Software Engineer.
Joined May 2009
- Tweets4.5K
- Following2.8K
- Followers404
- Likes94.7K
Marciomacdev retweeted
despite the unfortunate timing, we take disclosures seriously at @typesafeai
at approximately 6:49PM this Friday evening, we became aware of a massive unauthorized leak of ALL customer noul outputs
in effort to maximize transparency, here is the link: gist.github.com/diogo149/810…
🚨🚨🚨
despite the unfortunate timing, we take disclosures seriously at @typesafeai
at approximately 6:49PM this Friday evening, we became aware of a massive unauthorized leak of ALL customer noul outputs
in effort to maximize transparency, here is the link: gist.github.com/diogo149/810…
🚨
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”
A significant blast radius.
This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.
Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
Marciomacdev retweeted
Oracle shipped an emergency Java fix for CVE-2026-91403 (CVSS 9.1). The JSSE flaw lets a network attacker pass forged TLS certs as trusted. Java 8 through 27 are listed. Patch your JDKs today.
blogs.oracle.com/security/se…
🚨
🛑 ALERT - Node2Shell RCE exploit works on an official Node.js build.
Researchers demonstrated how crafted Brotli data can trigger code execution through vulnerable Node.js applications, without modifying the runtime.
Here's how the exploit works: thehackernews.com/2026/10/re…
Marciomacdev retweeted
October has been an absolute nightmare for software
> Railway - customer secrets exposure
> LiteLLM - malicious PyPI + Docker releases
> Zeabur - infrastructure breached
> OpenCode - AI API keys exposed
> OVHcloud CLI - official binaries backdoored
> Rank Math PRO - malware in official plugin
> TeamUpdraft - customer data compromised
> ConnectWise - cloud backup identities compromised
> Tensorlake - npm package infected
> SubQuery - backdoored npm package
> GhostAction - GitHub repos with malicious workflows
> PHP - critical RCE vulnerabilities
> Node.js - security vulnerabilities patched
> eMudhra - certificate authority keys compromised
> Tailscale - eMudhra incident
At this point, the biggest security risk might not be the code we write, but the code we trust...
🚨
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-…
🚨
‼️ Breaking: LiteLLM Compromised – Infostealer and RAT Injected in 1.107.0 PyPI Release
Details: cybersecuritynews.com/litell…
LiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed wheel files.
The malicious release also reached Docker images, putting developer systems, build runners, and AI services at risk. Anyone who installed the affected release should assume credentials were exposed.
PyPI removed version 1.107.0, but taking down the package does not remove malware already installed or invalidate secrets attackers may have stolen. The attack uses Python startup hooks rather than relying on an application to import LiteLLM.
#CyberSecurity #cybersecuritynews #LiteLLM1.107.0
Flash 🚀
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
Marciomacdev retweeted
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
Marciomacdev retweeted
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
👀
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Marciomacdev retweeted
Perplexity Computer can now run fully local on your Mac.
Work with your native Mac apps and local files, and run tasks without sending sensitive data to the cloud. The model and the agent both run on your Mac.
Available now in the Perplexity Mac app.
Marciomacdev retweeted
Here are the 24 biggest updates you get by upgrading to SDK 58
00:20 iOS 27 & iPhone Duo
01:09 Expo Device Hub
01:45 Expo UI & Jetpack Compose components
02:53 App Intents (alpha)
03:22 Home screen widgets on Android
03:38 Variable fonts and SVG variables
03:57 Faster builds and faster Expo modules
04:27 Expo Modules 2.0 (beta)
05:12 Expo CLI for agents
05:27 React Native v0.88
05:58 Wrap-up and the Expo App Awards
🔗 useful links down below
SDK 58 is out 🙌
This SDK is built for iOS 27. Apps on SDK 58 will be ready for Duo on day one 📖.
The release also includes App Intents for Siri, 2x faster clean Android builds, faster Expo modules, and a CLI built for your coding agent.
Changelog: expo.dev/changelog/sdk-58
Upgrade: 𝚗𝚙𝚡 𝚎𝚡𝚙𝚘 𝚒𝚗𝚜𝚝𝚊𝚕𝚕 𝚎𝚡𝚙𝚘@^𝟻𝟾.0.0 --𝚏𝚒𝚡
Great !
Chrome 155 adds support for JPEG XL (.jxl) → goo.gle/4yYpSjW
Expect 30-50% smaller file sizes than traditional JPEGs, native HDR, progressive rendering, and lossless JPEG transcoding.
Under the hood, Chrome uses jxl-rs, a pure Rust decoder built for maximum memory safety and performance.
Marciomacdev retweeted
I used Reverse Engineer Anything to re-create raycast on @omarchy. And I was blown away! In just a couple hours I have a fully-functioning raycast-like launcher! Right now it:
* Learns your habits
* Apps + every Omarchy action in one search
* Aliases & favorites
* Keyboard-first
* Follows your Omarchy theme live, opens in ~40ms
repo: github.com/typecraft-dev/oma…
One of Akita's best projects ! 🚀🔥
I'm sure this gets baked into most harnesses at some point. But for now, this is a really interesting project! Sharing state/memory across AI vendors: github.com/akitaonrails/ai-m…
