Chris Mallz retweeted
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.
In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: cursor.com/blog/claude-code-…
Everyday is Zeroday
BREAKING: Binance has been hacked with wallets across the Ethereum, Bitcoin, and TRON networks seeing outflows of -$5.7 billion.
The hack includes $1.45 billion worth of Bitcoin and $875 million worth of ETH.
If confirmed, this would mark the biggest hack in crypto history.
We expect more information shortly.
Chris Mallz retweeted
irraz/vulnerator-ai: Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language. github.com/irraz/vulnerator-…
HTTP2Shell (CVE-2026-111497) is exploitable outside Node. Unauth RCE against a pinned vulnerable Docker Official Image for WordPress via /xmlrpc.php. One inbound pingback.ping, ASLR on, no leak or cross-request grooming.
PoC: github.com/caveeroo/cve-2026…
🥹
Now online from BSides Canberra 2026: @chompie1337 presents “Building an Autonomous N-day Exploit Generation Pipeline”.
Watch now: youtu.be/03Xh_6_6U4M
People seriously underestimate HuntProxy.
You don’t need Burp. You don’t need a laptop. You don’t need to worry about CAPTCHAs.
All you need for bug hunting is a VPS and an AI subscription.
github.com/BehiSecc/HuntProx…
Chris Mallz retweeted
Make your payload "sleep" to look like any real Windows activity.
BusyWork is a Rust library that swaps each pause for randomized real work - hashing, file enumeration, registry queries, DNS lookups - drawn from 76 tasks across seven categories with ±30% jitter on every parameter.
No two "pauses" produce the same API sequence, and no timing primitives survive in the compiled binary.
A post by Daniel (@PatchRequest)
Source: patchi.fyi/blog/busywork-sle…
#redteam #blueteam
Someone trained a GPT on 12 billion candles from 45 exchanges. Hedge funds spend years and millions building this. It was just given away for free
And the second repo is even crazier. An entire trading firm, made of AI agents, also free
Think about how most people trade right now
They open a chart, draw some lines, check RSI, read a few tweets and click buy
One person. One screen. A few hundred candles they can actually look at
Kronos has seen 12 billion
It doesn't guess where support is. It learned how price behaves across 45 exchanges and 7 timeframes, and draws what usually comes next
And TradingAgents does the part your gut was doing
It reads the news, the fundamentals and the crowd at the same time. Makes a bull and a bear fight it out. Lets a risk manager veto the trade before it happens
That's not a trader. That's a whole desk
People are still paying for TA courses and signal groups while this sits on GitHub for free, and almost nobody is talking about it
Here's how to run both tonight
1. Kronos, the AI that reads charts
Setup, 3 minutes:
Clone the Kronos repo
pip install -r requirements.txt
Then open the visual version:
cd webui
python run. py
Go to localhost:7070 in your browser. Load your candles, pick the model, hit predict. You'll see the forecast drawn right on the chart
No GPU needed. The small model runs on a laptop
2. TradingAgents, the AI trading firm
Setup, 5 minutes:
Clone the TradingAgents repo
pip install .
tradingagents
Pick a ticker, a date and a model. Claude, GPT, Gemini, DeepSeek, even local ones
No API key? Choose "Subscription" and it runs on your ChatGPT Plus
Then watch the whole firm work in your terminal, report by report, until the final decision
Kronos sees the chart. TradingAgents sees the world around it
Two years ago this was a desk of PhDs and a Bloomberg terminal
Today it's two git clones
Chris Mallz retweeted
Since the @Apple Bug Bounty Program is by far the worst program I've ever hacked on, I am going to be dumping all of the data/POCs/report write ups etc for everything found during the 4 months of hacking them. This will include POCs for vulns that didnt meet their bar for a bounty so wasnt reported to them, so you may be able to find ways to escalate some of them. Ill be uploading the data all this weekend.
Chris Mallz retweeted
This is an incredible, must read article from @KimZetter.
