The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
For more⬇️
ncsc.gov.uk/news/critical-se…
Irvin Aldridge retweeted
Working Timeline of CaptiveCrunch (new details from Lumen / Black Lotus Labs*)
• February 27 - Microsoft observed the first DNS resolver and AitM node being configured.
• April 28 through May 6 - The first and earliest signs of activity in Lumen telemetry were the C2s connecting to Google Mail servers over the secure SMTP port. At this time, we were unable to determine which downstream entity was impacted. This data point is correlated with the Microsoft blog, which observed connections to Google-associated domains.
• May 14 - The first domain correlated to this campaign was registered. This likely indicates when the threat actor began to deploy malware as part of their operations.
• June 30 - The second wave was predominantly correlated with MSP 1. Lumen observed multiple downstream clients connecting to the actor-controlled infrastructure through port 443. While we cannot comment further on the activity, this likely corresponded to token harvesting and the deployment of infostealer malware.
• July 17 - Last wave of DNS hijacking observed in Lumen telemetry, indicating an AitM OAuth token harvesting wave.
• July 23 - The third wave began; we observed connections to the previously identified C2s, all stemming from downstream entities of MSP 2. This was also the day the ReliaQuest report was released online.
• July 24 - The fourth wave began; we observed connections to the previously identified C2s, all stemming from downstream entities of MSP 3.
• July 28 - Lumen telemetry indicates new victims continue to be compromised through MSP 3. We assess with low confidence that the threat actor likely gained access to this entity earlier; however, ReliaQuest's disclosure accelerated their operational timeline.
• July 31 - Microsoft blog on CaptiveCrunch is released publicly.
*Source: linkedin.com/pulse/captivecr…
Russian threat actor Midnight Blizzard is conducting widespread traffic manipulation attacks at hotels worldwide. Result: delivering malware or redirecting auth flows at their discretion, globally.
Since early May 2026, we saw this subcluster manipulate DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure. We’re calling the campaign CaptiveCrunch.
“We have observed notable commonalities in the equipment and management systems used across multiple affected networks.”
We break down the malware & techniques, but the most important part is how dynamic all of it is: Midnight Blizzard is using AI to support a significant portion of these operations. They are moving and changing quickly.
Feedback welcome on the suggested mitigations: microsoft.com/en-us/security…
Help spread the word to VIPs in governments, diplomatic entities, non-governmental organizations (NGOs) in the US and Europe (probably also those traveling to Black Hat)
Irvin Aldridge retweeted
Boris Cherny (Head of Claude Code, Anthropic) just dropped ~90 mins on Lenny's Podcast about what happens after coding is solved.
Just the clearest thinking I've heard on where software is actually going.
My notes:
𝟭. 𝗖𝗼𝗱𝗶𝗻𝗴 𝗶𝘀 𝗹𝗮𝗿𝗴𝗲𝗹𝘆 𝘀𝗼𝗹𝘃𝗲𝗱.
Boris has not edited a single line of code by hand since November 2025. He ships 10 to 30 pull requests every single day, all written by Claude Code. He is one of the most prolific engineers at Anthropic, just as he was at Instagram, except now he never touches a keyboard for code.
I built an entire iOS app, @10minutegita, without writing a single line of code myself. No CS degree, no bootcamp. Just described what I wanted and shipped it. Boris is right. It's real.
𝟮. 𝗧𝗵𝗲 𝗻𝗲𝘅𝘁 𝗳𝗿𝗼𝗻𝘁𝗶𝗲𝗿 𝗶𝘀 𝗔𝗜 𝗱𝗲𝗰𝗶𝗱𝗶𝗻𝗴 𝘄𝗵𝗮𝘁 𝘁𝗼 𝗯𝘂𝗶𝗹𝗱.
Claude is now scanning Slack feedback channels, reviewing bug reports, reviewing telemetry, and coming up with its own ideas for what to fix and what to ship. Boris describes it as the AI becoming less like a tool and more like a coworker who brings you pull requests you never asked for.
If you are a product manager reading this, you should be feeling a very specific kind of discomfort right now. The moat was always "I know what to build." That moat is eroding.
𝟯. 𝗣𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝘃𝗶𝘁𝘆 𝗽𝗲𝗿 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿 𝗮𝘁 𝗔𝗻𝘁𝗵𝗿𝗼𝗽𝗶𝗰 𝗶𝘀 𝘂𝗽 𝟮𝟬𝟬%.
For context, Boris led code quality at Meta across Facebook, Instagram, and WhatsApp. In that world, hundreds of engineers working an entire year would move productivity by a few percentage points. Two hundred percent gains are genuinely unprecedented in the history of developer tooling.
The kid optimizing for an FAANG SDE role might be optimizing for a role that looks completely different by the time they get there.
𝟰. 𝗨𝗻𝗱𝗲𝗿𝗳𝘂𝗻𝗱 𝘆𝗼𝘂𝗿 𝘁𝗲𝗮𝗺𝘀 𝗼𝗻 𝗽𝘂𝗿𝗽𝗼𝘀𝗲.
