You can now run Ombra OS with UTM
ombra-os.org/blog/set-up-omb…
crazy
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
I used to have the $80 glm coding plan
And I get more usage and better work done using sonnet 5.5 on the $20 Claude plan
xen retweeted
Gemini 4 Carbon is #2 on the Agent Arena, right behind Opus 5.5 (Max). It's #4 on web development capabilities, and ranked #1 on text-based conversations.
It pushes the pareto frontier, ~4x cheaper than Opus 5.5.
By any measure, Google is back on the frontier!
Exciting news: Gemini 4 Carbon (High) from @GoogleDeepMind just made a huge debut on Arena, landing #1 in Text Arena, #2 in Agent Arena, and #4 in Code Arena: WebDev. Back at the top, Gemini 4 Carbon delivers frontier intelligence and reshapes the Pareto frontier across three arenas.
In Agent Arena, Gemini 4 Carbon ranks #2 with a +16.2% net improvement across +21.9K real-world agentic sessions from our global community, surpassing top models GPT-6 Astra and Fable-5.1. At $1.80 median cost per task, Gemini 4 Carbon (High) costs 72% less than the #1 ranked Claude Opus 5.5 (Max).
Its standouts by key signals:
- #1 Steerability (+18.6%): can the model course-correct when you push back?
- #2 Praise vs Complaint (+37.9%): implicit sentiment in users' reactions
- #3 Confirmed Success (+18.7%): explicit “yes, that worked” from users
In Code Arena: WebDev, Carbon scored 1768 pts landing #4:
- Just 2 pts below #3 Claude Sonnet 5.5 (xHigh), at 1770 pts
- 89 pts above #11 Gemini 4 Argon (High), at 1679 pts
By category, it ranks #3 in Gaming and Simulations, and #5 in Brand & Marketing.
In Text Arena, Gemini 4 Carbon (High) is the new #1 with 1528 pts, now ahead of Gemini 4 Argon (High) at #2 with 1520 pts.
Congrats to the @GoogleDeepMind team on this huge milestone!
xen retweeted
2 things:
- Fable 5.5 will probably be as good as a human researcher on FrontierML
- Haiku 5.5 is ahead of all the chinese models
xen retweeted
If you ever took a photo of your seed phrase and deleted it later, the thumbnail might still be hiding in an old iPhone backup on your laptop.
NEVER TAKE A PICTURE OF YOUR SEED PHRASE.
Claude Code found every photo i "permanently deleted" from my iPhone.
almost 4 years of photos and videos sitting in a hidden cache on my
device. any app with file access can read them.
plugged my iPhone into my MacBook for a backup. had Claude Code running
a security scan from my last post. it flagged something i never asked
it to check. a directory called PhotoData/Thumbnails with over 152,000
files. photos, videos, screenshots. all stuff i deleted.
2022. 2023. 2024. 2025. photos i deleted within a second of taking them.
photos i went into Recently Deleted and cleared manually. photos i
deleted twice because i didn't trust the first time. all still there.
what was sitting in that cache:
a passport photo for a visa application in 2023
bank app screenshots with full account numbers visible
private photos i sent someone and deleted the same night after a breakup
a crypto seed phrase screenshot i took "for a minute" in 2022
my ID and credit card side by side, deleted 10 seconds later
my ex's private instagram stories i saved and "permanently deleted"
in 2024
152,417 files. some at full resolution. all organized by date going
back to 2021.
when you delete a photo on iPhone, iOS removes it from your camera roll
and your Recently Deleted folder. but it keeps a compressed copy in a
Spotlight search index cache. that's how your phone finds photos when
you type a word in search. Apple never clears it. not after 30 days.
not after a year. they told you it was permanently deleted. it wasn't.
checked which apps on my phone had Files and Folders access. 19 apps.
weather apps. QR scanners. PDF readers. a flashlight app from 2021.
any of them could've been reading every photo i ever "deleted" this
whole time.
went from 19 apps to 3 in about a minute.
full step by step is below. takes 2 minutes. bookmark it so you don't
lose it and send it to anyone with an iPhone.
the php vuln was overhyped
xen retweeted
OpenAI CEO Sam Altman: "I don't even know a dramatic enough word to use… models can find bugs that are outside of the normal threat model of what we think a hacker can do… hardware-level, insane stuff… I no longer think we're gonna be able to just patch all the bugs."
It's over.
xen retweeted
I took a closer look at the stealmybitcoin.com CTF, which aims to demonstrate that PHP2SHELL is not realistically exploitable. So I gave it a try.
Note: My analysis could be wrong, and I'm more than happy to be proven otherwise.
Here’s what I found:
• The server responds with Server: nginx and X-Powered-By: PHP/8.4.26.
• My differential fingerprinting scanner independently confirmed at least PHP 8.2+
• Hypotheses: I considered two possible setups:
◦ nginx → PHP-FPM
◦ nginx → Apache → PHP-FPM/mod_php
• After comparing the server's behavior against local test environments, the closest match appears to be nginx → PHP cli-server.
Plot twist: the response behavior is consistent with the PHP cli-server serving a static index.html rather than an index.php. If that's indeed the case, the challenge appears to be intentionally made unexploitable.
My conclusion (for now) is that I'm questioning whether this is a good-faith challenge.
Happy to be corrected if I've missed something!
