yemin ederim ilk bakışta şaka sandım
New bug in OpenSSH.
Security researchers: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Anyone with a SSH server accepting password on alpine/etc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Details: sshhole.com
Access control is everything
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
0x496 retweeted
想象一下你的架构是 nginx 反向代理,后面挂着 PHP 8.1 主站、Node.js 24.x Brotli 网关、Go 微服务、Rust TLS 校验层、Python + LiteLLM 1.107.0 AI 中台,全部跑在 Linux 内核 c6e50df8 之前,HTTPS 证书由 eMudhra 签发并通过 emSign 交叉认证,根证书库用 Go crypto/x509 + Rust webpki-roots + Python certifi,CI 昨晚刚从 PyPI 拉了新包
0x496 retweeted
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な2件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時(日本時間)に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)(@cyber_forecast) / X
0x496 retweeted
【要対応】PHP システム多数で被害が出うる脆弱性「php2shell」の修正パッチが、本日10/21 23時(日本時間)にリリースされる見込みです。
以下にて、弊社調査の現況や、現時点で考えうる緩和策・備えを整理しました。ご一読の上、対応にお役立てください。
▼ 詳細
blog.flatt.tech/entry/php2sh…
Türkiyede şuna trafik cezası koymama ihtimalleri yok tahminim 3 yıl sonra icin 750k TL
0x496 retweeted
Our researcher @PinkDraconian found a new RCE in MECCHA CHAMELEON, the hide-and-seek game with 15M copies sold in its first month. The map you're prompted to download when you join a match could write files anywhere on your PC, and he turned that into code execution on reboot.
Now fixed in 4.0.0.
-> Full write-up: aikido.dev/blog/meccha-chame…
0x496 retweeted
e hadi hayirli olsun o zaman...
no mass scans · no generic pdfs · pocs or nothing
© 2026 abuse.ltd
career update;
4 ay once bir kariyer (full startup batma cikmaya ne kadar kariyer diyebilirsek) degisikligi yapip appsec, abuse prevention, guvenlik danismanligi vb. servisler sundugum bir danismanlik / outsourcing modeline dondum.
yillardir "bu isleri niye yapiyosun, sana bir faydasi yok" vs. denilen onlarca seyin faydasini bu surecte baya net gordum. cidden son 15 senede dokunmadigim yer kalmamis. her gorustugum kisiyle illa ki ya su an calistiklari yer uzerinden ya da daha onceden yaptiklari bir is uzerinden bir sekilde denk gelmisim.
4 ay gibi kisa bir surede, her biri kendi sektorunde ciddi oyuncular olan 3 sirket ile calismaya basladim. 2 sirket ile de gorusme asamasindayim. benim zaten tek kisi olarak maksimum calisabilecegim vakit bu kadar.
derdim bugun 100 kazanirken yarin 500 kazanayim da degil; halim vaktim de yerinde cok sukur. amacim iyi oldugumu dusundugum ve zevk aldigim alanda rahatca calismak sadece.
gorusmelerde de cok suslu cumleler kurmuyorum acikcasi. hatta bazen, ekibinizden birileriyle bir yerde denk gelip tanismadiysak belki de calismayabiliriz dedigim yerler oluyor. bu ozguven vs. alakali degil tamamen "eger daha once denk gelmediysek, demek ki ilgi alanlarimiz farkli kafasi" aslinda.
benim yapmak istedigim sey biraz daha farkli. ben yillarca startup denedim, bazilarindan iyi paralar kazandim bazilarinda besiktasta apartman parasi kaybettim (lol) ama hepsinde gunun sonunda isi kapattik ve bitti.
artik 'buyuk scaleli' bir seyler denemeye motivasyonum cidden cok dusuk, onun yerine bir yerlerle cidden 'sevdigim iste' calisip, calistigim isi gercekten sahiplenmek ya iyi ki su isi vermisiz diyecekleri bir partner olmak istiyorum.
gunun sonunda da "evet burada gercekten bir sey degismis" diyebilirsem bana yeter 👋
Super excited to announce that I'll be attending LatentShift.ai Conference for engineers shipping AI in production. Let's connect if you're there! - kommunity.com/latentshiftai/…



























