CalvinCrypto.bit | Bedrock $BR

just built a small open source tool tonight to test the quality of your device’s entropy and verify that your seed phrase is cryptographically secure. entro.tools

🚨 PSA for anyone running a Linux server, node, or relay CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed. Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have. What to do today: 1. Check your kernel: uname -r Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed. 2. If your distro has a fix, update and reboot. 3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you. 4. Turn off MPTCP unless you need it: sysctl -w net.mptcp.enabled=0 Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in. 5. Make it survive a reboot, and check it still works after one. If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today. Self-hosting is freedom. Patching is part of the job. 🛡️

市场暴跌就是因为这，又被盗了，市场反应最快，刚砸盘就是因为这，BNB 跌 9%，BTC 跌破 7.9 万，1 小时爆仓 6.3 亿美元😮‍💨 凌晨 4:24，币安一个热钱包被一笔交易扫空。 40 分钟，以太坊链上流出约 33 亿美元，如果坐实，这是去年 Bybit 被盗案的两倍多。 Tether、Circle 已冻结约 18 亿，ETH冻不住。 币安说还在调查，CZ说看起来就是被黑了😂 怎么被抽空的，链上分析是，10月28 一个新地址从 Tornado Cash 拿到启动资金。 04:20 热钱包被设置 EIP-7702 委托，执行权指向它的合约 04:24 一笔扫走 16.7 万 ETH和16 亿 USDT 和 60 多种币 04:41 另一个热钱包流出 8.2 亿 USDC 7702 委托必须用钱包私钥签名，那签名哪来的？ 钱能追回多少不清楚，Circle 冻结 8.2 亿 USDC，Tether 冻结约 9.7 亿 USDT，有报道说已超 15 亿，4 亿多美元的 ETH 冻不了，已转到新地址，部分 USDT 冻结前就被拆散转走 稳定币这次冻得够快，一半以上拦下来了。 接下来又是老一套，提币停没停，根因是什么，最终亏多少，SAFU 赔不赔。。这几天肯定会冒出币安赔付，领取紧急迁移资产之类的链接，全是钓鱼的，别点。

🚨 Nightmare day for cybersecurity Multiple major security incidents, active exploits, supply chain compromises... If you run production systems, start patching NOW. PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets. eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores. Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs. TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff. Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors. BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign. And that's not even the full list. Patch. Audit. Rotate. NOW.

先领再研究 反正我有了 @binance @binancezh

Turns out the future does have flying cars

What's crazier is the hackers apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut. So many things wrong here...

Holy shit... A random Chinese company purchased CryptoBilis (the authorised Ledger reseller that issued the spy-implanted Ledgers) from its Malaysian ex-owner, then put him under a confidentiality agreement preventing him from disclosing the sale publicly. What a wild attack.

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses. Reach out to Ledger customer support through official channels with any questions: support.ledger.com/

Introducing ChatGPT for Dishwashing GPT-6 achieves state-of-the-art results on dishwashing benchmarks for long-running jobs and difficult stains. The Navier–Stokes Millennium Prize Problem is a $1 million challenge about whether the equations describing fluid motion can break down. In this video, I accidentally found a counter-example while trying to optimize my dishwasher. But in reality, OpenAI used 10,000 AI agents to find a proof in 88 hours: openai.com/index/navier-stok… Parody of the original GPT-6 Astra ad @OpenAI #ChatGPT_Partner #chatgpt Credits: Written and Directed by Joma Co-Writer - Henry Connor Coan IV @coan_henry Production by Dauntlus Studios @dauntlus.studios Producer/Co-Director - Marcus Liew @dauntlus Camera Operator - Amos Lee @amoselijahlee Art Director - Alethea Soo @aletheasoo Art Assistant - Alicia Lim @aliciatkl_ Assistant Editor - GPT-6 Astra Music: Tensions Run High by Soundridemusic youtube.com/watch?v=Ly9H63SL…

.@Mantle_Official ethereum L2 EXPLOITED FOR 500m 🚨‼️

The funds from the $3.8M NEAR Intents hack were sent back in full. We are stopping the investigation. Please use bug bounties instead of disrupting the services.

