🔨 https://nitter.cf/t.co/J8SDEpaBbF (AI native agency) ❤️ Also boyfriend of 20ys, uncle, sailing, skating, gardening, mountainbiking.
Joined April 2009
- Tweets5.1K
- Following471
- Followers490
- Likes29.5K
For me as a sailor this is the most understandable benchmark ever
I stop working with cloud agents. It's too expensive and slow for too mid results. When I work in Cursor directly I can control the model and see what it's doing.
Cloud agents are a scam for LLM providers to make more money
Philipp M. W. Hoffmann retweeted
"Saas is dead because customers can vibe-code their own tools."
People can cook. Restaurants still exist.
Sadly Germans don’t want to hear how strong they are, somehow they are afraid of themselves
Maybe that’s due to our collective heritage
Far too much depends on what Germany believes in and whom Germany believes in.
The United States’ role in the world may become even smaller. So Europe’s role in the world must become even greater. And without Germany, this is impossible.
Without you, freedom will surely lose.
Freedom and security in Europe have no alternative to your commitment and your strength.
Europe has no alternative to Germany. Please remember that.
From the address at the Berlin Security Conference. (1/3)
Philipp M. W. Hoffmann retweeted
7 BILLION DOLLAR crypto hack came from a homebrew install from someone tryna vibecode something 😭
7 hours. thats how long none of our apps auto deployed today and nobody noticed
this morning my devops @bot hardened our servers and closed port 8000 on the coolify box, and it turns out the github app was sending its webhooks straight to the server ip on exactly that port instead of the domain. only caught it just now because i pushed to a new staging app and nothing happened
fix was one url in teh github app settings
grokbot closing ports is great until you find out what was talking to them
Called it @SawyerMerritt !
Philipp M. W. Hoffmann retweeted
Is it seeing a car that is not there and missing all other cars?
Or maybe the video on the screen is simply pre-recorded and doesnt represent the reality at all?
staging felt super slow so i had my devops grokbot look. server answering in under a second, zero errors
the browser was downloading a 407 kb tailwind compiler and biulding the css on every single click
network tab first, bigger server later. thanks @bot
a grokbot (@bot) checks my ad campaign every morning and most days it says nothing, which is the feature
for getease we're testing ads inside chatgpt (openai ads), brand new channel, small budget, lots of unknowns. so i set up a routine on my marketing @bot that pulls the numbers read-only every morning at 8 and only messages me when something actually changes
for weeks it stayed quiet, a few impressions a day, one click total, €1.33 spent. then one tuesday the campaign woke up with 682 impressions and 3 clicks in a day and thats when i got a message
honest result so far is around 850 impressions, 4 clicks, zero conversions. new channels are chaep to test and humbling to measure
"report only on change" beats any daily dashboard imo, the monitoring cost me zero minutes a day
Philipp M. W. Hoffmann retweeted
Vor allem, und das beobachte ich bei mir selbst und extrapoliere, dass es auch anderen so geht:
wenn du einmal Scheiße gelesen hast, selbst wenn danach irgendwann ne Community Note oder Faktencheck kommt, das Gehirn nimmt die Richtigstellung dann nicht mehr ernst
Scheiße ist schon abgespeichert
Das find ich besonders heftig
Deshalb sollte imo jemand der auf X dauernd CN'ed wird einfach den Reach entzogen kriegen nach ein paar Strikes um die Leute zu erziehen keine Scheiße zu posten
tried that. whatsapp only lets you link 4 devices iirc and i run 20 something grokbots, so 3 of them were sharing one whatsapp web session and kept kicking each other out all day
so now exactly one bot, my chief of staff @bot, is allowed to open whatsapp. every other bot asks it for chat summaries or hands it a message to send, and it only sends with my ok
one integration, one owner bot, everyone else goes through it
admin / change_me_in_production
that was the api password, sitting in the public js bundle of a side project of ours. my security grokbot spotted it while upgrading dependencies, fix is merged and live
evreything in a vite build variable is public. @bot
meanwhile my grokbot just found one of our 6 servers running with no firewall attached at all. not a zero day, nobody ever clicked the button. @bot had it locked down 12 minutes after i gave it the token
🚨 CHECK POINT CONFIRMS ACTIVE EXPLOITATION — NEW ZERO-DAY HIT MANAGEMENT SERVERS BEFORE PUBLIC DISCLOSURE
Check Point has issued an urgent advisory confirming active exploitation of two critical vulnerabilities across its Security Gateway and Security Management products, including a newly disclosed zero-day.
• CVE-2026-93616 — CVSS 9.8 — is a pre-authentication path traversal vulnerability in the Check Point Management web service
• Successful exploitation can execute a script from an arbitrary path and load an arbitrary Java class
• Check Point says it observed a handful of pinpointed attacks exploiting the zero-day on July 23 — roughly two months before today's public disclosure
• The vulnerability affects Security Management releases including R82.20 and multiple R82/R81 branches
• Check Point explicitly warns that LivePatch Take 28/29 does NOT address CVE-2026-93616; customers need the newly released fix
• Separately, Check Point now confirms active exploitation of CVE-2026-85102, the CVSS 9.8 pre-auth RCE in VPN certificate handling disclosed September 9
• Exploitation attempts against Spark customers began September 12 and originated through anonymization infrastructure including VPN services and proxies
• Check Point observed attacker certificate subjects including vpn, vpn-user and vpnuser
• Post-login activity can include internal port and service scanning
⚠️ Analyst Note:
The most important development is CVE-2026-93616: this was not merely a newly patched critical bug. Check Point's own telemetry shows targeted exploitation occurred in July while defenders had no public vulnerability information or patch specifically for it.
The simultaneous exploitation of VPN gateways and centralized management infrastructure also makes this a high-priority perimeter-security event. Organizations running affected Check Point environments should patch immediately and hunt for historical compromise rather than treating remediation as patch-only.
Original Check Point advisory:
blog.checkpoint.com/security…
#CheckPoint #ZeroDay #CVE202693616 #CVE202685102 #ActiveExploitation #Firewall #VPN #ThreatIntel #DDW #DarkWeb