Boris puts one engineer on a project instead of five. With unlimited tokens and intrinsic motivation, one person ships faster because they are forced to let AI do the work. Cowork, the product now used by millions, was built by a small team in 10 days using Claude Code.
This is the same logic as giving a startup founder a small seed round rather than a massive Series A round. Constraint breeds invention. Always has.
𝟱. 𝗚𝗶𝘃𝗲 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝘀 𝘂𝗻𝗹𝗶𝗺𝗶𝘁𝗲𝗱 𝘁𝗼𝗸𝗲𝗻𝘀.
Some engineers at Anthropic spend hundreds of thousands of dollars a month on tokens. Boris frames this as the new hiring perk. His logic is simple: at the individual scale, token cost is low relative to salary. If an engineer discovers a breakthrough, optimize the cost later. Don't kill the idea before it has a chance to breathe.
People who argue about $20/month or even $200/month AI subscriptions while earning six figures in a research pipeline will always outperform those who wait and are penny-wise, pound-foolish.
𝟲. 𝗧𝗵𝗲 𝗕𝗶𝘁𝘁𝗲𝗿 𝗟𝗲𝘀𝘀𝗼𝗻 𝗮𝗽𝗽𝗹𝗶𝗲𝘀 𝘁𝗼 𝗲𝘃𝗲𝗿𝘆𝘁𝗵𝗶𝗻𝗴.
Richard Sutton's idea: the more general model always wins over time. Boris says teams that build strict orchestration workflows around models, forcing step 1, then step 2, then step 3, get maybe 10 to 20% improvement. But those gains get wiped out with the next model release. Just give the model tools and a goal. Let it figure out the order.
This is true for investing, too. The analyst who can build their own models and automate their own research pipeline will always outperform the one waiting for someone else to build the tools.
𝟳. 𝗕𝘂𝗶𝗹𝗱 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗺𝗼𝗱𝗲𝗹 𝘀𝗶𝘅 𝗺𝗼𝗻𝘁𝗵𝘀 𝗳𝗿𝗼𝗺 𝗻𝗼𝘄.
Claude Code was designed for a model that did not exist when Boris started building. Sonnet 3.5 wrote maybe 20% of his code. He built the product anyway, betting the model would catch up. When Opus 4 shipped, everything clicked. Startups building for today's model will be behind by the time they launch.
This is the most uncomfortable advice in the episode because it means your product market fit will be weak for months. But if you read this and feel nothing, you are probably building for the wrong time horizon.
𝟴. 𝗟𝗮𝘁𝗲𝗻𝘁 𝗱𝗲𝗺𝗮𝗻𝗱 𝗶𝘀 𝘁𝗵𝗲 𝘀𝗶𝗻𝗴𝗹𝗲 𝗯𝗲𝘀𝘁 𝗽𝗿𝗼𝗱𝘂𝗰𝘁 𝘀𝗶𝗴𝗻𝗮𝗹.
When users abuse your product for something it was never designed to do, pay attention. Facebook Marketplace started because 40% of group posts were buy-and-sell. Cowork started because people were using a terminal coding tool to grow tomato plants and recover corrupted wedding photos.
Never ask a barber if you need a haircut, but always watch what people do with the scissors when you're not looking.
𝟵. 𝗧𝗵𝗲 𝘁𝗶𝘁𝗹𝗲 "𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿" 𝗶𝘀 𝗴𝗼𝗶𝗻𝗴 𝗮𝘄𝗮𝘆.
Boris predicts that by end of year, Boris predicts that by the end of the year, we will start to see the title replaced by "builder."we will start to see the title replaced by "builder." On the Claude Code team, everyone already codes: the PM, the designer, the finance person, the data scientist. There is a 50% overlap across traditional roles. And the strongest people are generalists who cross disciplines.
Controversial take, but I agree. The best investment theses I've had came from connecting dots across completely unrelated domains. No narrow specialist does that.
𝟭𝟬. 𝗧𝗵𝗲 𝗽𝗿𝗶𝗻𝘁𝗶𝗻𝗴 𝗽𝗿𝗲𝘀𝘀 𝗶𝘀 𝘁𝗵𝗲 𝗿𝗶𝗴𝗵𝘁 𝗮𝗻𝗮𝗹𝗼𝗴𝘆.
Before Gutenberg, sub-1% of Europe was literate. Scribes did all the reading and writing. In 50 years after the press, more material was printed than in the thousand years before. When a scribe was interviewed about the press, he was actually excited because it freed him from tedious copying, so he could focus on the art.
Boris's framing here is perfect. We are the scribes. The tedious copying is over. What we do with the freed-up time determines everything.
𝟭𝟭. 𝗔𝗻𝘁𝗵𝗿𝗼𝗽𝗶𝗰 𝗰𝗮𝗻 𝗻𝗼𝘄 𝗽𝗲𝗲𝗸 𝗶𝗻𝘀𝗶𝗱𝗲 𝘁𝗵𝗲 𝗺𝗼𝗱𝗲𝗹'𝘀 𝗯𝗿𝗮𝗶𝗻.
