Adorador de grep. Crossfitter. "hackeo cosas"
Madrid, España
Joined November 2009
- Tweets16.9K
- Following1.8K
- Followers2.2K
- Likes2.5K
☠ Dani Martinez ☠ retweeted
Este señor lo explica muy bien, y tiene la habilidad de no entrar en tecnicismos para que se entienda.
Y para que (supongo que por experiencia) ningún gilipollas pueda venir a desacreditarlo por cualquier detalle menor de mierda.
☠ Dani Martinez ☠ retweeted
Got @Muse running on the PSP that's been sitting in our house for over 15 years @alexandr_wang
Had my agent port the gadget client to C so it runs natively on the PSP. Hold R, talk into the built-in mic. Muse answers, and OpenAI gives it a voice
☠ Dani Martinez ☠ retweeted
If you're building on Muse, save this
8 GitHub repos for building gadgets, running your own agent, connecting apps and extending Muse Code
1. Muse Gadget SDK
Meta's SDK for building hardware that works with Muse
github.com/facebookincubator…
2. OpenMuse
An open-source personal agent with browser, files and optional Linux workspace
github.com/CopilotKit/OpenMu…
3. Open Muse
A local-first agent with memory, plans, approvals and an audit trail
github.com/aeiouvcode/open-m…
4. Awesome Muse Connectors
150+ community connectors and skills for Muse
github.com/Anil-matcha/aweso…
5. Awesome Muse Code
A collection of skills, plugins and tools for Muse Code
github.com/metacpp/awesome-m…
6. Muse-acp
Run Muse Code inside Zed and JetBrains
github.com/BrokkAi/muse-acp
7. Helicon
A desktop and web interface for the Muse Code CLI
github.com/HarjjotSinghh/hel…
8. Muse Code Bridge
A local MCP plugin for Muse Code sessions, approvals and usage tracking
github.com/stts0919/Muse-Cod…
Save this before building a Muse integration from scratch
☠ Dani Martinez ☠ retweeted
🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis.
🔸 Mettez immédiatement pip à la version 26.2.2 ou plus.
🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip
🔸 uv : uv self update (0.13.4 ou plus)
🔸 Mettez aussi à jour les certificats du système (apt / dnf upgrade ca-certificates) et vos images Docker
pip install est compromis.
L'autorité indienne eMudhra (emSign), qui signe les « passeports » prouvant qu'un site est bien celui qu'il prétend être, utilisait des clés secrètes ridiculement faibles : 8 clés, toutes inférieures à 256. L'une valait 4. Autrement dit, n'importe qui peut fabriquer un faux passeport valide pour n'importe quel site.
Le risque pour Python : quelqu'un sur ton réseau (wifi public, FAI, État) se fait passer pour pypi.org, et ton « pip install » télécharge un paquet piégé sans aucune alerte. Aucune attaque n'a été signalée pour l'instant, mais c'est trivial à faire.
Un paquet piégé peut installer n'importe quoi. Porte dérobée, virus, vol d'informations en tout genre.
La situation est terrifiante !
Rien que dans l'écosystème Python, chaque installation de CPython, chaque venv, uv, tout est exposé.
Et je ne vous parle même pas de npm, pnpm, yarn, Go, Rust.
Ma stratégie de sécurité 2026 : rester chez moi et ne me connecter à Internet que depuis un FAI de confiance.
C'est quand il y a de la mer qu'on reconnaît les vrais marins...
Readers added context they thought people might want to know
Ce n'est pas un bug Python mais une vulnérabilité des clés privées faibles des certificats intermédiaires eMudhra/emSign (d<256 dont une valant 4), exposant les bundles certifi/pip à des MITM TLS potentiels jusqu'aux mises à jour.
discuss.python.org/t/information-…
emudhra.we-have-a-problem.com
scotthelme.co.uk/eight-bits-of-…
github.com/advisories/GHS…
☠ Dani Martinez ☠ retweeted
Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619).
Pure logic bug — no memory corruption,
ASAN-clean, orthogonal to the CVE-2026-109618/19 class.
Receipt: uid=33(www-data) over HTTP, one-shot
#infosec #php2shell #php
Readers added context they thought people might want to know
The claimed RCE on fully-patched PHP 8.5.12 requires a custom lab app with a destructor gadget plus deliberate session.serialize_handler mismatch (php_serialize writes, legacy php reads) and non-default settings like cleanup=Off; this is an app flaw, not core PHP RCE.
github.com/rafalohaki/php…
php.net/manual/en/sess…
☠ Dani Martinez ☠ retweeted
Zero Day Initiative ha enviado, por error, 6 vulnerabilidades (alguna grave, con explicación y PoC) a la lista pública del Kernel, no a la privada.
