Betroffen sind u.A.:
→ Bundespolizei, Bundesinnenministerium, Zoll
→ Robert-Koch-Institut
→ Charité Berlin, Klinikum Nürnberg
→ Berliner Feuerwehr, Berliner Tafel
→ Universität Potsdam, weitere Universitäten
→ Hessische Landesregierung, Thüringer Landesverwaltung samt Landespolizei
→ Bayerische Behörden, Landratsamt Rhön-Grabfeld, Landkreis Dahme-Spreewald
→ Städte Dresden, Mainz, München und weitere Kommunen
Und am selben Tag patchten Node.js zehn Lücken, vier davon kritisch, sowie Go.
Jetzt der Teil, über den kaum jemand redet.
Die Lücken lagen über ein Jahrzehnt unentdeckt im Code. Gefunden wurden sie von OpenAIs GPT-5.6 Sol (!!!). Wiz nennt sie die schwerwiegendsten Lücken, die je mit dieser Technologie gefunden wurden.
BRISANT IST: Das Weiße Haus wusste seit Freitag, dem 16. Oktober, Bescheid. OpenAI koordinierte die Offenlegung mit CISA und dem Office of the National Cyber Director. Fünf Tage, in denen eine Regierung wusste, dass drei Viertel des Internets offenstehen, und die anderen nicht. Am Ende ging die Sache durch ein Leak vorzeitig raus, deshalb JETZT der Notfallmodus.
Genau hier zeigt sich, was es praktisch bedeutet, keine eigenen Modelle zu haben - Wovor ich nun seit Jahren warne!
Diesmal ging es noch gut aus. Doch jeder der sich in Europa jetzt nicht auf sehr düstere Zeiten vorbereitet, bewegt sich auf Glatteis.
Michael Parenti retweeted
A class action lawsuit has been filed against Coinkite.
courts.ontario.ca/portal/cou…
the new normal?
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Michael Parenti retweeted
In 2018 I wrote a Qualia Computing article describing how you could create a physical simulation of 3D hyperbolic space you could hold in your hand combining gradient index optics and one way mirrors in a dodecahedron.
Here is a simulation of what I have in mind :D What's more, here the dodecahedron's "internal light geometry" smoothly goes from Euclidean to Spherical to Euclidean again to Hyperbolic (all 3D).
Left shows what this looks like with one-way mirrors, and the one on the right what it looks with just a transparent plain glass.
Notice that in the transparent plain glass Euclidean case the dodecahedron disappears! (because the index of refraction is set to be exactly the same as that of the surrounding medium)
Cheers! :-)
Original article:
qualiacomputing.com/2018/08/…
Michael Parenti retweeted
This is UNREAL. If you love rap, stop what you are doing and listen
Lu Cipher is the drunken master of rap
This dude came to the cypher and spit an INCREDIBLE verse with a completely unique style
I've been saying for years he is one of the best lyricists in battle rap smh 🔥
@VideoGameBarGod
Michael Parenti retweeted
we were born into systems that have been driven by suffering for so long that we developed additional uses for it like recreation and status and personal identity
but the future isn't like the past
it was a good run, but i'm happy we're at its end. I've had my fill of suffering.























