@stebets

Code Wrangler @haveibeenpwned, former Microsoft MVP, @dotnetfdn member, @stebets@infosec.exchange.

 Reykjavík, Iceland
stebet.net
Joined February 2009
  • Tweets15.6K
  • Following1.4K
  • Followers2.3K
1.4KMedia
Stefán Jökull Sigurðarson retweeted
Scott Helme
@Scott_HelmeOct 21
-----BEGIN EC PRIVATE KEY----- 4 -----END EC PRIVATE KEY----- 😬
90
691
76
10,240
263,286
Stefán Jökull Sigurðarson retweeted
Scott Helme
@Scott_HelmeOct 21
Here's everything we've done so far for @reporturi in response to php2shell. Feedback and suggestions welcome 👍
Report URI
@reporturiOct 21
Two critical PHP vulnerabilities leaked ahead of the scheduled patch. We disabled session upload progress, blocked multipart requests at the edge, and confirmed Cloudflare’s new WAF mitigations were in place. Our response to php2shell so far: blog.report-uri.com/respondi…

Responding to php2shell, CVE-2026-109618 and CVE-2026-109619

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leaked before PHP could ship a fix. Here's what's known, what isn't, and the three things we did to protect Report URI in the...

blog.report-uri.com
2
11
2,811
Stefán Jökull Sigurðarson retweeted
Scott Helme
@Scott_HelmeOct 14
Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack. The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason. I’ve written a rebuttal as this is really dangerous advice and it's based on some incorrect technical claims. scotthelme.co.uk/passkeys-ar…

Passkeys Are Not a Trap

A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this...

scotthelme.co.uk
29
73
10
365
107,914
Stefán Jökull Sigurðarson retweeted
Troy Hunt
@troyhuntOct 12
If only they’d checked first 🤔
security.nl@securitynlOct 11
'Wachtwoord 123456 leidde tot datalek met gegevens van 8,8 miljoen Denen' #securitynl security.nl/posting/957023/%…

'Wachtwoord 123456 leidde tot datalek met gegevens van 8,8 miljoen Denen'

Een groot datalek in Denemarken waarbij de gegevens van 8,8 miljoen Denen werden gestolen was mogelijk doordat er voor een ...

security.nl
9
10
245
14,075
Stefán Jökull Sigurðarson retweeted
The Nature@NaturalWorld515Oct 1
Iceland 🇮🇸
29
460
34
4,681
84,240
Stefán Jökull Sigurðarson retweeted
Scott Helme
@Scott_HelmeSep 23
If you complete this reCAPTCHA, you're absolutely screwed 😬
Report URI
@reporturiSep 23
One suspicious domain led us to 2,000+ compromised WordPress sites, a fake reCAPTCHA lure and a macOS infostealer targeting crypto wallets, browser cookies and Keychain data. We traced the campaign to sanctioned Russian infrastructure and published the IOCs: blog.report-uri.com/chasing-…

Chasing a ClickFix Campaign From One Domain to a macOS Stealer

Yesterday, we traced a single domain from an external threat feed through an extensive delivery chain: compromised WordPress sites, a fake reCAPTCHA challenge and a macOS cryptocurrency stealer...

blog.report-uri.com
2
5
18
5,062
Stefán Jökull Sigurðarson retweeted
Troy Hunt
@troyhuntSep 17
Does @haveibeenpwned have a friend at @OpenAI? We’re struggling to get our MCP server into their plugin store and the reasons why are super vague. Getting it into Claude was a breeze, it shouldn’t be this hard.
40
20
6
597
84,831
Stefán Jökull Sigurðarson retweeted
Scott Helme
@Scott_HelmeSep 7
They exposed data on 8.8 million people with no exploit, no malware, and no access to MAG’s servers. Three server-side API keys sat in public JavaScript for 4+ years and FulcrumSec found them. They could have modified and deleted data too. I verified how the Manchester Airports Group breach happened: scotthelme.co.uk/no-hacking-…

No Hacking Required: The Manchester Airports Group Data Breach

On 27 August 2026, Manchester Airports Group told customers that "an unauthorised third party" had stolen their data. Car park bookings, lounge bookings, Fast Track purchases for airport security and...

