Pinned Tweet
Just passed my over $10,000 exam, GIAC GWAPT Certified ✅ The journey was long, the late nights were real, and it was worth every bit. Huge thanks to @sisinerd who took a chance on me that I’m worth this & to @SANSInstitute for the incredible partnership with @cybersafehq
This quoted post is unavailable.
cybernerd🤖 retweeted
I retired from cybersecurity, I now lay flooring
No more CVEs to worry about, I will go to sleep thinking that my floor is well done, without any worry that my Linux server is going to get hacked 30th time this week
Good luck with your vulnerable servers
What a disaster atlasum.net/blog/cve-2026-98…
cybernerd🤖 retweeted
Smaller models can be very useful for bug bounty, we just have to be more specific with its' prompts instead of relying too much on the reasoning like we do with the high-end models.
We recently covered a bunch of ways to get more out of your hackbot setup regardless of model and hardware
- Split your agents by speciality, have one analyse JavaScript, another check authentication, and another handle recon. Narrow tasks make it easier to see what each agent actually tested.
- Use smaller models for boring work, like reading large JS bundles, inspecting APKs and identifying sources and sinks are useful "simple" jobs. Save stronger models for investigating promising leads.
- Don't lose evidence when summarising. Make agents preserve relevant code locations, requests and responses. A summary saying "possible injection" is useless if the next agent can't find the original source.
- Make another agent challenge the finding and verify the claimed impact. An SSRF callback doesn't automatically prove internal access, XSS doesn't automatically mean ATO, these things need to be tested by different agents.
- Test your prompts against known bugs, previously validated, to check whether changes to your harness improved results or made it worse.
- Keep agents separate, give them separate browser sessions, clear work assignments but a shared place to store results.
A smaller model with good tools, clear instructions and proper verification can be a lot more useful than most people think, we only need to use them a little bit differently!
cybernerd🤖 retweeted
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
cybernerd🤖 retweeted
‼️ BREAKING: The Binance hack has grown to about $5.6B drained across Ethereum, Bitcoin and Tron, on-chain trackers say.
If confirmed, it would be the biggest crypto heist on record.
Tether and Circle have frozen about $1.8B in stablecoins, and Circle says it acted "in coordination with law enforcement."
Binance hasn't confirmed any impact on user funds.
cybernerd🤖 retweeted
Everyday is Zeroday
BREAKING: Binance has been hacked with wallets across the Ethereum, Bitcoin, and TRON networks seeing outflows of -$5.7 billion.
The hack includes $1.45 billion worth of Bitcoin and $875 million worth of ETH.
If confirmed, this would mark the biggest hack in crypto history.
We expect more information shortly.
cybernerd🤖 retweeted
So far, total outflows as part of this hack are sitting ~$5.9 billion.
Binance founder CZ said it appears as though total hacked funds exceeded $1 billion.
This is likely the biggest hack in crypto history.
Follow us @KobeissiLetter for real time analysis as this develops.
cybernerd🤖 retweeted
BREAKING: Binance has been hacked with wallets across the Ethereum, Bitcoin, and TRON networks seeing outflows of -$5.7 billion.
The hack includes $1.45 billion worth of Bitcoin and $875 million worth of ETH.
If confirmed, this would mark the biggest hack in crypto history.
We expect more information shortly.
cybernerd🤖 retweeted
Nigerian-American founder Yinka Ogunbiyi unveils the world’s first air-braiding robot. 🇳🇬🔥👏🏽
This robot makes hair up to five times faster than stylists.
cybernerd🤖 retweeted
Please, Make THANKING GOD (and People) a lifelong habit and practice. I mean intentional, detailed, heartfelt and consistent Thanksgiving, at all times.
In a short while you would begin to experience an unusual supply of Grace in your life.
There is a connection between the word CHARIS (Grace) and THANKSGIVING in the New Testament. Do a short study on this and you will see for yourself.
There’s also a connection between Thanksgiving and humility. Because gratitude takes the attention off you and fixes on another. It admits and acknowledges good and favour done by others. That in itself is an expression of humility. And James says God gives more grace to the humble.
If you engage this consistently, over time you would begin to notice remarkable changes and growth in your life and walk with God, something no one can away from you. This has been one of my major life’s hack. Try this and thank me later 🙂.
THANK YOU JESUS !
cybernerd🤖 retweeted
🚨 THE INTERNET IS FACING ONE OF THE WORST WAVES OF CYBERSECURITY THREATS EVER.
More than 20 major cyber incidents and security warnings have been reported in recent days, affecting banks, governments, cloud platforms and widely used software.
And some of the details are shocking.
