i talk about security i explain crypto. i talk about life also i'll block you if you don't have a cold wallet Telegram: Bala_ibb. Building @Astraeus_AI
knowledge is wealth
Joined October 2018
- Tweets1K
- Following1.3K
- Followers20K
- Likes173K
Pinned Tweet
they’re calling it “Black October” and i don’t think people realize how serious this is
in the last 48 hours there have been over 27 major cybersecurity incidents. not in a month. not in a week. in 48 hours
any ONE of these would normally be the biggest story of the year
PHP: critical vulnerability in the software running 80% of the web. severity 9.2 out of 10
Node.js: high-severity flaw letting attackers take over servers remotely. affects versions 22, 24, and 26
Java: also compromised. three of the most used programming languages on earth hit at the same time
GitLab: a perfect 10 out of 10 severity hole in every version since 2014
Railway: hosting platform compromised. API keys for OpenAI, Claude, Stripe potentially exposed
Signal: a bug that could leave your mic and camera on after you hang up
WordPress: hackers stole a plugin maker’s keys and planted backdoors on websites
LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
and that’s not even half the list
thousands of AI agent swarms are reportedly scanning and attacking vulnerable servers right now. automated. around the clock
security researchers are saying this might be the early stages of a global cyber incident that nobody fully understands yet
if you run a website, use cloud services, store API keys on hosting platforms, or use any software built on PHP, Node.js, or Java you are potentially affected
update everything. rotate your API keys. change your passwords on critical services. enable 2FA everywhere you haven’t already
this is not a normal week on the internet. this is something different
north korea is selecting 200 middle school students every year and training them to become state-sponsored hackers
not college students. middle schoolers
these kids are learning advanced mathematics, foreign languages, how crypto works, and how to reverse-engineer foreign technology before they're old enough to drive
the best ones get fast-tracked into military cyber units, and if your attack is successful enough you get rewarded with an apartment in pyongyang
this is a whole country running a pipeline from classroom to cyberattack, and crypto is literally part of the curriculum
north korea stole $6.34 billion from binance, $1.5 billion from bybit, and has been linked to some of the biggest crypto heists in history
now you know where those hackers came from
Bala 🧤 retweeted
every piece of software you trust right now has a vulnerability that nobody's found yet
not some of them. all of them
your wallet, your browser, your banking app, your password manager, the operating system running your phone right now
openssh runs almost every server on earth, somebody found out that typing 257 random characters as the password gives you full root access. just like that
microsoft paint, the app you drew stick figures on as a kid, just got a vulnerability that lets attackers run code on your computer through the internet. paint.
apple told everyone icloud was end-to-end encrypted, then buried in a support page that sharing a link kills the encryption completely even if you paid for advanced data protection
these are the most audited, funded, and trusted tools ever built and they keep falling apart in ways nobody predicted
code is written by humans who cut corners, increasingly generated by AI that doesn't understand what it's producing, and tested by systems that can only catch what someone thought to look for
"secure software" doesn't exist. there's just software running on borrowed time until someone finds the crack
hackers disguised their malware as symantec's own software to get past symantec's own antivirus
let that irony sink in for a second
they dressed up as the bodyguard to take out the bodyguard
they hit a US organization with 13 different tools designed to do one thing, kill the security software before the real attack even starts
two tools dressed up as the antivirus company itself, then they rebooted the system into safe mode where most security tools stop working, dropped signed drivers to shut off whatever was still running
the whole thing took about an hour. not days, not weeks, one hour to completely dismantle every layer of protection
your antivirus isn't a wall. it's a target
‼️ Ransomware hackers threw a new custom backdoor and at least 13 security-killing tools at one US organisation in about an hour.
Then they set AnyDesk to run in Safe Mode, where most security tools don't fully work.
Two of those tools were disguised as Symantec's own software.
Symantec says the attackers also dropped five signed but vulnerable drivers, to switch off security software.