Blast will be shutting down. We launched Blast with the goal of building a self-sustaining chain for users and developers. Unfortunately, the economics of operating the chain no longer make sense: the ongoing costs of maintaining Blast exceed the revenue generated by the L2, and we do not see a credible path to making the chain economically sustainable. As a result, we've made the difficult decision to wind Blast down. We're sorry to the users and developers who believed in Blast, built on it, and supported the ecosystem. Our priority now is making the shutdown as smooth and safe as possible. We're asking all users to withdraw their assets from Blast to Ethereum mainnet, including any balances held in the Blast PWA. To make this easier, we will be reducing the withdrawal delay to 24 hours. As part of the shutdown process, we'll first begin withdrawing Blast's Lido assets. This process is expected to take approximately one week. During this period, withdrawals will temporarily be unavailable, even after the withdrawal delay is reduced to 24 hours. Once that process is complete, withdrawals will resume with the new 24-hour delay. Users will have until October 26, 2026 to withdraw through the normal Blast interface. After October 26, assets will remain withdrawable, but users will need to interact directly with the Blast bridge contracts on Ethereum L1. We'll publish detailed instructions before then. We strongly encourage everyone to withdraw their assets to Ethereum mainnet before October 26.

magiceden已经跑路了 大家有授权过的，赶紧取消。

這影片做得太好了😂 最搞笑的一段是 Zuckerberg ：Oops, wrong trend.

💥炸了！开源本地版 Laya 响应速度吊打 Jev ，毫秒级决策快到飞起！ 左边 Laya 是本地 421M 开源决策模型，右边 Jev 1.13.0 是云端 API。 同一盘贪吃蛇、同一套 typed decision，30 秒自由跑下来： 🔹Laya：分数 46、长度 52，决策 86.5 次/秒，P50 约 9ms 🔸Jev：分数 1、长度 7，决策 3.2 次/秒，API 往返 317ms M5 Pro 实测中位耗时：本地 15.3ms vs 云端 298.1ms，接近 20 倍 Laya 推理内存大约 1GB，毫秒级决策，不靠网络 而云端 Jev 每一步都在等往返，本地每一步都在当场拍板！ GitHub：github.com/NandhaKishorM/lay… #开源Jev #Laya #本地部署 #SystemOne #贪吃蛇对战AI #Jev nitter.cf/nft_chen/status/210164…

😭

朋友跟我说，人的一生一定要生个孩子 我问为什么？ 他说，人这一辈子，能体验到的快乐是极其有限的。 5岁，你玩的是游戏机，画面糙得没法看，但你抱着它能玩一整个暑假。 10岁，你泡街机厅，一个币盯一下午，老板赶都赶不走。 15岁，你钻进网吧通宵，第二天顶着黑眼圈上学，心里美得很。 18岁，你去滑冰场，摔得屁股生疼，就为了拉旁边那个人的手。 22岁，你拿到第一份工作，工资不多，但你觉得这个世界开始为你发门票了。 28岁，你买了房，贷款买的。签字那天手是抖的，晚上站在毛坯房里，觉得天下都是你的。 从那一年起，日子一年比一年难。三十多岁，责任一年比一年重。收入越来越多，但快乐越来越少。 你买了当年梦寐以求的最顶配的电脑，把以前喜欢玩的游戏全玩了一遍。 却体会不到曾经的乐趣。 你换了曾经想买的车 却开心不到三天。 你有了很多曾经梦寐以求的东西，却再也感受不到曾经的快乐。 直到你有了一个孩子。 你不用做什么，只是看着他的成长。 他快乐，你会感同身受， 你儿时的那些快乐跟着他全部都回来了， 孩子会带着你重新的活一次 这份快乐，远远超过你自己余下人生快乐的总和。 我不知道他说的对不对，陷入了沉思。