Nicolas Peeters retweeted
💥 @UberEats is now on @Amazon.
We’ve always believed in meeting customers where they are. Amazon takes that to a whole new scale.
U.S. Prime members now get a $0 Delivery Fee on restaurant orders over $25. No new app. No Uber account needed.
investor.uber.com/news-event…
Super proud of this work at @Uber where our team has launched this new integration!
Amazon has made Uber Eats as its official restaurant delivery partner for Prime members in the United States.
spr.ly/6018BH0WKg
If you are using Google Docs and Slides, you'll love that Chrome extension github.com/peetersn/docs-cla…
If DST time change isn't already painful on its own, how on earth is not synchronized between countries (e.g. US-EU)?
good thread on personal security
I genuinely struggle to understand the concept of passkeys and how they are supposed to make things more secure.
It seems like for some reason most password managers store the passkey in their vault but this then suddenly circumvents the entire concept of 2FA yet again, doesn't it?
It feels the same as having your auth codes inside your PW manager.
Am I missing something?
Hard to overstate how big of a deal this is.
tl;dr — ANY unpatched Linux server with even a single TCP port exposed to the internet (say for HTTP or SSH) and MPTCP active (default for many Go web servers) is vulnerable to complete takeover.
What a disaster atlasum.net/blog/cve-2026-98…
If this is what has employees at Proton in revolt, they're in for a rough ride as the age of agents unfold. There is nothing scandalous in this memo. It's hilarious that 404 is treating it as such.
Replying to @josephfcox
Here is Proton CTO's AI manifesto, that I obtained multiple copies of 404media.co/manifestos-fear-…
Nicolas Peeters retweeted
I don't think people realise how big a deal this is.
If you have cancer, or somebody you know has cancer, there is a company in Hyderabad that wants to build a personalised cancer vaccine for you.
Try approaching any big pharma company and asking for a personal vaccine. If they even reply to your email, this is the response you'll get: we don't do that here.
PopVax, on the other hand, takes your tumour sequencing data (or a sequence you've designed), designs candidate neoantigen vaccine sequences with their AI pipeline, produces the mRNA, encapsulates it in their LNP formulation, fills vials, and runs QC, all in 8 to 10 weeks. They’re publicly committing to capacity for 100+ of these over the next 12 months and asking people to email them their cancer type/stage and sequencing details.
What a time to be alive.
Totally relate to this madness. This needs to stop.
Replying to @levelsio
This is literally killing my company right now. Had one full time employee that called in sick one day after her trial period. So no way to cancel the contract. In the mean time she renovated her house. Than she didn’t respond to the necessary UWV-papers, guess what, I have to pay her one year extra.
This is 80.000 euro per year for a 3,5m company.
I can have insurance, but they pay up to 70% , after 1 month, and the costs are 100000 per year at minimum.
With +50 people working for me it is unbearable. So, when this race is over no way I am ever setting up a company with employees ever again.
Nicolas Peeters retweeted
I told Claude to make a video about what it's like to be European
One day later...
Nicolas Peeters retweeted
The GRU hacked into Jared Kushner's iPhone. Dutch military intelligence (MIVD) then recruited a GRU spy who gave them access to the hacked phone. What MIVD discovered was that Kushner had access to two bank accounts --one Azerbaijani, the other Israeli --where Saudi Crown Prince Mohammed bin Salman and Emirati ruler Mohammed bin Zayed deposited money. It sounds like a slightly far-fetched episode of "Slow Horses," but it's real. And it proves just how eye-poppingly corrupt this administration was and continues to be as its "special envoy" decides the fate of tens of millions in Europe in the Middle East. Simply incredible reporting by Matthew Cole, drawn from his new book on Kushner. vanityfair.com/story/jared-k…
Nicolas Peeters retweeted
German government folks celebrating their immunity to the cyber apocalypse as they’re still running on Fax
🤖 Made with AI
Nicolas Peeters retweeted
Computer folks- I think we're just going to have a day like today every month now. Make it very easy to update your entire fleet in one go.
Nicolas Peeters retweeted
When you get a midnight Slack message from your boss asking why you set the password for the entire internet to “4”
Nicolas Peeters retweeted
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
Nicolas Peeters retweeted
France used to be Badass in the 70s.
