p2p full graph stack for Agentic systems, commerce and digital assets. 10,000x cheaper, 340x lower latency. https://xitter.cf/t.co/p9RVzPrqWy https://xitter.cf/t.co/BVeE4jkhkC
Distributed
Joined February 2020
- Tweets3.7K
- Following160
- Followers6.2K
- Likes2.8K
Pinned Tweet
A new chapter in proactive wellness begins.
FINAO SPV Inc.- a venture between FINAO and Rubix Blockchain-has collaborated with the YMCA to launch the P0 beta of the YMCA Wellness Café™ in the Pacific Northwest.
The platform encourages members to build healthier habits by rewarding consistent wellness activities with Y COIN, a utility token backed by Rubix tokens.
Powered by the Rubix Blockchain, the platform enables secure activity records, seamless rewards, data privacy and scalable transactions.
With the YMCA serving more than 60 million members across 120 countries, this initiative has the potential to take rewarding, proactive wellness to a global scale.
Read the full announcement:
lnkd.in/d8_q2zhJ
_Graph retweeted
API keys and registry credentials mostly compromised. Roll out new keys, but need access first. Account takeovers can be hard to reverse. Harden and airgap API keys and all credentials before its late. @ThinC_AUTH #AuthAMS @Ensurity
An urgent notice from the Railway team
blog.railway.com/p/security-…
_Graph retweeted
Railway is compromised, rotate all API keys as soon as possible
Deployments are down so don’t wait to redeploy
Attackers are draining keys in real time, we didn’t lose much but can confirm this is still an active attack
Stay safe friends
_Graph retweeted
This is alarming. Hackers could gain root access before patching is done and maintain persisent presence inside. Focus must be to comprehensively fix auth before that. @EnsurityTech @Agent_DNA
The window to patch software bugs is collapsing
Of the bugs hackers actually exploit, ~87% are now being attacked on or before the day the bug is public knowledge
That share was 23% in 2020
Charts of the Week: a16z.news/p/chart-of-the-wee…
_Graph retweeted
Number of companies impacted by @PingCAP incident is vast. Issue is again open creds on AWS. Need to harden and airgap creds.
pingcap数据泄露还是被暴露出来了(破折号 后是我的点评)：
在 57 个月的统计周期内，PingCAP 的 AWS 总支出高达 $107,195,238.42 美元（约 1.07 亿美元）——就是pingcap购买AWS云服务器等然后部署tidb后卖给第三方客户使用
仅 us-east-1 区域的跨可用区传输费用（cross-AZ transfer）一项就高达 $16,509,714.87 美元。——天杀的AWS 流量费用，不只是跨AZ、跨可用区也是收费的，而且很贵
EDP 折扣（企业折扣计划）：减免了 $10,362,705.51 美元——看起来pingcap 谈了一个很给力的折扣
涉及到的主要大客户，如图
总结：
这令人悲哀地成为了常态:他们会花数百万美元购买花哨的 EDR（终端检测与响应），却任由半千个 S3 存储桶大摇大摆地流失。但这家公司是一家云服务提供商。连对他们各个云服务（AWS、GCP、Atlassian / Jira、Azure）遭受的大规模、毫不掩饰的入侵和数据外泄都似乎毫无察觉，这简直是可怕且极度不负责任的
_Graph retweeted
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
_Graph retweeted
Has anyone scanned the internet for ECC public keys (and even RSA) and tried all private keys up to 256 to see if this is a more common phenomenon than imaginable?
@nadiaheninger ?
_Graph retweeted
It is 2026 and we are still seeing breaches due to credential theft and passwords, with wide blast surface. Two choices: harden/airgap creds. Or decentralize creds. Little time left to make this transition.
@EnsurityTech @ThinC_AUTH #AuthAMS @Agent_DNA
ConnectWise Suspends Cloud Services in Response to Cyberattack securityweek.com/connectwise…
_Graph retweeted
WE DIDN'T JUST RETHINK AUTHENTICATION. WE REDEFINED TRUST.
Identity is managed through @XSenseID . Credentials & assets are controlled through AUTHAMS, Authentication is strengthened through our @ThinC_AUTH FIDO2 Bio Keys.
#UnPhishYourself with Ensurity.
📷[email protected]
🤖 Made with AI
_Graph retweeted
Gavin Baker on the other side of Ben's bandwidth story: at the peak of the 2000 bubble, 97% of America's fiber sat dark, and today there are no dark GPUs.
