Pinned Tweet
when BOJ rug pull America?
GCP and AWS are having issues meeting demand; they are at capacity for compute.
when the cloud can't scale on demand, what happens?
vulnerability disclosure is the weapon
You won’t read about this anywhere else because it’s a theory. A very very good theory.
PHP2Shell: What if the disclosure was part of the operation? High-level cyberwarfare ahead of the next phase of the Iran war.
On October 18, technology-tracking service Aguko identified 138,595 Iranian .ir websites using PHP, representing 96% of Iranian websites with an identified server-side programming language in its dataset.
Consider the possibility that the October 2026 PHP2Shell disclosure was neither an accident nor simply a cybersecurity emergency, but an event whose timing could serve a broader intelligence operation against Iran.
This is an insane concentration of exposure to a common technology. It does not mean that 96% of Iranian websites were vulnerable, but it establishes how extensively PHP is embedded in the country’s publicly visible digital infrastructure.
The vulnerabilities were not confined to an obscure plugin. They existed within PHP itself, affecting versions spanning more than a decade. Successful exploitation under the right conditions could allow unauthorized code execution, access to sensitive information, and compromise of affected servers.
Now consider who discovered them.
In August 2026, Wiz Research, part of an Israeli-founded cybersecurity company acquired by Google, independently identified critical PHP vulnerabilities. Wiz’s founders previously served in Israeli military intelligence, including Unit 8200, the intelligence organization historically linked to Stuxnet, the cyberweapon that sabotaged Iran’s uranium-enrichment centrifuges.
Other independent researchers, including Calif and OpenAI, also contributed to discovering and reporting the vulnerabilities. The military backgrounds of Wiz’s founders establish a historical connection, not evidence of involvement in a contemporary intelligence operation.
Still, the chronology becomes more interesting.
October 17: Amazon detects an attempted exploitation of PHP2Shell through its MadPot honeypot network. The activity originates from anonymized infrastructure, four days before the official public disclosure. Amazon cannot establish how the actor acquired knowledge of the vulnerability.
October 18: Aguko’s dataset places PHP’s market share at 96% among Iranian .ir websites with an identifiable server-side programming language.
October 20: Confidential vulnerability identifiers begin circulating publicly. A demonstration video is prematurely released. The PHP Foundation accelerates its disclosure timetable. Mitigation information shared with some critical-infrastructure providers may also have leaked.
October 21: Patched versions arrive. One vendor publishes patched software more than six hours before the agreed release, while researchers observe exploitation attempts and the internet begins responding to a global security emergency.
Someone was attempting exploitation before the vulnerabilities were supposed to be public. The origins of that knowledge remain unresolved.
Now consider the military significance of the sequence.
Modern cyberwarfare does not necessarily begin with an attack on the ultimate target. It can begin with intelligence collection, access to peripheral networks, mapping of dependencies, compromise of suppliers, and the positioning of capabilities that may become useful later.
An adversary seeking to disrupt a nuclear program would not necessarily need to begin inside a centrifuge facility. The broader technological ecosystem includes administrative services, engineering organizations, research institutions, contractors, procurement channels, communications, and other systems that may hold information or maintain connections of intelligence value.
A vulnerable PHP installation could theoretically provide an initial foothold somewhere within that ecosystem. Reaching industrial control systems would require additional access and capabilities that have not been demonstrated in this case.
offline movement is growing
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
ken 🦇🔊 retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
About how many routers running php servers will go unpatched?
‼️BREAKING: PHP has released its fix for the two leaked flaws, which can let attackers run code on servers without logging in.
"There are no complete mitigations, updating is the only safe choice," PHP says.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
PHP says Apache with mod_php is most at risk, with a demonstrated exploit that fires before any application code runs.
PHP 8.1 and older get no official update, though PHP has published source backports for 7.4, 8.0 and 8.1.
security by obfuscation is over
Hash-perfect decompilation of a Solana program is now a thing.
@osec_io went from a 220KB .so blob to byte-identical Rust source for GoonFi V2, using agents scored on how closely each function matched the original bytecode.
The bug they found once the code was readable? The AMM priced assets off its own vault balance. Donate tokens, skew the price, drain the other side. $6.1M at risk.
