Software Engineer from The Netherlands
Nederland
Joined November 2016
- Tweets1.2K
- Following43
- Followers39
- Likes2.4K
Melroy van den Berg retweeted
The bug is like a joke.
On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
Melroy van den Berg retweeted
Ubuntu is getting roasted over a kernel bug it still hasn't patched.
CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP handshake code. It's been there since 2016, it can be triggered remotely, and it's rated CVSS 9.8. Debian shipped a fix on October 16. Arch, Alpine and Slackware have fixes too.
Ubuntu's security tracker still lists every supported release, 24.04 and 26.04 LTS included, as "Vulnerable", with fixes marked "work in progress". Ubuntu also rates it "High" rather than Critical, and Critical is what normally triggers an out-of-cycle update.
A blog post called "WTF Ubuntu?" by chalmovsky hit the top of Hacker News today. It says: "Ubuntu hasn't shipped the patch nine days after it was rated 9.8 and six days after a working root exploit." The author also took their Ubuntu servers offline.
HN commenters point out that fixed kernels are already sitting in Ubuntu's -proposed repositories. Others are swapping migration notes for Debian, AlmaLinux and Rocky. So far there's no public statement from Canonical.
Melroy van den Berg retweeted
🚨 Critical Linux kernel TCP flaw enables remote root code execution; CVE-2026-98432
A race condition in the Linux kernel’s IPv4 TCP implementation can trigger a use-after-free before application authentication, potentially allowing an unauthenticated remote attacker to leak kernel memory, corrupt memory or crash the system.
Anthropic says Claude developed a working exploit that executed attacker-chosen commands as root against Linux servers with a Multipath TCP listener. The exploit took approximately 53 minutes to complete during testing and has not been publicly released.
⠀
• CVSS: 9.8 Critical, according to the Linux kernel CVE team
• Affected: Linux kernels beginning with version 4.4
• Fixed: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3
• Attack requirements: Network access, no credentials and no user interaction
• Exploitation status: No known attacks in the wild
⠀
Ubuntu and Red Hat Enterprise Linux had not released corrected kernel packages as of October 29. Debian, Oracle Linux, Amazon Linux and SUSE have released fixes for at least some affected branches.
Distribution severity ratings differ substantially. Red Hat rates the flaw 5.9 because it considers the race difficult to win and describes denial of service as the most likely practical impact.
Melroy van den Berg retweeted
How the Binance hack worked:
The attacker exploited EIP-7702 - an Ethereum Pectra upgrade
That lets a regular wallet temporarily act as a smart contract with a valid private key signature.
Hacker pre-collected 50 EIP-7702 authorizations with sequential nonces
Not knowing the exact nonce at attack time.
Sent them all at once, only one matched.
That was enough.
The Tron stablecoin movements? Binance themselves
Melroy van den Berg retweeted
‘Eco-friendly’ PAPER straws can be WORSE for the environment than PLASTIC — South Korean study
Plastic had the lowest impact in 10 of 16 categories assessed, from production to disposal
Researchers recommend providing ALL disposable straws only on request
Melroy van den Berg retweeted
🚨 BREAKING: Node.js just dropped its OWN security bombshell.
4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.
→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity.
→ REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely.
→ TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions.
→ Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to.
→ THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates.
→ RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches.
→ PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers.
PHP AND Node.js both facing major security disclosures on the SAME DAY.
If you run a website or application, TODAY is the day to check your servers.
And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated.
Don't be the last one to patch.
🚨 A MASSIVE internet security emergency is unfolding right now. 🚨
Two CRITICAL vulnerabilities have been discovered in PHP, potentially putting millions of websites at risk.
→ NEARLY 70% of websites with a known server-side language run PHP. The potential scale is ENORMOUS.
→ TWO CRITICAL security flaws have been confirmed, each scoring 9.2/10 in severity.
→ Attackers could potentially take control of vulnerable servers remotely, without authentication.
→ Reports suggest PHP versions dating back to 2004 could be affected. The exact scope is still unconfirmed.
→ EMERGENCY PATCHES are scheduled for TOMORROW at 10 AM ET. Website owners are being urged to prepare immediately.
→ Europe's CERT-EU is warning organizations to patch ASAP or consider TAKING EXPOSED APPLICATIONS OFFLINE if they cannot be secured.
→ WordPress, Magento, Laravel and potentially millions of other PHP-powered websites could be at risk.
