Cybersecurity; Database, Network & Systems Administration
Nairobi, Kenya
Joined November 2024
- Tweets888
- Following320
- Followers72
- Likes1.7K
Michael Bullut retweeted
I think Cybersecurity+AI knowledge is going to be the deadliest combination in the coming years
Michael Bullut retweeted
🚨 THE INTERNET BROKE TODAY 🚨
Oct 21, 2026 will go down in history
1. eMudhra : Private key was literally "4". 8 keys forged ANY website for 17 months. 60M+ certs at risk.
2. SBI CONFIRMED. 3,897 customers' mobile, DOB, address + loan data found on dark web.
3. Rajasthan Police 🇮🇳ALLEGED hack. Group claims 70,000 identity records + 59,460 numbers for sale. Unverified.
4. php2shell [9.2] Unauth RCE in PHP. 70% of the web. WordPress, Drupal, Laravel. CISA: Patch or GO OFFLINE.
5. GitLab [10.0/10] PERFECT SCORE. Unauth RCE, no login needed.
6. Node.js [CVE-2026-111497] Brotli decoder RCE + TLS bypass. 10 CVEs patched today. Also blocked eMudhra.
7. Railway BREACHED TODAY. Env variables decrypted. Your API keys & DB passwords exposed. Rotate all.
8. OpenCode BREACHED. OpenAI, Anthropic, Google API keys exposed for Console users. Distillation attack. Bills run up in $$$$.
9. LiteLLM PyPI v1.107.0 was MALWARE today morning. Steals credentials + backdoor.
10. Plex2Shell ACTIVELY EXPLOITED. Hackers installing cryptominers LIVE. CISA KEV, deadline Oct 23.
AI found the bugs. AI is exploiting them. Humans can't patch fast enough.
Patch. Rotate. Revoke. Update.
RT to save someone's server ♻️
#CyberSecurity #DataBreach #India #php2shell
Michael Bullut retweeted
‼️ BREAKING: The private keys of 8 certificates from Indian certificate authority eMudhra were compromised, Mozilla says. Firefox blocked them within 3 hours.
Each key should be a 116-digit number, but one was just 4.
Anyone can guess them and forge HTTPS certs for any website.
Michael Bullut retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Michael Bullut retweeted
Cybersquatting:
A person who intentionally takes or makes use of a name, business name, trademark, domain name, or
other word or phrase registered, owned or in use by another person on the internet or any other computer
network, without authority or right, commits an offence
Michael Bullut retweeted
As Kenya confirms its first case of Ebola, it’s important to point out that it can be contained without spreading locally. As a former health correspondent, I covered Ebola in Liberia, Sierra Leone, Mali, Uganda and in the DRC. Kenya has several things to its advantage:
Michael Bullut retweeted
You deserve self-care, yes. And every small act of it, administered to yourself, is a step toward healing.
The best of today, is yours💯
Good morning 🙏
The A.I. boom is not simply a story of capital flowing into technology. It is increasingly a circular financing model—a flywheel in which capital, infrastructure, intelligence, applications, revenue and investor confidence continuously reinforce one another.
Capital flows into GPUs, data centres, cloud infrastructure, semiconductors, energy and A.I. companies. That infrastructure enables increasingly capable models; better models create new applications and enterprise use cases; those applications generate revenue and cash flows; and stronger economics create the confidence and capital required to fund the next wave of investment.
This is why the A.I. ecosystem needs to be viewed as an interconnected value chain rather than a collection of isolated companies. NVIDIA, TSMC, AWS, Microsoft, OpenAI, Anthropic, Meta, Palantir, Salesforce and many others occupy different positions within the same expanding economic system.
But every flywheel has friction. Overbuilding, weak monetization, energy and chip constraints, regulatory and geopolitical risks, excessive leverage and stretched valuations can slow the cycle—or interrupt it altogether.
The central question for investors is therefore not simply “Who wins A.I.?” It is: Where does value accumulate as capital repeatedly circulates through the A.I. ecosystem?
#AI #ArtificialIntelligence #AIInvesting #TechInvesting #VentureCapital #Semiconductors #CloudComputing #GenerativeAI #CapitalMarkets #Technology
🤖 Made with AI
1
1
85
Michael Bullut retweeted
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.
Michael Bullut retweeted
"Mathematics is the language in which God has written the universe."
-- Galileo Galilei (1564 - 1642)
Michael Bullut retweeted
WordPress 7.0.3 is available now. This security release fixes 12 vulnerabilities, including a cross-site scripting issue on the login screen. Update your sites as soon as you can, or let automatic background updates handle it. wp.me/pZhYe-5xZ
Michael Bullut retweeted
Last night Apple briefly removed Telegram from the AppStore because a user had planted illegal porn in a public chat.
Telegram was restored within hours. But I want to explain what happened — to warn other app developers and help protect online communities from similar attacks.
Because Telegram quickly removes illegal content from public groups using all kinds of moderation tools, the attacker had to resort to a technical trick. He inserted AI-modified illegal content by editing an old message in an active group chat. As a result the content was effectively hidden from the group’s members, preventing them from seeing/reporting it.
The attacker was a takedown extortionist: someone who demands ransom from group owners in exchange for not targeting their communities. These extortionists use automated accounts to plant illegal content in public groups and then report it directly to Apple, attempting to trigger the removal of legitimate communities whose owners refused to pay them.
From a practical standpoint, illegal pornographic content in Telegram’s public groups is not a systemic problem. Our moderation is effective. The fact that attackers must resort to backdated, effectively invisible content and other technical tricks proves this.
⚠️ However, there are two important lessons here for app developers and online communities:
— Extortionists have found a way to manipulate Apple into overreacting. Apple removed Telegram from the App Store before contacting us. This creates a potential systemic risk for every mobile app that hosts user-generated content. If an app used by more than a billion people can be removed from the App Store without prior warning, any app can be.
— The tactics used by takedown extortionists are evolving, putting communities across social platforms at risk. Telegram has extensive experience identifying the tricks used by coordinated reporting gangs and protecting legitimate communities (even when doing so risks our own app being temporarily removed from the App Store). Other platforms may not be equally prepared.
Stay vigilant! ☝️
Michael Bullut retweeted
Let me beat you a story.
The Odious Debts Petition has caused a lot of tension across the government.
So, the killer regime came up with strategies to suppress it.
Strategy 1:
The Attorney General drafted some useless booklets, presented them in court saying that they are already doing debt auditing and the Petition should not be allowed to proceed.
Strategy 2:
William Ruto ran to form a Presidential Public Debts Auditing team.
Strategy 3:
The Attorney-General made an application asking the High Court to suspend the petition on basis of a planned appeal to the Court of Appeal.
The Odious Debts Petitioners have encountered all these three strategies and have won.
1. The petitioners filed a Petition Challenging the Presidential Public Debts Auditing team and today,the High Court has ruled the team unconstitutional stating that the work of auditing lies within the office of the Auditor General.
2. On the 25th of June 2026, the Court rejected attempts by the Attorney General and other respondents to have the case dismissed.
3. Yesterday the Petitioners opposed Strategy 3 on the grounds that the High Court cannot supervise how the CoA, [a superior court under Article 162(1) of the Constitution], exercises its jurisdiction. The court ruled that the Petition proceeds to full hearing on the 23rd of October 2026.
Kenyans must not let the issue of Odious Debts to slide.
Kenyans must be informed about this politically engineered crisis.
This is economic terrorism and we must fight it with everything possible.
Na saa hii inataka hadi Maandamano!
#DeniBandia #OdiousDebts