Tyler

1/ Thought it might be helpful to translate this for crypto folks so you know who is hacking you. tl;dr the word "Lazarus" doesn't mean anything anymore, it's just a collective name used to describe various North Korean cyber operations. The (relevant) clusters are as follows:

‼️ Chainalysis, the firm that tracks crypto hackers, was hacked itself. It told customers in an email seen by ICD that an attacker using "offensive agentic techniques" accessed users' names, emails and role labels. It says this has nothing to do with the $6.3B Binance heist.

Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence. Read more: chainalysis.com/blog/binance…

Kim Jong Un walks past rows of UAVs.

Confirmed: Binance hacker routed stolen TRX through Bitget wallet bridge into ETH, dumping straight into a wallet previously used in the Phemex hack. It's Lazarus, without a doubt. Funny how an APT unit can orchestrate a $6.3B multi-chain heist, but still gets caught reusing old deposit targets from 2025. Swapping TRX to native ETH as fast as humanly possible because they know mainnet ETH has no admin freeze button. 2024: DMM Bitcoin 2025: Phemex & Bybit 2026: Binance ($6.3B) They don't even bother generating fresh deposit addresses anymore. Lazarus is just running an automated DevOps pipeline to turn Web3 liquidity into national treasury reserves. Bridge TRX -> native ETH -> Tornado/privacy -> off-grid. The industry keeps building bridges, and North Korea keeps using them as sovereign exit liquidity.

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete. As an immediate precaution, Binance has: - temporarily suspended deposits and withdrawals while security checks are completed; - revoked the affected address authorisation; - engaged law enforcement and blockchain intelligence partners to trace and recover funds. Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice. Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions. binance.com/en/support/annou…

JUST IN: Netanyahu claims Israel's election has been “stolen by Arab parties.”

JUST IN: Palantir cofounder Joe Lonsdale is reportedly backing a monkey breeding startup that plans to raise 30,000 monkeys in the U.S. for medical research.

Since the @Apple Bug Bounty Program is by far the worst program I've ever hacked on, I am going to be dumping all of the data/POCs/report write ups etc for everything found during the 4 months of hacking them. This will include POCs for vulns that didnt meet their bar for a bounty so wasnt reported to them, so you may be able to find ways to escalate some of them. Ill be uploading the data all this weekend.

I saw the worst of you And I still chose you

‼️ UPDATE: Hacker "k0t" breached 924 more Fortinet firewalls than first known, Hudson Rock says. They hold 40,573 cleartext secrets, including 1,576 Active Directory bind passwords.

BREAKING: Hackers target the US Federal Election Commission, knocking its electronic filing system offline just 1 week before the midterm elections. — Reuters

Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure. foxio.io/blog/choose-your-ba…

Lo que parecía una vulnerabilidad de Node.js ha resultado ser mucho peor. Aunque suene a coña, estamos ante Broccoli2Shell. Ayer, 25 de octubre de 2026, los investigadores de seguridad de JFrog publicaron un análisis en el que demuestran que CVE-2026-111497 afecta a aplicaciones que no tienen ninguna relación directa con Node.js ni con servidores HTTP: research.jfrog.com/post/brot… Es una vulnerabilidad en el decodificador Brotli, desarrollado en C por Google, que utilizan numerosos proyectos, directamente o a través de otras bibliotecas. Sólo se ha probado RCE en Node.js, pero no podemos descartar que afecte a más aplicaciones o plataformas, lo iremos viendo los próximos días. Esta es una lista conocida de aplicaciones afectadas por este fallo de Brotli: Node.js, Bun, .NET 8, 9, 10 y 11 preview, PowerShell 7.4–7.6, Visual Studio 2019, 2022 y 2026, FFmpeg, ClickHouse, Apache Arrow, DuckDB, curl / libcurl, Envoy Proxy, Istio, Firefox, Thunderbird, Python Brotli, Python brotlicffi, Ruby, 7-Zip-zstd, p7zip, EDK II (UEFI), Ghostscript, SumatraPDF, muPDF, Chromium, Brotli4j (Java), CatBoost, YTsaurus, ngx_brotli (Nginx), UEFITool, PHP brotli extension, Ruby brotli gem, woff2, GraalJS, YDB, v8-jsi, NanaZip, EDK II Hay una web con una lista exaustiva de aplicaciones afectadas y más información: broccoli2shell.com/ Aplicaciones que pueden heredar la vulnerabilidad: - Express 5 / body-parser (Middleware que descomprime peticiones Brotli) - Axios / clientes HTTP de Node.js (Cuando una respuesta Brotli alcanza el decodificador vulnerable) - Python Requests (Cuando está instalado el soporte Brotli) - HTTPX, aiohttp, urllib3 (Cuando utilizan una biblioteca Brotli vulnerable) - ASP.NET Core (Middleware de descompresión habilitado) - HttpClient de .NET (Descompresión Brotli habilitada) - Aplicaciones con libjxl (Procesamiento de JPEG XL con metadatos comprimidos) - Aplicaciones con pyarrow (Procesamiento de datos Parquet comprimidos con Brotli) - Contenedores Docker (Si contienen bibliotecas o runtimes vulnerables) Qué revisar en servidores con servicios online: - libbrotli1 (Biblioteca compartida que utilizan otras aplicaciones) - curl / libcurl (Posible descompresión de respuestas externas) - Node.js (RCE demostrada en ciertas configuraciones) - Python + módulos Brotli (Riesgo en aplicaciones que consumen datos externos) - FFmpeg + libjxl (Corrupción de memoria reproducida) - WordPress (Algún plugin podría decodificar Brotli) A los sysadmins, que os sea leve, esto va a darnos trabajo 😆

❗️ A developer hid a Bitcoin key on a PHP server left unpatched against PHP2Shell, the critical flaws fixed on Oct 21, and dared anyone to steal it. 17 hours on, the wallet holds ~$2,000 and nobody has taken it. The developer says someone is crashing PHP but "still no RCE yet".

Clashes in Florence, too.

You should add a dislike button so then the creator has to send us a dollar