scotthelme.co.uk
10
15
6
57
34,061
Stefán Jökull Sigurðarson retweeted
Scott Helme
@Scott_HelmeSep 2
This is a very convincing ClickFix lure that's impersonating the Cloudflare 'Human Verification' process. We've been tracking this operator mostly through their Magecart campaign, but they're dual-purposing their infrastructure and also serving a ClickFix attack on non-ecommerce sites. Full details and IoC list: blog.report-uri.com/one-load…
3
4
1
14
4,095
Stefán Jökull Sigurðarson retweeted
Starlink
@StarlinkAug 31
Starlink Mini keeps you connected to high-speed internet on the go 🛰️❤️
Scott Helme
@Scott_HelmeJul 27
I’ve got a @Starlink Mini on the pano roof for our Euro road trip! 📡🛰️ Awesome roads, great food, beautiful views, fast WiFi. What more could a nerd want?! 😎
197
310
15
2,495
680,442
Stefán Jökull Sigurðarson retweeted
Stefán Jökull Sigurðarson
@stebetsAug 28
I don’t agree with @dhh on some things, but listening to him talk to @lexfridman about Omarchy, AI and computers is really fun. The joy, excitement and fun he has had building Omarchy and learning about AI and agents is simply contagious. Great interview! youtu.be/NYFGCESmikA?is=pqIe…

DHH: Future of Programming, AI, Agentic Engineering, Vibe Coding & Linux | Lex Fridman Podcast #501

DHH is the creator of Ruby on Rails, Omarchy Linux, CTO of 37signal...

youtube.com
1
2
296
Stefán Jökull Sigurðarson retweeted
Kristján Va@kristjanvalurAug 28
Replying to @MalcolmLionel98 @stebets @ccp_chimichanga @ctismer
It was an experiment by @ctismer to prove that Python could work as a frame evaluation loop. I think @eggertm was the one who discovered it and suggested it for the EVE engine. Christian later came to Iceland to adapt and perfect it, particularly the Stack Slicing.
2
1
1
120
Stefán Jökull Sigurðarson retweeted
Daniel Hannan
@DanielJHannanAug 25
An apt day to remember that Dolly Parton once recorded a cover of Stairway to Heaven - and, in defiance of every moral law in the universe, she absolutely owned it.
1,020
14,356
1,722
81,347
7,173,326
Stefán Jökull Sigurðarson retweeted
Erlendur@erlendurAug 23
Hvaða þvæla er þetta hjá formanni Sjálfstæðisflokksins?
8
4
37
4,009
Stefán Jökull Sigurðarson retweeted
Aaron Stannard
@AarononthewebAug 14
Going to try something a bit different - introducing /r/moderndotnet , a totally bare bones subreddit aimed around talking about .NET while not having ridiculous rules and being assholes about it. Please join and help us jumpstart
Aaron Stannard
@AarononthewebAug 14
Guy submits a post about building Magic the Gathering in C# - it gets some votes on /r/programming He cross-posts it to /r/dotnet It gets downvoted to zero and here's the top comments Good lord this subreddit is getting agreeableness-mogged by /r/programming lol
18
28
2
133
11,472
Stefán Jökull Sigurðarson retweeted
Dave Callan | dotnet
@Dave_DotNetAug 13
How Fast is #dotnet 11 Runtime Async? | Medium medium.com/@skyake/how-fast-…

How Fast is .NET 11 Runtime Async?

Traditional async/await

medium.com
3
25
2
130
17,065
Stefán Jökull Sigurðarson retweeted
Report URI
@reporturiJul 23
Onboarding just got a whole lot easier! 🤖 Using Claude, ChatGPT, Gemini, or another AI agent? Login, click "Copy Prompt", paste it into your AI, and it'll configure CSP reporting for you. Get up and running in minutes 😎 report-uri.com/
2
2
585
Stefán Jökull Sigurðarson retweeted
Pi-hole@The_Pi_HoleJul 8
Oh, don't mind me. Just testing an upcoming feature...
16
16
3
317
30,559
Stefán Jökull Sigurðarson retweeted
mRr3b00t
@UK_Daniel_CardJul 7
I made a thing that might help people: mr-r3b00t.github.io/net_draw…
22
51
5
289
39,245
Stefán Jökull Sigurðarson retweeted
Scott Helme
@Scott_HelmeJun 22
It's live! 🔑 whynopasskeys.com/

Why No Passkeys? — top sites without passkey support

19 of the world's top 50 websites still don't support passkeys. See the global list and per-country reports.

whynopasskeys.com
5
7
1
39
22,908
Load more