Kevin Poireault (@leekthehack) header
Kevin Poireault (@leekthehack) profile picture

Tech & cybersecurity journalist @InfosecurityMag Also behind @coupecircuit_ đŸ‡«đŸ‡·đŸ‡ŹđŸ‡§

London, United Kingdom
Joined October 2011
Photo by Kevin Poireault (@leekthehack)Photo by Kevin Poireault (@leekthehack)Photo by Kevin Poireault (@leekthehack)Photo by Kevin Poireault (@leekthehack)Photo by Kevin Poireault (@leekthehack)Photo by Kevin Poireault (@leekthehack)Photo by Kevin Poireault (@leekthehack)Photo by Kevin Poireault (@leekthehack)Photo by Kevin Poireault (@leekthehack)Photo by Kevin Poireault (@leekthehack)
Kevin Poireault retweeted
Of all the vulnerabilities (CVEs) published so far in 2026, 4% have been reported as exploited in the wild (by @VulnCheckAI ). The last 2 years, it was 7%.
7
9
2
40
3,597
Kevin Poireault retweeted
Current status of the binance hacker wallets
Complete flow of the binance hack so far
2
6
1
46
23,411
Kevin Poireault retweeted
⚠ Ciblage de tĂ©lĂ©phones Apple đŸ“± ⚠ Le CERT-FR a connaissance de notifications envoyĂ©es par Apple le 29 octobre 2026 Ă  des utilisateurs ciblĂ©s par des logiciels espions. Si vous en avez Ă©tĂ© destinataire, contactez le CERT-FR au plus vite — cert.cyber.gouv.fr/cti/CERTF

3
46
3
170
59,585
Kevin Poireault retweeted
Agentic money laundering
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence. Read more: chainalysis.com/blog/binance

39
372
25
3,129
221,240
Kevin Poireault retweeted
Post mortem of the binance hack and hacker so far
Complete flow of the binance hack so far
9
49
3,392
Kevin Poireault retweeted
Massively underreported: an official Claude Code extension was compromised and installed backdoors on developer machines. Could it be behind the Binance hack?
157
55
39
559
106,396
Kevin Poireault retweeted
Today's Claude extension compromise is a good reminder to do this. If you're using VSCode @code, Cursor @cursor_ai, or any other IDE built on VSCode, I would immediately enable extensions.installCooldownHours. I've set this setting to 72 (hours), which is a much safer delay to install new updates to extensions than the default setting of 0 (immediate updates). This prevents extension updates from getting installed for 3 days, which would hopefully eliminate most of the risk from compromised updates. It's not foolproof, but it's better than no delay. Heck, set it to something even higher to be safer, like 336 (2 weeks).
19
69
8
403
35,362
Kevin Poireault retweeted
There’s misinformation circulating about the Claude Code incident. The confirmed incident involved a tampered copy distributed through Cursor’s own marketplace. A compromise of Anthropic’s official distribution, Microsoft’s VS Code Marketplace or Open VSX has not been established. cursor.com/blog/claude-code-

‌ Anthropic's official Claude Code extension was distributed with an SSH backdoor via Cursor's marketplace. A trojanized update (v2.1.313) targeted up to 5,000 users, according to Cursor. How attackers pushed it under the legitimate extension's identity remains unclear. Read: thehackernews.com/2026/10/of

23
25
1
124
15,367
Kevin Poireault retweeted
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products. In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk. If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: cursor.com/blog/claude-code-

474
1,014
646
6,544
1,104,174
Kevin Poireault retweeted
Complete flow of the binance hack so far
22
76
9
540
135,921
Kevin Poireault retweeted
The game has changed 👇
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence. Read more: chainalysis.com/blog/binance

