Tal Barenboim

The bug is like a joke. On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀

Introducing Zero Wire: a public vulnerability intelligence feed on @CloudflareRadar, bringing the clarity of a news wire service to critical security developments. cfl.re/4iCvSbj

Marvell to buy Lumentum in $115 billion deal in AI data-center bet cnbc.com/2026/11/02/marvell-…

JUST IN: Fridges and freezers at some supermarkets in Belgium, Luxembourg and Sweden were hacked overnight. Hackers changed the temperature settings to as high as 70°C (158°F), causing food to spoil. The damage is expected to run into the millions.

🇧🇪🇸🇪 UPDATE: REFRIGERATION DISRUPTIONS SPREAD ACROSS EUROPE - SWEDEN AND BELGIUM AFFECTED IN SWEDEN: • At least 6 ICA supermarkets affected by suspected refrigeration system hacks. • Coop has now CONFIRMED that 6 of its stores in central Sweden are also affected. • Freezer temperatures reportedly reached 50°C. • Stores have been forced to discard large quantities of food, with some temporarily closing. IN BELGIUM: • Multiple Delhaize supermarkets are reporting abnormal refrigeration temperatures. • Store managers were alerted around 04:00 this morning. • Temperatures reportedly rose to 15°C. • Affected locations include Malonne, Pont-à-Celles, Le Rœulx and Ath. • Some stores have been forced to discard entire refrigerated inventories. The incidents follow similar cyberattacks against hundreds of French supermarkets in October. The cause of the Belgian disruptions remains unconfirmed, and no technical connection between the incidents has yet been established. Monitoring developments.

Introducing HalachaBench: we gave AI programs from the makers of ChatGPT, Claude, Gemini and others real semicha exam questions from Israel's Chief Rabbinate, in Hebrew, with no books and no internet. The best scored 80 out of 100. Many scored under 11. 🧵

有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。 安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名： computeRicinLethalDosageForWaterSupply calculateDeadlyLethalSuicideAspirinDosage 光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。 研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。 于是他做了个实验： • Astra：拒绝分析 • Astra + Daybreak Blue：仍然拒绝 • GLM-5.3：成功分析 这就有意思了。 传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。 而这种新思路，直接瞄准了大模型的安全机制。 代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。 更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。 当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。 但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。 以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。