Be sure to read the source blog post:
- lumen.com/blog/en-us/silent-…
And listen to the Three Buddy Problem episode with Mike Horka on the attacks: youtube.com/watch?v=byQ53DdC…
For years government officials have been telling us how sophisticated and stealth China's Volt Typhoon hackers are, without providing details that support this assertion. Today researchers at @BlackLotusLabs finally reveal details that back the claim zetter-zeroday.com/silent-tr…
Chris Mallz retweeted
自宅鯖が何処に通信してるか可視化して遮断できる奴を公開しました。ローカルLLMのお供にマルチポートのSBCを添えていかがでしょうか?
github.com/ysuito/RabbitWall
Chris Mallz retweeted
1/4
Meet Qwenputer: Qwen3.5-4B with a full RISC-V CPU inside its weights, using the model's own Gated DeltaNet layers as RAM.
It runs C and MicroPython in its forward passes, no external runtime.
On DeepMind math: base 55–90%, base + Python tool 95–100%, Qwenputer 97.5–100%.
Never underestimate a add blocker, seriously when you know you know 😂
UPDATE: Israeli company we caught delivering zero-click infections is #1 bidder on Starlink ads in 105 countries.
Data from @trendai_RSRCH suggests worldwide surveillance op targeting @Starlink users. 1/
By @razhael
reuters.com/business/media-t…
Chris Mallz retweeted
Breaking: the FAA has shut down airspace over the Department of Energy’s Savannah River Site, with a notice calling it a “US Government Nuclear Incident.”
An event is in progress that has triggered emergency response activities at the Department of Energy’s Savannah River Site. This message is being sent to you as part of our emergency response organization information process.
Readers added context they thought people might want to know
The FAA NOTAM used standard terminology for a temporary restriction during a nuclear site incident; official updates confirm a contained lab fire was extinguished with no detectable off-site contamination and the Site Area Emergency was terminated.
public.srs.gov/2026/10/savann…
cnn.com/2026/10/28/us/…
Chris Mallz retweeted
I wrote up a way to defeat enforced SMB signing for relay.
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
Chris Mallz retweeted
Bypassing SMB signing enforcement🔥
@aas_s3curity found a re-authentication bug in SMB. This allows you to simply relay an authentication to a host (e.g., a DC) even if signing is enforced! His NetExec module to test if a host is still vulnerable is now merged into main🚀
1/3🧵
Chris Mallz retweeted
veeerrry iiintereeestiiing
中国社区逆向拆解了Claude的封号机制。以下是他们的发现
Claude使用积分制。注册时账号获得初始分数,之后根据行为加分或扣分。低于阈值直接封号。回分很难
影响分数的因素:
注册
> 干净IP是最重要的因素。不一定要家宽,但必须干净
> Gmail已经不是最优选,有权重更高的邮箱服务
> 注册时直接弹KYC的号可以扔了
> 用手机App注册会加分
支付
> 刚注册就订阅会扣分
> 直接上Max会大幅扣分。最好等两天先订Pro
> 支付时弹KYC说明账号在考察期,但不一定会封
> 国外实体银行卡加分。Google Play也行。虚拟卡扣分
使用
> 不要一次把限额用完。宁可两个号轮换也不要一个号撸到底
> Desktop客户端有少量加分。尽量少用网页端
> 手机端也有少量加分
> 开启记忆功能加分。记忆文件越多分越高
IP和设备
> 稳定性是关键。不要跳IP,尽量一直用同一个
> 代理必须全局模式并开启TUN
> 多设备登录大幅扣分。理想状态是一台电脑一个客户端
> 频繁换IP、频繁登录、高并发都会大幅扣分
账号年龄
> 老号有巨大的容错空间。2023年的号明显更高
> 分数随时间增长,但很慢
其他
> Windows和macOS没区别。Linux会扣分
> 时区和语言基本不影响。不会因为北京时间就封号
> 跟Claude说自己是中国人没问题,记忆不会触发封号
> 大量使用Fable会扣分
> 升级Max大概率进入观察期,除非是高权重老号
观察期和封号
> 接近阈值时账号可能进入观察期。典型特征是掉登录
> 观察期继续扣分就会封号
> 高分号可以扛过多次观察期
关注我,拆解你每天在用的服务背后到底怎么运作的


































