SR, Threat Modeling, Incident Response, led many War Rooms. Secured biggest names in web3 and web2. Overall a security guy fighting with the bad guys @ Cantina
cantinasecurity
Joined September 2010
- Tweets4.4K
- Following686
- Followers4.3K
- Likes8.5K
tailscale flaw once a compromised device they can rogue ssh and plant a node, if i understood it correctly, but not everyone should disable ssh according to the eng
i like you guys but me as a security defender and having just a little sleep trying to defend and mitigate with lots of my vustomers, i don’t find this funny 😭
despite the unfortunate timing, we take disclosures seriously at @typesafeai
at approximately 6:49PM this Friday evening, we became aware of a massive unauthorized leak of ALL customer noul outputs
in effort to maximize transparency, here is the link: gist.github.com/diogo149/810…
this looks nice but not sure if they fixed the usage problem, kimi on their sub plan was unusable for long running jobs…
before getting to this again waiting to see if anyone releases some stats on their subscription plan usage benchmark
Introducing Kimi K3.1 Pro: our most capable 3T-class open-weight model.
🔹 1M-token context, 2.8T total / 104B active params (MoE), Multimodal.
🔹 Full-project coding: games in Unreal, Unity & Godot.
🔹 Excels at parametric 3D modeling in Blender & CAD.
🔹 More reliable at finance work: Accurate modeling with hallucination down by 65%.
🔹 Matching the strongest proprietary models across coding, agentic and knowledge benchmarks.
Kimi K3.1 Pro and K3.1 Pro Highspeed (2–3× faster) are now live on Kimi.ai, Kimi Work, Kimi Code, and the Kimi API.
Open weights by Nov 4, 2026.
🔗 API: platform.kimi.ai
🔗 Tech blog: kimi.ai/blog/kimi-k3-1-pro
We are at full war, do not hesitated to reach out to a security researcher if you need help, if you have a product or any type of online activity, you have to assess your security practices, unfortunately we are at full scale cyber war, i haven't slept good in weeks helping customers either mitigate or defend.
Glamsterdam delayed, a good decision imo
⚠️ It has just been decided to delay the Glamsterdam hard fork on the Hoodi testnet because of security impacts we identified in this blog post: chainsecurity.com/blog/glams…
We already found 13 real-world examples and are in responsible disclosure with the affected projects.
Please check your contracts as soon as possible, as the EF is determining how many contracts are impacted in which way.
Feel free to reach out to us with questions via [email protected].
this is quite crazy, here is who you are up against
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Today is a good day to do a threat modeling, every client i do threat modeling for have been notified and helped (if affected) in the first hour of every incident that happened in the past 2 days.
The clients call me MarioGPT
Railway compromised
An urgent notice from the Railway team
blog.railway.com/p/security-…
What am I overlooking in PHP that led them to announce highly critical issues one day ahead and delay the patch for a further day? Is this irresponsible disclosure, or am I missing something?
so anyone using TiDB cloud is compromised?
10.6 TB allegedly stolen, including 413 private repositories, cloud configurations, financial records, and customer data.
115,308 plaintext API keypairs, reportedly including 42,612 active keys.
20.6 million customer SQL statements exposed, potentially containing sensitive database records.
5 million customer server IPs and 102 million connection records leaked, providing a map for targeting customers.
Severe credential exposure: AWS credentials, GitHub tokens, database passwords, and AI API keys allegedly found in support tickets and logs.
Control-plane compromise: Attackers claim they continuously exported TiDB's production control-plane database every six hours for 22 days without detection.
i did not verify the data but if true then, Huston we have a problem