1. PHP, used by a huge part of the web, had 2 critical flaws (CVSS 9.2) that let attackers run code remotely
2. Governments in 9+ countries took websites offline as a precaution, including France, the Netherlands, Finland, Germany, Belgium, Denmark and the UK
3. eMudhra, a certificate authority, had the keys of 8 certificates exposed. One key was the number 4
4. Railway says hackers may have accessed decrypted customer secrets
5. Zeabur was breached, with 321,810 accounts affected, and is shutting down
6. Japan's Onamae Desktop Cloud stopped up to 26,739 servers after malware was found
7. LiteLLM, a popular AI library, was poisoned and stole cloud and AI keys
8. OVHcloud's CLI tool was backdoored
9. GitLab disclosed a CVSS 10 flaw that lets attackers take over servers without logging in
10. State Bank of India confirmed 3,897 customer records on the dark web
11. Data of California students was stolen from ETS, with the intruder inside for about 4 months
12. Bullhorn took its platform offline after a cyber incident
13. Palo Alto firewalls are still being exploited by ransomware groups Qilin and Inc
14. Researchers say AI agents were used to target 400+ banks and payment companies in Latin America
15. Axios reports US banks are finding unauthorized AI agents inside customer accounts
16. Reuters reports one hacker used AI agents to break into 100+ company websites, including Deere
cybernerd🤖 retweeted
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
cybernerd🤖 retweeted
🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis.
🔸 Mettez immédiatement pip à la version 26.2.2 ou plus.
🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip
🔸 uv : uv self update (0.13.4 ou plus)
🔸 Mettez aussi à jour les certificats du système (apt / dnf upgrade ca-certificates) et vos images Docker
pip install est compromis.
L'autorité indienne eMudhra (emSign), qui signe les « passeports » prouvant qu'un site est bien celui qu'il prétend être, utilisait des clés secrètes ridiculement faibles : 8 clés, toutes inférieures à 256. L'une valait 4. Autrement dit, n'importe qui peut fabriquer un faux passeport valide pour n'importe quel site.
Le risque pour Python : quelqu'un sur ton réseau (wifi public, FAI, État) se fait passer pour pypi.org, et ton « pip install » télécharge un paquet piégé sans aucune alerte. Aucune attaque n'a été signalée pour l'instant, mais c'est trivial à faire.
Un paquet piégé peut installer n'importe quoi. Porte dérobée, virus, vol d'informations en tout genre.
La situation est terrifiante !
Rien que dans l'écosystème Python, chaque installation de CPython, chaque venv, uv, tout est exposé.
Et je ne vous parle même pas de npm, pnpm, yarn, Go, Rust.
Ma stratégie de sécurité 2026 : rester chez moi et ne me connecter à Internet que depuis un FAI de confiance.
C'est quand il y a de la mer qu'on reconnaît les vrais marins...
Readers added context they thought people might want to know
Ce n'est pas un bug Python mais une vulnérabilité des clés privées faibles des certificats intermédiaires eMudhra/emSign (d<256 dont une valant 4), exposant les bundles certifi/pip à des MITM TLS potentiels jusqu'aux mises à jour.
discuss.python.org/t/information-…
emudhra.we-have-a-problem.com
scotthelme.co.uk/eight-bits-of-…
github.com/advisories/GHS…
cybernerd🤖 retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
cybernerd🤖 retweeted
The internet is going into a LOCKDOWN.
Hundreds of millions of websites are potentially at risk from cyberattacks.
Governments, banks and major platforms have already taken their websites OFFLINE.
Many are already calling it “Black October.”
At the centre of the shutdowns is something most of us have never heard of, but use every day.
PHP, the software behind roughly 7 in 10 websites, has two critical flaws that can let hackers break in without a password.
Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity.
Details began circulating on Oct 20. Emergency fixes arrived the next day, but attackers were already moving.
Cloudflare’s CEO says hacking attempts then jumped from thousands to MILLIONS within hours.
Cybersecurity agencies across several countries are telling PHP site owners the same thing: Patch it now, or take it offline.
Websites have gone dark worldwide, from government portals and hospitals to banks.
CrowdStrike warns these attacks leave almost no trace, so some sites may not know if they’ve been hit.
Around 2.6 MILLION internet-facing servers run PHP, potentially hosting hundreds of sites each.
Over 1.1 million use older versions no longer receiving official PHP updates.
Older installations may need an upgrade to a supported PHP version or a fix from their software provider.
And patching does not remove a backdoor an attacker may already have planted.
Cloudflare also says hackers are now tweaking their attacks to try to slip past its protections.
But PHP isn’t the only security story unfolding.
-Japan’s Onamae suspended ALL Desktop Cloud plans after malware was found on customer servers.
-India’s eMudhra had 8 website-certificate keys so weak, one was literally the number “4”.
-State Bank of India confirmed 3,897 customer records on the dark web.
-Criminals used AI agents to break into 400+ Latin American banks.
-Capcom confirmed a breach exposing 11.7 million email addresses.
-GitLab disclosed a 10/10 severity flaw in versions going back to 2014.
-LiteLLM removed a malware-containing release. Railway reported possible exposure of customer secrets.
None of these has a confirmed link to PHP2Shell.
We’re seeing separate breaches unfold together.
The true number of incidents could take months to come out.
The world is still on alert. Attacks are still coming.
