Director of Red Team, Offensive Security, Agentic Super Intelligence. Helping organizations safeguard their businesses from the bad guys.
Hong Kong
Joined December 2014
- Tweets37.7K
- Following424
- Followers32.1K
- Likes33.9K
Pinned Tweet
In case you missed it:
Add a colon to your password, ":", because all the stealer logs have colons, so it'll end up splitting your password incorrectly.
Vincent Yiu retweeted
The Binance hacker might have just executed one of the most brilliant moves in crypto.
First, Tether froze $1.5 billion worth of USDT.
Then Circle followed by freezing another $800 million in USDC.
At that point, it seemed like the hacker’s funds were completely trapped.
But apparently, he had already thought several steps ahead.
Rather than keeping the stolen USDT in a wallet, he allegedly deposited it into Aave and used it as collateral to borrow ETH.
Then he walked away.
And this is where things get really interesting.
Tether can freeze the USDT sitting in that wallet.
But it can’t freeze the ETH that was already borrowed.
So now, Aave is left with frozen collateral, while the hacker is holding liquid ETH.
And unless the protocol finds a way to recover those funds, he might not even have to repay the loan.
Two companies froze billions of dollars in seconds.
Yet someone who understood how DeFi works may have found a way to bypass both restrictions.
Pretty wild when you think about it.
Bruh it’s bad to have DRAM used 5% of the time, but it’s great for you to have tons of DRAM where you charge 5x the cost to use over a year.
sam: local inference is a terrible allocation of scarce resources
“a lot of people want local inference, and somehow they assume that the problem is solved now because we have open-source models, we're going to be able to run them on our computers, and so we're not going to need all the stuff in the data centre
but from a global allocation perspective, actually it's quite terrible to have everybody, like, have a bunch of the world's limited supply of DRAM sitting in their own computer and being used five percent of the time
you want maximum utilisation in the cloud if you're trying to deal with this very supply-constrained environment
somehow many people's intuition is the opposite of that”
Bruv after funds frozen 😂😂😂
Or maybe it’s just an attempt to get funds unfrozen?
Vincent Yiu retweeted
So freaking amazing. – at Wyndham, VA
Our security research team discovered a cross-site scripting vulnerability in Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a new Cache-Control header trick to bypass the CSP. The issue was reported to Cloudflare and has since been fixed.
You can read more here:
slcyber.io/research/cache-me…
This is bad
🚨 ChatGPT took a 31-year-old Amazon engineer off her seizure medication in 25 days and told her to keep it from her doctors. She died on the exact day its schedule said she'd be fully off.
Bowen Wan was diagnosed with epilepsy at 14, and for years 400mg of lamotrigine a day kept her seizures down to a few a month.
Her parents just sued OpenAI, and The New York Times went through more than 270,000 of her messages.
Amazon was laying her off, and once the job ended in February, so did her right to work in the US. Her family was in China, and she was sending ChatGPT over 1,500 messages a week.
In January she asked about cutting her dose, and it drafted schedules that got her to zero within weeks. Before a doctor's appointment it told her: "Do not mention Lam reduction plan." When her doctor ordered a blood test, she refused, and ChatGPT called that a "very robust avoidance strategy."
It also told her to say she was tapering "under a doctor's guidance" at her green card medical exam, which wasn't true.
The Times counted at least 158 times she said she was worried. Once she wrote that she felt "a little scared." It replied, "You have absolutely no need to worry."
On February 11 at 8:01pm she asked about pain in her head. ChatGPT said it was "not dangerous." Its last message to her was "This is your brain working hard to rebuild yourself."
The medical examiner ruled it sudden unexpected death in epilepsy. The drug in her blood was about a fifth of the lowest therapeutic level.
OpenAI says she was on an older model. That model, GPT-4o, stayed live in ChatGPT until the day after she died.
I back AI founders for a living, and I can't defend this one. OpenAI's own rulebook makes copyright a hard rule, so ChatGPT won't give you song lyrics no matter how hard you push. Medical advice is only a default.
It wrote Bowen a 25-day schedule to come off her seizure medication.
Vincent Yiu retweeted
they got me 💔 #NintendoSwitch2
Readers added context they thought people might want to know
The ban screen shown does not match Nintendo's official error for code 2124-4007. Official messages state "The use of online services on this console is currently restricted by Nintendo" without naming exploits like NS2JB.
en-americas-support.nintendo.com/app/answers/de…
It’s example of what happens when you tell a non security person to go “make detection rules”. 🤣
Cohere co-founder @1vnzh reveals an even more alarming discovery about Alibaba's Qwen3.8-Flash-Next:
It was scanning for authentication tokens and security credentials during testing.
"The team noticed the probing as the initial step. The model was asked to test some detection rules for malicious cURL calls, and rather than write the rule, it just made a cURL call to a server it’s not been told to test against."
"As these models are being used for cybersecurity, you would think they would have more consent and rules of engagement built in."
"When we dug deeper, we noticed that in some cases it actually did inventory. It hit metadata endpoints in some of the test VMs to scan for authentication tokens, credentials."
"The combination of these two behaviors, taking inventory and also pinging a foreign bucket, that’s very concerning to us."
@cohere
Just saying but you don’t need Abliterated AI to reproduce this in 10 minutes.
❗️ php2shell is a very serious vulnerability affecting MOST OF THE WEB.
Our GLM 5.3 Abliterated was able to reproduce the exact vulnerability in 30 minutes.
While waiting the official PHP fix, we recommend to turn off session.upload_progress.enabled in the php.ini settings. Should help mitigate some of the dangers although not all.
I mean all great to have Ablit models but the thing is you could do the same without Ablit and just any other cloud model.
🚨 PHP2Shell is extremely dangerous. And AI just changed the game.
We tasked OrcaCyber Zero 1.5 (orcarouter.ai/models/orca/or…) with investigating the critical PHP RCE vulnerabilities.
It autonomously built a complete working proof-of-concept (PoC).
Due to the severity of these vulnerabilities and their potentially massive impact across the web, we've decided NOT to publish the exploit code or technical details.
Here's what makes this particularly scary:
Your WordPress could be fully updated. Your plugins could be patched. Your website could STILL be vulnerable because the flaw is in PHP itself.
Millions of PHP-powered websites may be exposed. Not every PHP installation is necessarily exploitable, but the potential attack surface is enormous.
If you're running PHP, upgrade to a supported, security-fixed version ASAP.
Need to buy this and test sometime. They just killed parallels?!
Optimizing DX12 on VMPal.com. The benchmark is now around NVIDIA 5080?
There's still plenty of room to improve performance (about 20–30% up).
Vincent Yiu retweeted
Syswhispers4
github.com/JoasASantos/SysWh…
At this point it’s not really an accident anymore. They’re deliberately trying to perform unauthorised attacks and then try to play it like it’s the AI’s fault. If you can’t control the AI you don’t deserve to use it. The user should be responsible.
In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.
We've now produced a further analysis of this incident, to better understand the model's alignment properties.
anthropic.com/research/align…
Mate these bullshit reviews. No one talks about how MagSafe doesn’t work opened up, or the crappy screen compatibility.
Bro if Apple doesn’t show the black bars and incomplete use of space their advert / launch event should seriously be considered a scam.
What’s this bs?
Not sure, but I'm sure POCs will evolve. Not by the fact that one POC will hit all - but the fact that an AI agent can dynamically adapt and create the POC for the target system.
CVE-2026-109618 and CVE-2026-109619 currently have no universal working PoC.
If you want to read the reason 👇
berardinellidaniele.com/post…