a cybercriminal left his entire hacking toolkit on a public server with no password
exploit scripts, webshells, root access tools, stolen data spreadsheets, crypto fraud kits, a CVE exploit file, everything just sitting in an open directory for anyone to find
this man had a whole operation running and didn’t even put a login page on it
we spend all this time worrying about sophisticated hackers breaking through encryption and firewalls, meanwhile the guy trying to hack you can’t even secure his own server
your iphone keyboard has a secret list of words it refuses to let you type
not offensive words. political ones
"tibetan independence", "united ireland", "dictator trump", all blocked from autocomplete and swipe typing across 28 languages
apple didn't even store the list in plain text, they buried it inside a hash table hidden in the keyboard's language model files
a researcher had to brute-force 100,000 entries just to find out what your own keyboard was quietly censoring behind your back
you can still type them letter by letter, but the moment you swipe or use autocomplete apple decides that word doesn't exist
they told reuters it's about avoiding "offensive suggestions" but never explained why political phrases are sitting on the same list as slurs
your keyboard isn't predicting what you want to say. it's filtering what you're allowed to say
Apple didn't store a plaintext list of forbidden words in iOS. Instead, researchers discovered a compiled minimal perfect hash table of 32-bit fingerprints buried inside the keyboard's language-model files.
When you swipe-type or use autocomplete on an iPhone, the keyboard converts your input into token IDs and evaluates sequences of two to six words. It hashes those candidate n-grams using Bob Jenkins's public-domain hashword() function. If that 32-bit fingerprint matches an entry in the table, the predictive engine refuses to suggest it, or the swipe model actively diverts the word to an alternate match.
On November 6, researcher Derik Kauffman published Swipeblocked after exhaustively enumerating candidate word combinations against the table to reverse-engineer the hidden phrases. His conservative estimate is roughly 100,000 entries across 28 languages. In English, the prediction list holds 4,525 phrases and the swipe-typing list holds 2,794.
Most entries cover violence, slurs, and sexual content, but the table also silences geopolitical phrases like "Tibetan independence", "United Ireland", "dictator Trump", and Hebrew for "the occupied territories". In testing, swiping "United Ireland" consistently resolved to "United Iceland".
You can still type any phrase letter by letter. The suppression only touches autocomplete predictions and gesture paths. Apple told Reuters the system avoids offensive suggestions, but never addressed the political entries or the existence of the table.
Apple never published the list because it was never meant to be read. It took brute-forcing the hash table to show what the keyboard was quietly dropping.
every piece of software you trust right now has a vulnerability that nobody's found yet
not some of them. all of them
your wallet, your browser, your banking app, your password manager, the operating system running your phone right now
openssh runs almost every server on earth, somebody found out that typing 257 random characters as the password gives you full root access. just like that
microsoft paint, the app you drew stick figures on as a kid, just got a vulnerability that lets attackers run code on your computer through the internet. paint.
apple told everyone icloud was end-to-end encrypted, then buried in a support page that sharing a link kills the encryption completely even if you paid for advanced data protection
these are the most audited, funded, and trusted tools ever built and they keep falling apart in ways nobody predicted
code is written by humans who cut corners, increasingly generated by AI that doesn't understand what it's producing, and tested by systems that can only catch what someone thought to look for
"secure software" doesn't exist. there's just software running on borrowed time until someone finds the crack
Bala 🧤 retweeted
changing your gmail password after getting hacked is the first thing everyone does and it barely fixes anything
when someone gets into your gmail they don’t just read your emails, they set up systems that keep working after you lock them out
they set forwarding rules that send a copy of every email to their address, filters that auto-delete google’s own security warnings before you see them, IMAP access that lets them read your inbox from another app entirely
you change the password thinking you’re safe, meanwhile every email you receive is still being forwarded to someone else and you’d never know because the notification google shows you disappears after one week
here’s what you need to check right now
go to gmail settings, forwarding and POP/IMAP, if there’s a forwarding address you didn’t add, disable it
check filters and blocked addresses, if there’s a filter you didn’t create especially one that auto-deletes or auto-forwards, delete it
check your labels for anything unfamiliar, and turn off IMAP access if you’re not using it
if you’ve ever used “continue with google” to log into chatgpt, gemini, or anything else, those apps still have access too. a password change doesn’t revoke them
your password is the front door. hackers don’t come back through the front door, they leave windows open
apple just announced they can now see every photo and file you share through icloud links, even with end-to-end encryption turned on
starting december with iOS 27.3, anything you share from icloud photos or icloud drive using "anyone with the link" gets scanned by apple
the part they buried in their own support document is wild
apple says the item "is no longer end-to-end encrypted, even if the owner or participants have turned on advanced data protection"
you paid for the encryption. you turned it on. and the moment you share a link, apple turns it off
here's what to check right now:
open files app, go to browse, then shared