My dear American friends, in my last post I gave you a snapshot of where France stands today. Now let me show you how we got here. I want you to see the whole movie before you buy the ticket.
After the war, France was a machine. We called it the Trente Glorieuses, thirty glorious years. We built Concorde, the most beautiful aircraft ever made. We built a fleet of nuclear reactors in about fifteen years and gave ourselves some of the cleanest, cheapest electricity in the world. We built Ariane and put Europe in space. We built the TGV, the fastest train on earth. We invented the Minitel, an online network in millions of homes before most of you had heard of the internet. We were not a museum. We were builders.
Then came 1981. François Mitterrand. Think of him as our Bernie Sanders, except he actually won. At his side, in the office next to his at the Élysée, sat a 37-year-old prodigy named Jacques Attali, his special adviser for the next ten years. The brightest minds of the left, convinced they could run an economy from a ministry.
Here's what they did. They governed with Communist ministers. In 1982 they nationalized dozens of banks and the biggest industrial groups in the country: Paribas, Suez, Saint-Gobain, Thomson, Pechiney, Rhône-Poulenc. They lowered the retirement age to 60. They cut the work week to 39 hours and added a fifth week of paid vacation. They created a wealth tax. They hired massively into the public sector.
Reality hit in less than two years. Capital fled, inflation ran wild, and the franc was devalued three times. In March 1983 Mitterrand had to slam on the brakes and impose austerity just to stay in the European monetary system.
But here's the trick: the brakes never reversed anything. They just slowed the ratchet. The so-called right came back with Jacques Chirac, and nothing was undone. Under Chirac's presidency, France passed the 35-hour work week. Left or right, every government added one more program, one more rule, one more tax, and nobody ever took one away.
At the same time, the political class did something even more destructive than bad economics. It turned the youth into a political instrument. Instead of teaching young people, including millions of children of immigrants, to love the country they lived in, it taught them a story of guilt and grievance: France as the oppressor, France as the thing to resent. You cannot integrate people into a country you've taught them to despise. We are living with the consequences of that narrative today, in our schools, our suburbs, our streets.
Then forty years of slow decline, all the way to Macron. And the story has a perfect ending. In 2007, Jacques Attali chaired a commission on how to unleash French growth. Its deputy rapporteur was a young civil servant named Emmanuel Macron. The commission proposed more than 300 reforms to free the economy. Almost none were ever implemented. Even the men who built the system knew it wasn't working, and even they couldn't undo it.
No balanced budget since 1974. Public spending around 57% of GDP. Debt above 3,300 billion euros. Growth stuck under 1%.
Now the number that should keep you up at night. In 1995, GDP per person in France was about $27,000. In America, about $29,000. We were neck and neck. Today France is around $49,000. America is around $90,000. You are now nearly twice as rich per person as we are.
What changed? Not our talent. Not our engineers. Not our schools of mathematics. The only thing that changed is that we went all in on socialism. The 35 hours, the endless regulation, the taxes that chase out anyone who builds, the belief that the state should do everything and the individual should ask permission for everything.
There's a line people love to attribute to Einstein: insanity is doing the same thing over and over and expecting different results. We tried. For forty years, we tried. Every government promised that one more program, one more tax, one more regulation would finally fix things. You just saw where it got us.
So if you choose the Democratic Party, which is literally turning socialist in front of your eyes, you will deserve what comes next.
Let me tell you exactly what will happen if you go down that road. Nobody will vote for decline. Every single measure will sound generous, compassionate, reasonable. Your builders will slowly leave or stop building. Your state will grow every year and never shrink. Your debt will compound. And in thirty years, your kids will look at a chart like the one I just described and wonder when it all went wrong.
You still have something we lost. You have Elon Musk sending rockets to orbit and landing them on their tail. You have Palmer Luckey building the defense industry of the future. You have Jeff Bezos, Jensen Huang, and thousands of founders nobody has heard of yet, building in garages right now.
Trust your entrepreneurs. Don't trust your politicians.
I come from your future. Don't make it yours.
This is what I was dreaming for the "year 2000" when I was a child! Thanks @Tesla.



























