You can now enjoy a colored relief map render of this dataset streamed through Google Earth. Download the .kml file (drive.google.com/file/d/1bS1…) and open it in your Google Earth Pro client. Enjoy!

This seems half right. We'll find 100,000's of vulns, which over time will leave no choice *but* to migrate to systems where perfection is not only possible, but provable.

i give it a month before the North Koreans use some abliterated model to find a backdoor in our grid and turn the lights out on Los Angeles for fun

Checking that a major mathematical proof is correct can take years. Formalization—converting the mathematical reasoning into a form computer proof assistants like Lean can verify—can help. Last month, Claude completed the first formalized proof of Fermat’s Last Theorem, one of the most famous theorems of all time. This was a project experts thought would take many years. It is the largest Lean proof ever written. Fermat’s Last Theorem was first proven in 1995 by Sir Andrew Wiles, more than 350 years after it was conjectured. Our proof, which totals over 13 million lines of code, provides machine verification. More importantly, it proves over 29,000 other theorems that the proof requires, across many areas of math which had never before been formalized. We see this as a major step in the long process of firming up the core of mathematical knowledge, building on work from three centuries of mathematicians and hundreds of contributors to Lean and Mathlib. We are optimistic that AI-assisted verification of mathematical proofs will help reduce the burden of refereeing mathematics in an era where more proofs are being produced than ever before. You can read about the process on our Science Blog: anthropic.com/research/forma… And see the complete proof on GitHub: github.com/anthropics/fermat…

My friend told me that he's had a paper conditionally accepted and still not yet published for about a year now. Academic publishing in fast-moving fields exists in an unacceptable state.

We have superconducting magnets operating in space. Let that sink in.

Pretty sure that 100% of vulns have been disclosed and we're good now.

How has no one solved spam calls yet?

Just going to preregister here that I believe the computer security overhang is not a few dozen bugs that get patched and then we're good, there are 100,000s of vulns that are extremely discoverable with infinite free tokens and we're probably going to have to move away from systems that presuppose that perfection is possible.

A different perspective, xitter.cf/jgarzik/status/2112944… Biological patterns emerge and are instructive.

Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP. Here is the short version of what happened and who got hit. 1. eMudhra (Trusted CA compromise) eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs. One of the intermediate CA private keys was literally the number 4. The other seven: 56, 66, 115, 155, 156, 230, 237. Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket. • Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs. • Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10). • 10-second check on any server: curl dv-g3b-emudhra.we-have-a-pro… (TLS error = safe. 200 OK = still vulnerable.) 2. PingCAP / TiDB Cloud (10.6 TB breach) Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents. Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets. Who is affected in the leaked records: • Live credentials exposed in support tickets: - Pinterest: AWS keys for their pingcap-logs S3 bucket - CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets - DeBank: 38 presigned S3 URLs - An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys) • Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed: - Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap - E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook - Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM - Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life - Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase • Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery): - 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash. If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket. 3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619) Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch. Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c). Because C-level multipart parsing runs before line 1 of index.php: • App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it. • Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1). • Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.

Fascinating stuff. I'm not an expert, but I remember that dodgy CAs have been a known problem since at least 2010, data retention/version control leaks at least as long, and PHP has always been adjacent to self harm. It'll be interesting to see where we land in 12-18 months on this stuff.

Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP. Here is the short version of what happened and who got hit. 1. eMudhra (Trusted CA compromise) eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs. One of the intermediate CA private keys was literally the number 4. The other seven: 56, 66, 115, 155, 156, 230, 237. Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket. • Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs. • Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10). • 10-second check on any server: curl dv-g3b-emudhra.we-have-a-pro… (TLS error = safe. 200 OK = still vulnerable.) 2. PingCAP / TiDB Cloud (10.6 TB breach) Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents. Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets. Who is affected in the leaked records: • Live credentials exposed in support tickets: - Pinterest: AWS keys for their pingcap-logs S3 bucket - CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets - DeBank: 38 presigned S3 URLs - An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys) • Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed: - Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap - E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook - Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM - Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life - Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase • Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery): - 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash. If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket. 3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619) Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch. Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c). Because C-level multipart parsing runs before line 1 of index.php: • App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it. • Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1). • Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.

~20 years ago I had a recruiter tell me I was too junior for a specific role they had. They didn’t realize I wrote the tech test for the company that was trying to hire (they had outsourced the test). I said I wouldn’t apply anyway due to the conflict of interest of doing the engineering test I authored. The recruiter then went absolutely ballistic that nobody “senior” could seemingly pass the tech test and was pissed I made it too hard for the folks she’d already been putting forward. Nobody had passed it. Within 12 months I’d left to start my first business at 23. Never looked back.

My moat is that I am retarded and have no shame. Which means I will do the retarded thing that works

Time to start sharing: I'm working with an unbelievably talented team to build @cypress__labs

In 2018, Brent Underwood did something nuts. He bought the old sliver mining town of Cerro Gordo for $1.4m. In so doing, he became the owner of a ghost town and many miles of mines. Brent has spent the last few years exploring the mines solo and trying to restore the town, which once played host to 4,000 people. Along the way, he’s become a YouTube star and a best-selling author. We went to Cerro Gordo to interview Brent and live at the mines for a couple of days. Here’s our full episode. The Core Memory pod is available at all fine pod retailers