20
2
153
25,239
Kevin Poireault retweeted
I want to speak to you directly about what happened. Bottom line - your money is safe, and we're covering every loss. Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions. To be clear: the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak. We'll share a detailed technical post-mortem once the investigation is complete and every fact is verified - and publish an updated Proof of Reserves once remediation is complete. What you need to know: ‱ Your funds are safe ‱ Binance will cover all losses from the SAFU fund and company funds ‱ Estimated total impact: ~$6.3B, with ~$3B frozen on-chain so far, in coordination with our blockchain partners ‱ No evidence of any wallet private key leak ‱ Deposits are unaffected and operating as normal What we've done: ‱ Temporarily suspended withdrawals while we complete a security revamp of the withdrawal service and its related addresses ‱ Revoked the affected address authorizations ‱ Engaged law enforcement and blockchain intelligence partners to trace and recover funds Our team hasn't stopped. We're working closely with law enforcement to ensure the matter is handled appropriately - and I'll share what I can, as soon as I can.
742
818
193
5,899
602,204
Global cryptocurrency giant @binance has confirmed it suffered the largest cyber-attack in history, resulting in $6.3bn of cryptocurrency being stolen. infosecurity-magazine.com/ne

46
Kevin Poireault retweeted
In a single year, AI has rewritten the security priority list for CISOs. Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses. There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems. In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI. The biggest jumps since 2026: - Internal AI agent security (+28 pts) - AI SOC (+26 pts) - AI offensive security (+24 pts) - AI code security (+23 pts) - AI vulnerability remediation (+22 pts) Last year's staples: - Exposure & vulnerability management (-21 pts) - SIEM / security data (-18 pts) - Privileged access management (-18 pts) From a16z's @OwenColby and @steph_zhang on The New Security Agenda: a16z.news/p/the-new-security

78
123
72
798
142,898
Kevin Poireault retweeted
BREAKING: A hacker is attempting to breach the US Federal Election Commission's systems and that agency has had to 'temporarily shut down' its web-facing services as a result, according to an email seen by Reuters reut.rs/4imQyUu
981
4,803
1,174
9,354
1,808,831
Kevin Poireault retweeted
Coupure des réseaux sociaux. J'ai contacté les 4 opérateurs télécoms concernés. Réponses : @free : pas de commentaire @bouyguestelecom : pas de commentaire @SFR : pas de réponse @orange : pas de commentaire, si ce n'est qu'« Orange exerce ses activités dans un cadre légal et réglementaire. Comme tout opérateur, nous sommes tenus de nous conformer aux obligations qui nous sont légalement notifiées par les autorités compétentes, dans le respect du droit applicable. » @FFTelecoms (BT, Orange, SFR) : pas de commentaire. "On laisse le gouvernement s'exprimer", me glisse en parallÚle une source
Information exclusive Blast : le Premier ministre a prĂ©parĂ© la coupure des rĂ©seaux sociaux pour le 24 octobre Deux jours avant la manifestation du 24 octobre, le Premier ministre SĂ©bastien Lecornu a demandĂ© Ă  Orange, SFR, Free et Bouygues Telecom de se tenir prĂȘts Ă  couper l’accĂšs Ă  TikTok, Instagram ,Snapchat et X. Blast rĂ©vĂšle la lettre et le compte rendu de la rĂ©union qui a suivi, oĂč les opĂ©rateurs ont exprimĂ© leurs doutes. Le gouvernement avait dĂ©jĂ  utilisĂ©e cette mesure liberticide en Nouvelle-CalĂ©donie en 2024, avant d’ĂȘtre dĂ©savouĂ© par le Conseil d’État. Par @yanmdi. blast-info.fr/articles/2026/

17
262
18
617
246,413
Kevin Poireault retweeted
Sorry folks, we have a confirmed PHP compromise with post-exploit activity. Still not the widespread outbreak we all braced for, but it’s actively exploited in the wild. Updated threat brief: unit42.paloaltonetworks.com/

23
110
15
363
81,122
Kevin Poireault retweeted
Ah bah voilà, c'est parfait ça pour un vendredi !! Allez hop, on remet ça.
‌ BREAKING ‌ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws. New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance. Full details → thehackernews.com/2026/10/ur

23
90
7
584
53,438
Kevin Poireault retweeted
Evolving threat 🚹 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.” A significant blast radius. This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression. Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
118
853
429
3,450
812,906