If your program is live, assume your source is public.
osec.io/blog/goonfi-decompil…
ken 🦇🔊 retweeted
Wow! Claude found the NIST curve parameters & how they were chosen.
anthropic.com/research/ecdsa…
#̢̛ͯ͛̐͛ͣ̓̈̀͑͛ͯͥͦͭ͑̌̎͂̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨͔̻͉̜̭͉̹̫̜͉̤̻̤͔̱̖͢͞͡ͅͅ͏̸̷̢̀̉͆̏ͧͥͫ̇̽ͯ͂̓̏͂ͧ̓͑ͧͣ̌͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͭ͑̉ͭ͆͑̀̀͂ͪͪͯͨ͆̓̉͂̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨͉̻̖̭̖̘͔̻̫̘̖̘̻̲͔̱̲͢͞͡ͅͅ͏̸̷̢̌̇̌̽ͨͥͥ̇̈ͯ̌͑̉̏ͨ̇̏ͫͩ͆͝͠͠͏̸̵̵̷̵͟͜
#̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎
#̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎
#̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎
#̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎
#̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵͟͜ #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎
ken 🦇🔊 retweeted
Big congratulations to the @zksync airbender team for this milestone.
At this point, I consider the battle for speed to be definitively won, and the top priority for zkEVMs should shift fully to security.
To me that means formally verifying
(i) equivalence of the arithmetization to the ethereum spec
(ii) a hard maximum bound on (prover cost) / (amount of gas in block)
(iii) security of the proof system itself
firefly.social/post/x/211001…
every relationship solidified before ai ubiquity is priceless in this new era
i think we're all in denial tbh and coasting off of the legacy internet user base perhaps
but the social internet is becoming fundamentally unusable in an AI world
there is simply no way for any intelligent user to meaningfully adapt to what's happening, and it's even more difficult for non-intelligent users
and if we don't collectively start to move away from the anon nature of the internet which we've all become accustomed to
then it will either collapse under it's own weight, or it will become a very significant threat to civilization
yes, it's that serious
ken 🦇🔊 retweeted
Supply-chain attacks against hardware wallets aren't going away.
And that's something the entire crypto industry needs to take seriously.
Following the recent Ledger Nano X hardware implant research brought to public attention by @MagicalTux, I decided to investigate the attack myself.
Using an ESP32-S3, some basic electronics, and open-source tools, I was able to reproduce the display-bus interception concept and mirror my own Ledger Nano X screen onto another display.
The video shows my experimental reproduction.
What concerns me isn't just that information displayed by a hardware wallet can potentially be observed by an unauthorized hardware implant. It's how accessible the underlying techniques have become.
And this raises an even more interesting research question:
What if an implant didn't need to transmit stolen information at all?
Could a more sophisticated implant interfere with physical button inputs, manipulate user interactions, or exploit weaknesses in seed-generation workflows?
Could an attacker somehow cause a device to adopt a predictable recovery phrase without any external communication?
These are research hypotheses, NOT demonstrated attacks. Importantly, controlling the display or buttons alone does not mean an attacker can override the Secure Element's cryptographic randomness.
But they're questions worth investigating.
The lesson isn't that hardware wallets are useless, or that their manufacturers are malicious. Quite the opposite: many people in this industry have dedicated years to protecting users.
The problem is that security doesn't end at the Secure Element.
Manufacturing, distribution, logistics, hardware interfaces, firmware, physical access, and user verification all matter.
This is one of the reasons I'm building LeekWallet, an open-source, DIY hardware wallet designed around transparency, independent verification, accessible components, and user-controlled assembly.
I encourage everyone to do their own research, learn how their devices work, experiment responsibly, and consider building their own hardware wallets.
And please support open-source security projects. Independent research needs more than attention; it needs sustainable funding.
Special thanks to @MagicalTux for bringing this attack into the spotlight, and to @ETHGlobal and @thedaofund Security Fund for contributing to an ecosystem where independent builders and security researchers can thrive.
I'd also love to see more discussion around these issues from @ethereumfdn and @VitalikButerin.
If you believe open-source hardware security research matters, consider supporting LeekWallet through TheDAO Security Fund:
initiatives.thedao.fund/init…
leekwallet.0xoucanproject.xy…
github.com/0xOucan/LeekWalle…
Don't trust. Verify. And whenever possible, build.
#LeekWallet #OpenSource #HardwareWallet #Ethereum #SecurityResearch
I'd also like to acknowledge @Ledger and @DonjonLedger. Protecting users against sophisticated hardware attacks is an incredibly difficult challenge, and the work security teams do deserves recognition.
This research isn't about blaming manufacturers or undermining trust in hardware wallets. It's about understanding where trust boundaries can fail, encouraging independent verification, and strengthening the entire ecosystem.
Security research should bring builders, manufacturers, and independent researchers together, not divide them.
Responsible disclosure, open research, and collaboration make everyone safer.
