"I had, depending on how you look at it, the privilege and the misfortune of being a tech investor during the year 2000 bubble, which was really a telecom bubble."
"The year 2000 bubble was defined by something called 'dark fiber.' Dark fiber was literally fiber that was laid down in the ground, and not lit up... At the peak of the bubble, 97% of the fiber that had been laid in America was dark."
"Contrast that with today. There are no dark GPUs. All you have to do is read any technical paper, and one of the biggest problems in a training run is that GPUs are melting."
@GavinSBaker
Ben Horowitz on the lesson LoudCloud, his early cloud company, taught him about today's AI neoclouds, and why they now face the opposite problem:
"It can end up being like a very dangerous arbitrage business, where you can get upside-down easily. And so if you look at LoudCloud, just as an example, here's a simple thing that happened to us."
"In 1999, bandwidth was $1,500 a megabit. And you couldn't get it. It was very hard to get it. And so you had to get a long-term contract, three years. By 2001, it was $50 a megabit... And if you borrowed money to get it, you're dead."
"That kind of thing is so out of the control of the entrepreneur."
"I think the core dynamic of AI has been working for CoreWeave, though, in that there's a massive shortage, not an overage of supply... Token prices have gone down, but GPU prices have not."
"And by the way, data center space is going up in price because even labor to build data centers is hard. The politics are making it hard to build data centers. So the whole supply chain price is going up and demand is not subsiding."
"Those are very big tailwinds for CoreWeave, despite the fact that the debt markets, kind of independent of them, are tough."
@bhorowitz w/ @chamath on @allinpod
_Graph retweeted
Hackers Jailbreak iPhone 18 Pro on Stage, and It Survives a Reboot
decrypt.co/381177/hackers-ja…
_Graph retweeted
JUST IN: Cybersecurity experts warn that AI agents are highly vulnerable to phishing emails containing hidden malicious instructions.
_Graph retweeted
We have not sorted security gaps in the pre agent era fully yet, and now with agents, its a fully different thing altogether. Build agenetic security architecture from first principles @Agent_DNA
_Graph retweeted
Don't hand your credentials and keys to AI models or model based security tools. Harden and air gap credentials/keys where possible now (for humans). Decentralize otherwise (for agents). There is little other option.
#AISecurity #cybersecurity #IAM
@EnsurityTech @Agent_DNA
_Graph retweeted
Lets quickly build better security systems for humans and agents while we can do
@EnsurityTech @Agent_DNA
Scoop: Top executives at Anthropic, OpenAI and other AI companies are privately gaming out scenarios for a public and political revolt after a catastrophic AI event…They assume one in ‘27…
axios.com/2026/10/09/ai-comp…
_Graph retweeted
I was wondering if maybe AI models were going to find some kind of hidden mathematical trap in the P-256 parameters. The opposite just happened!
anthropic.com/research/ecdsa…
_Graph retweeted
IPFS is entering its next chapter: more decentralized, more resilient, & stewarded by a growing community of independent teams supporting public infrastructure!💪
At the end of September the project celebrated a major milestone 🏁: 100% of in-browser public gateway traffic now uses direct, verifiable peer-to-peer retrieval — run by a sustainable, federated network of independent operators.🤝
Big thanks to:
🔎 IPNI / Compass — content discovery, routing, and browser-first retrieval
📊 ProbeLab — network health, measurement, and performance
🛡️ Skapa / BadBits — protecting the network from abuse
IPFS has always been about an internet that is more open, resilient, and user-controlled. Building on IPFS? Operating infrastructure? Come help shape what's next!
blog.ipfs.tech/2026-10-new-s…
_Graph retweeted
the nsa's "mystery" seed behind P-256 was just a 1997 clock time
the part people are missing: a timestamp only gives ~30 bits of wiggle room
the backdoor theory needed ~70
best case outcome. the most trusted curve on the internet stays trusted
CLAUDE FOUND THE SEEDS
anthropic.com/research/ecdsa…
_Graph retweeted
1 weak password. A country breached.
The Denmark CPR breach is a reminder that vulnerabilities can have disastrous consequences .
We help enterprises strengthen identity security through @XSenseID , @ThinC_AUTH FIDO2 Keys, & 𝗮𝘂𝘁𝗵 AMS.
#UnPhishYourself
📩[email protected]