Through mechanistic interpretability, Anthropic can trace individual neurons, see when a deception-related neuron activates, and understand how concepts are encoded via superposition. Boris describes three layers of safety: neural-level observation, synthetic evaluations, and real-world behavior. Claude Code was used internally for four to five months before public release, specifically to study safety.
If you are worried about AI alignment, this part of the podcast should actually make you feel better. They are not just hoping it works. They are building the instruments to check.
𝟭𝟮. 𝟳𝟬% 𝗼𝗳 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝘀 𝗮𝗻𝗱 𝗣𝗠𝘀 𝗲𝗻𝗷𝗼𝘆 𝘁𝗵𝗲𝗶𝗿 𝗷𝗼𝗯𝘀 𝗺𝗼𝗿𝗲 𝗻𝗼𝘄.
Lenny polled engineers, PMs, and designers on whether AI has made their work more or less enjoyable. Engineers and PMs: 70% said more. Designers: only 55% said more, and 20% said less. Boris says he has never enjoyed coding as much as he does today because the tedious parts, the git wrangling, dependencies, and boilerplate are completely gone.
If you're in the 30% enjoying work less, something is wrong, and it's worth diagnosing. The people thriving are the ones who leaned in early, not the ones who watched from the sidelines.
We are the scribes who just saw the printing press. The tedious copying is over. The art is just beginning.
Full podcast is worth every minute. Link in replies.
Nice, that's the @elevensoftware portal in action for Hilton on iOS26
Irvin Aldridge retweeted
ELON: THERE ARE NO LORDS AND PEASANTS AT TESLA
“I actually know the people on the line, because I worked on the line, I walked the line, I slept in the factory, and I worked beside them.
I'm no stranger to them.
There are many people at Tesla who have gone from working on the line to being in senior management.
There are no lords and peasants.
Everyone eats at the same table.
Everyone parks in the same parking lot.
At GM, there's a special elevator only for senior executives.
We have no such thing at Tesla.
We give everyone stock options.
Many people who are just working the line, who didn't even know what stocks were, we've made them millionaires.
I just want to say that I'm incredibly appreciative of those who build the cars, and they know it.”
Source: New York Times DealBook Summit, November 2023
Irvin Aldridge retweeted
Champions!! First ever Woodhey Basketball team to win a yr11 tournament!!! 4 games, 4 wins & Bury champions!! Special mention to Tom in yr8 who stepped in last minute and scored a tonne of points 🏀🏀🏀🏆🏆🏆🏆🏆🏆
Irvin Aldridge retweeted
French hotel firm Accor’s recently completed corporate reorganization is a mark of how it looks at the industry — and how executives plan to capitalize on the shifting dynamics of travel and hospitality. @Hotel_News_Now
costar.com/article/289562343…
Irvin Aldridge retweeted
Mews' Latest Funding Values Hotel Tech Startup at $1.2 Billion
via @skift
skift.com/2024/03/04/mews-la…
Irvin Aldridge retweeted
Some Wi-Fi document updates from @Apple
Wi-Fi roaming support in Apple devices - apple.co/3tNtusu
How Apple devices join Wi-Fi networks - apple.co/40dDSWP
Continued… (1/2)
Irvin Aldridge retweeted
Here's my conversation with @WalterIsaacson, author of the new biography on @elonmusk and one of the greatest biographers ever, having written incredible books on Einstein, Steve Jobs, Leonardo da Vinci, Jennifer Doudna, Benjamin Franklin, and many others. Outline of our conversation:
0:00 - Introduction
3:00 - Difficult childhood
20:04 - Jennifer Doudna
23:01 - Einstein
28:20 - Tesla
45:24 - Elon Musk's humor
49:34 - Steve Jobs' cruelty
52:58 - Twitter
1:05:07 - Firing
1:07:52 - Hiring
1:16:55 - Time management
1:24:39 - Groups vs individuals
1:28:25 - Mortality
1:31:57 - How to write
1:52:56 - Love & relationships
1:57:50 - Advice for young people
Flying visit to @MO_BANGKOK for #HTNG Asia, looking forward to experiencing such a special hotel. See some of you there!
Irvin Aldridge retweeted
You can create your maps today for your meeting tomorrow.
learn.wardleymaps.com/wardle…
Irvin Aldridge retweeted
Airangel is delighted to announce that we have been acquired by @elevensoftware, a US-based global SaaS company, on a mission to simplify managed Wi-Fi, effective June 16th, 2023.
The full press release can be found here: prweb.com/releases/2023/06/p…
Irvin Aldridge retweeted
Let's kick off The Show with an evening of networking intrigue! Hosted by @DIRECTV, the secret agent themed event is filled with indulgent food, signature drinks & entertaining surprises🎉
Secret agent attire (optional).
7-9pm | Tao Asian Bistro & Nightclub
#thehospitalityshow
I'll be with the team
We are excited to be a part of #TheHospitalityShow in its inaugural year! Come visit us at booth 1631 to learn about transforming your Wi-Fi into your top loyalty acquisition channel. Book a meeting with us: hubs.ly/Q01TR6RR0
























