Web3 Researcher & Educator | PhD | https://teapawt.net/t.co/ikMjsdsCov | Opinions are my own
Joined August 2010
- Tweets1.3K
- Following1.2K
- Followers293
- Likes1.9K
If you're using Claude Code, I highly recommend using the "You Should Know" plug-in from @AnthropicAI. For longer sessions and those with sub agents, it can be really helpful for pointing out process deviations or anomalous decisions before having to do a whole review pass.
James Aman retweeted
New bug in OpenSSH.
Security researchers: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Anyone with a SSH server accepting password on alpine/etc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Details: sshhole.com
James Aman retweeted
Hello World 🌎 Meet dagvisualizer — an interactive 3D network visualizer for the @Conste11ation ($DAG) network built by and for the community.
You can now start exploring real-time telemetry, node dynamics, and topology directly in your browser.
James Aman retweeted
Claude开始封锁REA，ArtCraft 团队反手开源了一个未封锁版！
项目叫 Craft Anything。
看到喜欢的网站，把网址丢给它，就能让 AI 尝试照着复刻。
更厉害的是，它还能研究 APP、桌面软件和游戏文件。哪怕没有原始源码，也可以尝试做出功能类似的新版本。
这套工具原本就用于开发他们自己的应用，现在直接开源了。
开源地址：github.com/storytold/craft-a…
James Aman retweeted
October in a nutshell:
- PHP got hacked
- Railway got hacked
- OpenCode got hacked
- Binance got hacked
- Polymarket got hacked
- GitHub Actions got hacked
- SoftBank got hacked
- Cursor marketplace got hacked
- Coinbase vendor got hacked
- Fireworks AI got hacked
- LiteLLM got hacked
- Capcom got hacked
- npm packages got hacked
- TiDB Cloud got hacked
- Warp's vendor got hacked
happy cybersecurity awareness month
James Aman retweeted
🚨 PSA for anyone running a Linux server, node, or relay
CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.
Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.
What to do today:
1. Check your kernel: uname -r
Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed.
2. If your distro has a fix, update and reboot.
3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you.
4. Turn off MPTCP unless you need it:
sysctl -w net.mptcp.enabled=0
Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in.
5. Make it survive a reboot, and check it still works after one.
If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.
Self-hosting is freedom. Patching is part of the job. 🛡️
James Aman retweeted
Holy balls the latest update to macOS *ROLLED BACK* the eMudhra cert removal from /etc/ssl/!
What the hell are you doing over there, Apple friends?
James Aman retweeted
Something big seems to be going down at the moment with binance hot wallets being drained. Folks are scrambling to determine the blast radius.
James Aman retweeted
One interesting thing between the OpenAI vs. Anthropic proofs of ETH is that the OpenAI proof is way more TCS-y and constructs simple polynomial decompositions. In some sense it gives you more "comfort" that classical CS methods like analysis of boolean functions are still correct / useful / the right way of viewing the world
But the Anthropic proof is substantially more mathematically elegant because it uses a physics-like Clifford algebraic expansion to get a natural recursion — and this recursion involves simple partition numbers that gives you the bound. The idea that a bosonic system whose band gaps are exactly the partition numbers is a "fundamental" object in theoretical CS is fucking insane to me
It sort of is kind of crazy these proofs are so different yet both are actually useful for getting intuition into the vagaries of SAT
Making some progress on simplifying the '#ETH false' proof, I think. In latest version, the key algebraic construction comes from elementary analysis of Boolean functions.
cs.cmu.edu/~odonnell/some_et…
James Aman retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
James Aman retweeted
Part 2 - three more huge updates from today, and what they impact:
4. Node.js Emergency Release (v22.23.4 / v24.22.1 / v26.12.1)
What happened:
Node shipped 10 security fixes today plus the eMudhra CA block.
• A flaw in Node's Brotli compression decoder lets an attacker run code remotely.
• 3 bugs let attackers bypass HTTPS certificate checks (including using Unicode digits to fake IP addresses).
• Single-executable Node apps were saving their random seed at build time, so every run generated the exact same "random" UUIDs.
• Node hardcodes its own list of trusted CAs inside the binary, so updating Linux does not stop Node from trusting the leaked eMudhra keys.
Real-world impact:
Almost every modern web backend, API server, and CLI tool runs on Node. Until you update the Node binary itself, your backend can be tricked into trusting fake HTTPS servers (via eMudhra) or compromised by a crafted compressed request.
5. Plex2Shell — Home media servers turned into botnets
What happened:
A 4-step bug in Plex Media Server lets anyone on the internet take over a server with zero login:
• Attackers trick Plex into sending a request to itself on 127.0.0.1 (where Plex skips password checks).
• Plex automatically attaches the owner's master token to any URL starting with "http://127.0.0.1"—so passing `127.0.0.1.attacker.com` fools the check and hands the master key to the attacker.
• From there, they use the video transcoder to drop malware onto the machine.
Real-world impact:
Thousands of people who exposed port 32400 to watch their movies away from home just had their home NAS boxes and mini-PCs silently turned into crypto miners and residential proxy botnets. If you run Plex, update it today and turn off port 32400 forwarding.
6. The PHP Patch Plot Twist (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 out now)
What happened:
PHP's official advisory just dropped and revealed how the two bugs actually work:
• Bug 1: Forcing PHP to run out of memory while parsing a request leaves internal memory half-built. When PHP cleans up the failed request, it executes that corrupted memory.
• Bug 2: Crashing Request #1 leaves leftover pointers in the worker process, and Request #2 on that same worker trips over them before the new request even initializes.
Real-world impact:
WordPress, Magento, WooCommerce, and Laravel sites (~75% of the web runs PHP) can be taken over by a single HTTP request before your website's own code or security plugins even wake up.
Wildest temporary fix from PHP's own advisory while you patch: set `memory_limit = -1` so attackers can't intentionally trigger the out-of-memory crash.
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
Oh no... some sysadmins are having a rough one today 😱💀 "These vulnerabilities often provide a direct path to the server's file system or database"
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
James Aman retweeted
It's official. Nasdaq said yes 🚀
AIAI Holdings approved for listing. The @Conste11ation / $DAG ecosystem just got its front door to Wall Street.
New update on what this means 👇 dagdaily.com/blog/nasdaq-app…
h/t @Dagnum_PI for surfacing the letter first
Digital Evidence makes data verifiable and tamper-evident through cryptographically verifiable commitments. Built for familiar API integration, it extends web2 workflows with the security guarantees of web3!
Today we’re unveiling Digital Evidence.
There are millions who need on-chain, cryptographic proof of authorship and verifiable time of creation for their data.
We tear down the barriers: put your data on-chain with one API call - publicly verifiable, private by design.
Built for millions of tx/s on a single metagraph.
#DigitalEvidence $DAG
James Aman retweeted
Introducing Plasma—the execution environment for Payments, Real-World Assets, and DeFi with trustless settlement on Bitcoin, driven by USD₮.
After years of research, we’ve developed a high-throughput Bitcoin scaling solution that operates without requiring any changes to Bitcoin Core.
James Aman retweeted
Which feature of #UTXO do you find the most compelling?
9%Enhanced Privacy
38%Predictable State
28%Efficient Verification
25%No Double Spends
64 votes • Final results