De hecho, en los propios correos pone que es confidencial. Greg Kroah-Hartman, responde un poquito harto ya. Revisad los procesos.
☠ Dani Martinez ☠ retweeted
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
eliastaylor.com/noexploit/
☠ Dani Martinez ☠ retweeted
Global TLS Intermediate CA incident: We’ve updated our incident page with how it happened, who is affected (one US customer ecosystem), what’s not affected, and what we’re putting in place. We will publish the root cause once our investigation is complete.
👉emudhra.com/en/post/certific…
Readers added context they thought people might want to know
eMudhra minimizes the scope by claiming only "one US customer ecosystem" is affected. In reality, 8 of its CA certificates had catastrophically weak private keys (one being simply the number 4), allowing anyone to forge trusted HTTPS certificates for any website on the internet.blog.google/security/prote…
☠ Dani Martinez ☠ retweeted
Acabo de correr un análisis rápido sobre 2.137 dominios de las administraciones públicas españolas.
De ellos, 579 corren PHP. 124 devuelven la versión que usan. 96 son vulnerables a fecha de hoy. Parte de los 455 que no devuelven la versión pueden serlo también.
☠ Dani Martinez ☠ retweeted
Meet Flint from @Recursive_SI! A ~40B parameter MoE open model for fast, accurate agentic coding use case made to run on-device.
Flint can generate >125 tps on a M4 Pro Macbook Pro and >150 tps on a 64GB NVIDIA RTX Spark on short contexts.
Try it on Ollama today:
ollama run flint
Claude Code:
ollama launch claude --model flint
Introducing Flint, @Recursive_SI’s first model: a fast local coding model built with our automated research system, the Eureka Machine.
• Best-in-class fast local coding
• Up to 2x faster than comparable models: 125+ tokens/sec on a MacBook Pro, 150+ on RTX Spark
• Built from scratch in under 4 months
Private, unmetered intelligence on your own machine. Open weights available now on @huggingface, run it locally on your favorite framework or try it for free on @opencode or @pidotdev.
☠ Dani Martinez ☠ retweeted
🥳 Ornith-1.5-122B Unsloth GGUFs are now available!
🧡 Thanks for the awesome work by @UnslothAI
🔗 huggingface.co/unsloth/Ornit…
Aloha!🌺 Meet Ornith-1.5-122B: No Tradeoff Between Strong and Fast
Stronger. Faster. Leaner. Ornith-1.5-122B delivers frontier-level capabilities with exceptional inference efficiency. With superior instruction following, stronger task decomposition, and deeper understanding of real-world workflows, it achieves state-of-the-art performance among open-source models of comparable size, while running on a single NVIDIA DGX card!!
Open weights under the MIT license.
Coding
✅SWE-bench Verified: 0.845
✅TB2.1: 0.813
✅CyberGym: 0.800
✅NL2Repo: 0.512
Agentic
✅HLE: 0.446
✅BrowseComp: 0.785
✅MCP-Atlas: 0.746
✅Toolathlon: 0.708
🤗Hugging Face: huggingface.co/ornith-ai/Orn…
We can’t wait to see what you build with Ornith-1.5-122B.
☠ Dani Martinez ☠ retweeted
🚨 Emergency release: OrcaCyber Nano 1.0 is now open-weight.
Part of our OrcaCyber model series: Nano, Zero, Ultra.
Based on our early evals, Nano is the most capable local model in its under-16GB class. 27B parameters. 262K context. Vision. Fully offline.
Early benchmarks:
AIME 2025: 96.23%
MATH-500: 98.60%
GSM8K: 97.50%
MBPP+: 84.66%
IFEval: 82.81%
Built for AI defense, vulnerability research, code security, and incident response.
We're shipping early because defenders can't wait. Cyber-specific evals coming next.
huggingface.co/orcarouter/Or…
☠ Dani Martinez ☠ retweeted
‼️ UPDATE: A researcher says the Broadcom Wi-Fi router bug affects way more countries.
The vulnerable code is also in ZTE's F680 v4, which ISPs from Spain to Vietnam, Egypt and Moldova offer.
Three Movistar Spain routers appear affected. Broadcom still won't assign a CVE.
☠ Dani Martinez ☠ retweeted
The lesson is simple: Don’t download models from random publishers in production.
Use trusted publishers, verify provenance, pin hashes, and treat model weights as part of your software supply chain. Model security starts before inference.
How abliterated models can get you pwned 👾
We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts.
Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.