[email protected]

Not a drill: shut down your BTCPay Server if you have a hot wallet. Appreciate the reposts 🙏

I spent the last few hours going down the CVE-2026-98432 Critical Linux Kernel Flaw rabbit hole 🕳️ and here are a few thoughts: - It is legit and scary. Kinda crazy that it's been known for 2 weeks & there is still no patch for popular distros (the Ubuntu fix, for example, is developed but not publicly released, still in testing). - MPTCP needs to be enabled, and on some unorthodox port. It seems that ISPs globally have started blocking options on 22, 80, 443 and other popular ports (good!). - If you're running a server with valuable data, disable MPTCP and/or IP options NOW. They are not necessary in 99% of use cases anyways. - It takes about 50 minutes on average to gain access to a server if all conditions are met. My servers started getting hit today; luckily the script I shared earlier handled the situation and rejected the probes. Stay safe & enjoy the wild AI psychosis ride we're in.

I'm still not over the BTCPay Server hacks from August. And I don't think I ever will be. Nine years of coding, building community and creating value with others, only for a lot of that value to be stolen by thieves and AI hackers. When I look back, the only thing I feel good about is how fast our community reacted, and how many more people were saved from catastrophic losses. As a FOSS project, we responded better than governments, big corporations and most for-profit companies did. Everyone who contributed should feel proud of the part they played in the response. What remains is the realization that we are in a new era. The people who robbed us only managed it because they got access to frontier AI models faster than we did. AI has fundamentally changed software development. So our job now is to build better ways for humans to work with AI while it writes the code. Developers were already being tortured. The boss wants it yesterday. Sales sold it last week. Product changed it this morning. Everyone in the company wants it faster, and the end users want it perfect. Your backlog has a backlog. Now add attackers running frontier models that read your entire codebase overnight. It's literally impossible to keep up. If you're still coding by hand, you're bringing a keyboard to a drone fight. You will not make it. In this brave new world it's all about having AI running your development and defense, ensuring it's as close to frontier as possible. And that you are connected with other humans who share your morals. Those who will not only refuse to steal from others, but actively fight thiefs, sharing lessons they learned. A world where those who create value get to keep it. That's the only world I want to live in.