IVERMAX retweeted
it's ironic, all those sleepless nights I spent as a teenager trying (and in most cases failing) to think up ways to spread RATs, i feel like i've developed a sixth sense of supply chain opsec/schizo level paranoia that protects me to this day.
what should really start to become obvious to people is that the time and cost of someone waking up and deciding they want to hit a supply chain (that you might use) to maximise their profits has shrunk to a period where you really don't get a day that goes by where you're not questioning your own security decisions.
this is the world we live in for now - not sure if it will change as things start to level out but no doubt we're currently in what blackhats will call the good old days in a decade to come.
Cursor users: check your Claude Code extension.
Cursor confirms a trojanized Anthropic.claude-code v2.1.313 in its extension marketplace on 29 October, 09:27 to 20:35 UTC. It estimates up to 5,000 affected users and identifies macOS ARM64 and Windows x64 builds.
Loading the extension executes malicious code that collects host information and attempts to install a persistent SSH backdoor.
Cursor says SSH access would fail on most hosts due to bugs and insufficient privileges. That limits remote access; it doesn’t undo malicious code execution. Credentials and repositories accessible to that account are potentially at risk.
The package has been removed and the C2 taken offline. Uninstalling the extension may still leave persistence behind.
If this version ran, investigate the host, remove persistence and rotate accessible credentials from a clean system. Updating the extension alone doesn’t prove the machine is clean.
The vendor-confirmed distribution channel is Cursor’s marketplace. Microsoft VS Code uses a separate store. These reports don’t establish a compromised Microsoft Marketplace or malicious npm release.
My recommendation: turn off automatic extension updates completely - for yourself and for your developers. With supply chain attacks like this, I don’t think the benefit of another feature or a minor UI fix justifies automatically accepting every new release onto developer machines.
Update manually when something stops working, when a bug is actually getting in your way, or when a relevant security fix needs to be applied. Otherwise, leave a working extension alone.
Cursor advisory and cleanup instructions:
cursor.com/blog/claude-code-…
Technical analysis:
opensourcemalware.com/blog/t…
IVERMAX retweeted
That's cute, literally ever Linux system on the Internet is wide open.
I wonder if Android is affected ...
🚨 Fallo crítico en el kernel de Linux: se puede atacar por red, sin login y sin necesidad de ninguna acción por parte del usuario.
CVE-2026-98432
➡️ CVSS 9.8 (crítico)
➡️ Afecta a la gestión de conexiones TCP/IPv4, el código que atiende cualquier conexión a tu servidor.
➡️ Ubuntu marca vulnerables desde la 16.04 hasta la 26.10, también los kernels de AWS, Azure, Google Cloud y Oracle.
➡️ La corrección todavía está «en preparación» en casi todas.
Si tienes un servidor o un VPS con Linux, sigue los avisos de tu distribución y actualiza el kernel (y reinicia) en cuanto salga el parche.
ubuntu.com/security/CVE-2026…
IVERMAX retweeted
Periodic re-up of @rossjanderson (RIP)'s definition of "security engineering"
"Security engineering is about building systems to remain dependable in the face of malice, error, or mischance. As a discipline, it focuses on the tools, processes, and methods needed to design, implement, and test complete systems, and to adapt existing systems as their environment evolves."
cl.cam.ac.uk/archive/rja14/P…
IVERMAX retweeted
For fifty eight years, my boss in Tokyo believed that beef should be sliced as thin as paper.
In Japan, we cook thin meat for four seconds in boiling broth. That is our way.
Then last month, the YouTube algorithm showed Director Sato a video of a man in Texas smoking a brisket.
It changed his life.
On Monday morning, he called me to his desk. His eyes were bloodshot.
"Have you seen this?" he whispered, turning his monitor toward me. "The American pitmaster does not sleep for sixteen hours. He sits by the fire in the dark. He guards the meat like a castle."
I said, "Sir, it is just a barbecue."
He slammed his hand on the desk.
"This is not cooking," he said. "This is a vigil."
Last Saturday was our annual company picnic by the river in Kanagawa. Normally, we grill thin meat and yakisoba for two hours and go home at 2:00 PM.
I arrived at 9:30 AM to help set up.
Director Sato was already there.
I want to be accurate here: he had been sitting in a folding chair since 10:00 PM on Friday night. He was wearing a towel around his head and staring at a massive black barrel smoker he had imported from Oklahoma.
Inside I said: THIS MAN HAS ABANDONED CORPORATE LIFE FOR THE SMOKE.
When we tried to help him, he held up a pair of metal tongs and clicked them twice.
"Step back," he said calmly. "The stall has begun. Nobody opens the lid."
Twelve Japanese accountants stood in complete silence around a barrel for four more hours. Nobody dared to eat a single noodle until he gave the signal.
At 1:45 PM, he sliced the meat. It fell apart on the cutting board.
My boss looked at the pink smoke ring, nodded once, and wiped a single tear from his cheek.
He has already submitted an official budget request for a trailer smoker for next fiscal year.
IVERMAX retweeted
I don't think security researchers identifying vulnerabilities one-by-one will provide as much value as security *engineers* who can proactively prevent every vulnerability alert from being a SEV-0 or turning into a security incident.
IVERMAX retweeted
heard in Silicon Valley:
Security researchers will soon make more than AI researchers.
IVERMAX retweeted
I lost half my Bitcoin in the Coldcard hack.
This completely destroyed my faith in cold storage, so I transferred the other half of my Bitcoin from my Trezor to an exchange for safe-keeping.
Unfortunately that exchange was Binance. Fuck my life.
IVERMAX retweeted
The largest crypto exchange in the world just experienced the largest robbery in human history—and the person running it is a nomadic autistic man in Dubai posting “Funds are SAFU!”
What a time to be alive.
IVERMAX retweeted
I remember my young friend showing me his uncircumcised penis behind the school one day and being horrified, I had never seen one before. When I asked him why it looked like that he said nigga you’re thirty five years old you tell me
IVERMAX retweeted
If you don’t believe Jesus is God or you don’t believe in God at all then I completely understand that.
BUT there’s a cradle Hindu who became a Christian based on the historical evidence and he’s doing a talk about why this Friday in SF. You should come see.
This Friday, I’ll be giving a talk on the historical case for the resurrection of Christ.
Several years ago, I began looking into the historical evidence as an atheist to prove that Christianity was nothing but a therapeutic superstition. What I found completely changed my life.
Over the course of a year, I spent nearly every waking moment reading whatever I could find on the subject. My entire life was suddenly reorganized around answering this one question: did Jesus Christ actually rise from the dead?
There was a time when I thought this question was too ridiculous to even consider. But looking back, it was by far the most important question I've ever asked.
If you're interested in learning more, check out the link to the event page below. All are welcome to join regardless of religious background or lack thereof.
IVERMAX retweeted
Grok Bot 0.77.0 is rolling out now. All features may not be active on your account and may be in future patches, but are currently in the code.
Top 10 of what we expect to see:
IVERMAX retweeted
Mighty’s VIO works great indoors and at low altitudes, but struggles once a drone flies too high.
I’m working on a VPS mode that uses onboard maps to localize using just the camera, without GPS.
The crazy part? All of this on a $67 camera.
IVERMAX retweeted
The best way to level up your bug bounty skills? By reading more! 🧐
We've been publishing free, in-depth web app hacking articles for years, covering everything from SSRF and broken access control to GraphQL, cache poisoning, and AI security. 🤠
Start reading, link in next post! 👇
#BugBountyTips #HackWithIntigriti
