→ Once patches go public, hackers could reverse-engineer them and race to attack servers that haven't updated.
The vulnerabilities are CONFIRMED. The full technical details remain secret.
Tomorrow, the race between hackers and defenders begins.
This could get ugly. FAST.
Melroy van den Berg retweeted
New on our Engineering blog: Creating in-house source control.
In May, we merged around 2,500 code changes per day. In September, we merged more than 30,000 per day. As a result, we became bottlenecked by developer infrastructure built for human (rather than agent) scale.
Here, we share how we built a new version control system—and fully migrated our monorepo from git—in five months: anthropic.com/engineering/re…
Melroy van den Berg retweeted
As of now, no fly can ever know for sure if it is living in a real world or a simulated one. Must be incredibly depressing
Melroy van den Berg retweeted
For the second time in Google Chrome’s history, Google awarded a $250,000 bounty for a full-chain exploit… to @XBOW. Here’s the full story:
At an all-hands at the start of 2026 in Malta, I set the team a crazy challenge. A full-chain exploit of Chrome by the annual Black Hat cybersecurity conference in August.
I believed there were few better tests of whether @XBOW could move beyond web applications to desktop software, servers and devices.
Chrome is one of the most hardened pieces of software on the planet, used by more than half the world’s population.
A full-chain exploit lets an attacker take total control of a machine, where they can read every email, password and bank login the user types. You don’t need to download anything or click a phishing link. Visiting the wrong site is enough.
So @moyix, Andres Luksenberg, Baul Lee, and Willem Pinckaers took on the challenge along with a fifth teammate: OpenAI's GPT-5.6 Sol.
They built a chain they thought would win, but Google told us they already knew one of the bugs.
We were already in Las Vegas for Black Hat and DEF CON, and the team didn’t want to go home without the win.
So Brendan and the agents built a new exploit in just 6 days.
We submitted it to Google and waited.
The news came through that we'd done what should’ve been impossible. A full-chain bounty of $250,000, the first awarded under Google’s 2026 rules.
It took just 6 days and $40,000 of compute to construct an exploit that affects a billion users of Chrome on Windows. An intelligence-agency veteran told me his team used to spend 6 months on this kind of vulnerability.
My takeaway: the cost of finding truly critical vulnerabilities is collapsing, for attackers and defenders alike. Restricting powerful models is not the answer; GPT-5.6 Sol is already public.
But defenders have one advantage attackers never will: they can test their own code first.
Assume your software is exploitable. Whoever is hunting your bugs has the same building blocks we did.
This is cause for urgency but not panic.
XBOW is now developing an autonomous product for testing compiled software (desktop applications, servers, embedded devices), and partnering with the world’s top organizations to design that product.
If you’d like to be one of them, get in touch.
P.S. Restart Chrome whenever the Update button appears!
Melroy van den Berg retweeted
Announcing tsc-rs (aka ts-rust), my complete rewrite of the Typescript compiler, type checker, and LSP, all in Rust.
This is a project I've had agents working on for 5 months now. I burned ~$400k of Codex tokens and got nowhere. Burned ~$20k of Opus and got there in 2 weeks.
I have not read a single line of the code.
tsc-rs is an open source drop-in replacement for tsc, and it's available now.
Melroy van den Berg retweeted
Link to Halo OpenCE Decomp
github.com/OpenCommunityEdit…
Melroy van den Berg retweeted
Meet Mistral Large 4, aka Le Chonk.
• 1T parameters, natively multimodal. 49B active.
It is the best open weights model from US or Europe on aggregated benchmarks.
• State-of-the-art on critical workloads, including cyber defense, manufacturing and finance and it surpasses closed frontier models on visual grounding.
• Forged in Europe end-to-end and is deployable from Europe via our own Mistral Cloud infrastructure.
• Available to all via API today. Working with cybersecurity partners privately.
Open weights release end of October.
🤖 Made with AI
Melroy van den Berg retweeted
For decades, researchers have sought materials that sort electrons by spin while their magnetism cancels.
In 3 days, 90+ Opus 5.5 agents helped us uncover two room-temperature magnetic semiconductor candidates in simulations: YBaMnFeO₅ and KV[Cr(CN)₆].
KV[Cr(CN)₆] was synthesized back in 1999. Its predicted ability to sort electrons by spin appears to have been hiding in plain sight for 27 years.
