if this affects the default installation of PHP We are fucked up CVE-2026-109618 CVE-2026-109619 PHP RCEs with a CVSS score of 10.0 ☠️ news.ycombinator.com/item?id…

CLAUDE FOUND THE SEEDS anthropic.com/research/ecdsa…

LEDGER SUPPLY CHAIN ATTACK MAY HAVE BEEN EXPOSED BEFORE MASS WALLET DRAIN Former Mt. Gox CEO Mark Karpelès may have inadvertently triggered a coordinated wallet drain after publicly exposing physically modified Ledger devices containing hidden surveillance implants. On October 8, Karpelès warned that counterfeit or tampered Ledger devices were being sold with concealed SIM cards capable of transmitting stolen seed phrases. The implants reportedly intercept data sent to the device’s screen, allowing attackers to capture recovery phrases displayed during wallet setup. Crucially, these devices can reportedly pass Ledger’s official Genuine Check because the original secure element remains intact. The verification process cannot detect unauthorized physical modifications. One theory now emerging is that attackers had been harvesting seed phrases from compromised devices, waiting to drain multiple wallets simultaneously. Karpelès’ warning reportedly attracted roughly 90,000 views, potentially alerting the attackers that their operation had been exposed and prompting them to move stolen funds. Karpelès says one compromised Ledger he examined originated in Malaysia, arrived in flawless shrink-wrap packaging, and contained an implant cleverly concealed beneath the screen. The suspected attack vector is a hardware supply chain compromise, not a cryptographic vulnerability. The connection between Karpelès’ warning and the subsequent wallet drains remains unconfirmed, as does whether the same implants were responsible. If established, the incident would demonstrate how compromised hardware can undermine self-custody even when a device passes manufacturer authentication.

After six years in stealth, Atomic Machines is out. Our mission: on-demand, universal command of matter. First beachhead: the Matter Compiler, an AI-native manufacturing system that builds working micro-machines from code alone. No per-product tooling. No process development. Different code, different machine.