everything you've ever shared from icloud drive is listed there. photo dumps, tax documents, passport scans, all of it
then open photos, scroll to shared albums, check if "public website" is turned on for any of them
switch everything from "anyone with the link" to "only invited people." that's the only sharing option that stays encrypted
your icloud encryption works until you share. then it doesn't
android users;
someone reverse-engineered a hidden app called SystemHelper that comes pre-installed on android phones and it's basically spyware from the factory
it logs every app you use and for how long, records when you take screenshots down to the millisecond
it tracks your calls including which app you used and how long they lasted, monitors screen sharing, and uploads all of it as "telemetry"
the best part? you can't just uninstall it because it's tied to core system functions
the spy app IS the system
the fbi agent investigating crypto theft was stealing crypto using the same wallet credentials he got from the investigation
$2.47 million gone, not from a hack, not from a phishing link, from the person the government trusted to protect it
we tell people to trust the system. the system just pled guilty
updating your wordpress site is supposed to make it more secure, but the update itself is the vulnerability
when wordpress runs a full update it drops the installer in a public folder
if an attacker calls it before you finish, they become admin on your site. 240,000 attempts already blocked
the patch to fix your site is the window to steal it. pathetic
changing your gmail password after getting hacked is the first thing everyone does and it barely fixes anything
when someone gets into your gmail they don’t just read your emails, they set up systems that keep working after you lock them out
they set forwarding rules that send a copy of every email to their address, filters that auto-delete google’s own security warnings before you see them, IMAP access that lets them read your inbox from another app entirely
you change the password thinking you’re safe, meanwhile every email you receive is still being forwarded to someone else and you’d never know because the notification google shows you disappears after one week
here’s what you need to check right now
go to gmail settings, forwarding and POP/IMAP, if there’s a forwarding address you didn’t add, disable it
check filters and blocked addresses, if there’s a filter you didn’t create especially one that auto-deletes or auto-forwards, delete it
check your labels for anything unfamiliar, and turn off IMAP access if you’re not using it
if you’ve ever used “continue with google” to log into chatgpt, gemini, or anything else, those apps still have access too. a password change doesn’t revoke them
your password is the front door. hackers don’t come back through the front door, they leave windows open
iphone users
hackers built an entire working computer inside a gif image and used it to take over iphones without the owner touching anything
not a virus, not a link, a fake gif sent over imessage that exploited apple's image processing to construct a full software cpu with 70,000 operations running inside the image parser
registers, memory, logic gates, a whole machine built from math before the phone even buzzed with a notification
your iphone was running someone else's computer inside a picture and you'd never know
that's pegasus, and it's still the most sophisticated attack ever found on a consumer device
When researchers analyzed how Pegasus spyware infected iPhones without the user tapping anything, they found something wild. The attackers sent an iMessage with a fake GIF that targeted Apple's image decompression engine. The decompression math was so flexible that the exploit chained arithmetic operations together to construct a literal, functioning software CPU using over 70,000 segment commands that defined logical bit operations (AND, OR, XOR, XNOR, etc.) entirely inside the image parser. This created a small computer architecture with registers, a full 64-bit adder, and a comparator, running raw code before the phone even buzzed with a notification
a french pharmacy software that handles patient records is exposed on the open internet on every single device it’s installed on, and the password to access it is the name of the computer
not a random password, not even a default password, the hostname. 53 exposed systems already found on shodan across paris, lyon, marseille, and those are just the ones indexed
someone’s prescription history, medical records, everything a pharmacy knows about them, protected by a password you can literally read off the login screen
someone just typed a wall of random letters as a password on a linux server and got full admin access
that's not a meme, that's the actual exploit
on alpine linux if your password is between 257 and 1024 characters long it doesn't matter what you type, you're in. root access, full control, game over
openssh rushed out a fix within a day and the reason is wild, they said long embargoes don't work anymore because AI agents are rediscovering bugs on their own sometimes within hours
so they patched it and told everyone immediately
the door was literally too big to stay locked
it's startling how one anonymous guy with a cartoon pfp has exposed more crypto criminals than the fbi, interpol, and every blockchain analytics firm combined
zachxbt has exposed more crypto criminals than most agencies have even identified, malone, dritan nesaj, the chinese laundering networks moving north korean funds
he was mapping lazarus group operations before half the industry even knew the name
btw, no official badge, no surveillance budget, just on-chain analysis and a pile of receipts that somehow hold up better than actual investigations
the fbi showed up to confirm what zach already published, interpol followed trails he already mapped
billions in criminal activity exposed by someone the industry still can’t put a face to, and the agencies with real resources? they’re citing his threads as evidence
one anonymous guy with a blockchain explorer did more for crypto security than every three-letter agency combined