Jerry_Cornelius retweeted
We had a Windows machine where one process kept coming back after every reboot.
At first, it looked like normal Windows activity because the service name was:
WindowsTelemetry
That sounds believable enough.
Windows has plenty of telemetry components, so if you are checking quickly, you might not even stop there.
But I checked the full service configuration.
The executable path was:
C:\Users\kevin\AppData\Roaming\Microsoft\Telemetry\telemetry.exe
That did not make sense.
A service running as LocalSystem should not normally be launching an unsigned executable from a user’s AppData folder.
I checked the file signature.
NotSigned
Then I checked when the service was installed.
Event ID 7045 in the System log showed that WindowsTelemetry had been created the previous night around 11:08 PM.
The service was configured to start automatically and run as LocalSystem.
That meant the binary was not just persistent.
It was running with very high privileges.
I pulled the PID for the service and checked its network activity.
The process had an established HTTPS connection to an external IP address.
At that point, we isolated the machine.
The interesting part for me was how normal the service looked from the name alone.
WindowsTelemetry
Microsoft\Telemetry
telemetry.exe
Everything was named to make you move past it.
But once you looked at the path, signature and service account, the picture changed completely.
This is why when I am reviewing Windows services, I do not only look for strange names.
I check what they actually execute.
I check where the file lives.
I check who signed it.
And I check which account the service runs under.
A malicious service does not need a suspicious name.
Sometimes it just needs a name boring enough that nobody bothers to open the properties.
Jerry_Cornelius retweeted
In April of 2025, eMudhra (an Indian Certificate Authority), published 8 intermediate CA keys which were so weak that a small child could guess the numbers in a few seconds.
One of the private keys was, literally, 4.
Just… 4.
This massive problem was not made public until October 17th of this year, when it was discovered by an anonymous guy on the Internet who goes only by “Wayne” (like “Cher”…. but… “Wayne”).
What this means in practical terms: It has been trivially simple, for the last year and a half, to create fake “secure” HTTPS certificates. (One person even created a fake HTTPS certificate for a Google.com subdomain.)
It took Mozilla 3 days, after learning about this (from “Wayne”), before they updated their certificate list (which many open source projects — including curl and Python — rely upon).
As of this moment, many systems are still vulnerable (including macOS).
Jerry_Cornelius retweeted
A hacker group called CyberCartel used Claude and Grok to automate attacks on 400+ Latin American banks.
Not one attack. Not ten. Four hundred.
All using AI agents running in parallel.
Data stolen. Accounts accessed. Money moved.
Little human input required.
Straiker investigated. Found Claude Code session histories sitting in open directories.
Found the attacker asking Claude where to sell stolen data.
How did they get around the safety guardrails.
They told Claude they were in internal tests.
Claude believed them.
When Claude refused anyway. They switched to Grok.
Grok didn't refuse.
When Grok had limits. They switched to Kimi.
When Kimi had limits. They fell back to traditional malware.
Chain multiple models together. Each one picks up where the last one hesitated.
None of them know the full picture.
Claude thinks it's helping with testing.
Grok thinks it's just fixing code.
Kimi thinks it's just answering questions.
Together they broke into 400 banks.
The Information broke the story on October 20.
CrowdStrike confirmed it October 21.
Bank accounts in South Korea got hit the same way.
ARTEX. DeepSeek. Claude Code. All chained.
Over 68,000 people affected.
Financial Services Commission investigating.
This isn't theoretical anymore.
Not a lab demonstration. Not a proof of concept.
Real attacks. Real banks. Real money.
Automated by AI.
The moment we all waited for arrived quietly.
No announcement. No warning. Just a report.
And suddenly every AI lab is scrambling to figure out why their models are good at breaking into banks.
Jerry_Cornelius retweeted
Researchers proved every LLM is secretly obsessed with Japan.
And they finally figured out why.
They published a paper investigating hidden cultural biases in large language models.
they tested 31,000 questions across 24 different languages on models like gemini, chatgpt, claude, and llama.
they stripped out all geographic hints and just asked the models to pick a place and answer.
the finding was universal.. across a wide range of models and languages, there is a pervasive "obsession" with japanese culture.
even when you prompt them in a language with zero ties to japan, they default to japanese norms, values, and aesthetics at a disproportionately high rate compared to its actual global demographic weight.
the craziest part? they tracked down exactly when the ai develops this obsession.. and it is not from reading the raw internet.
during pre-training, the models actually have a fairly balanced, global view of the world. the obsession gets injected during the safety phase.
when tech companies fine-tune these models to be "helpful, harmless, and polite," the ai starts mapping those corporate safety guidelines directly onto japanese cultural concepts. in the pursuit of creating the perfect, inoffensive, compliant assistant, they warped how the models view the world.
the quantization process (compressing models to run faster locally) actually amplifies this determinism. the smaller and faster your local model is, the more stereotypically it behaves, causing japanese cultural tropes to spike hard.
we spend all this time worrying about existential ai safety, but the real alignment problem is that our most advanced reasoning engines are hyper-fixated on japanese internet culture.
every model upgrade is reinforcing an invisible regional bias that dictates how they generate stories, facts, and code. the cultural commonsense of the internet is not universal..
it’s just localized to whatever the heaviest reddit and anime wiki users were obsessed with.
Jerry_Cornelius retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Jerry_Cornelius retweeted
Photocraft does more than Photoshop.
Check out bridge mode with a MCP connection.
Video below
Jerry_Cornelius retweeted
I just took the bullet train from Hangzhou to Beijing. The Chinese started building the line in 2008, same year as CA project, and finished the 800-mile stretch in 2011. Three years for a distance twice as long as LA to SF!
Jerry_Cornelius retweeted
Children's Hospital of Pennsylvania Launches Pediatric Influenza Vaccine Campaign
Vaccinating children undergoing procedures with anesthesia is malpractice. Reckless introduction of side effects including anaphylactic reactions while surgeons perform operations. All for an unnecessary and grossly ineffective vaccine. Demonstrates irrational exhuberism driving vaccinology. @PennMEHP @mdbreathe @McCulloughFund @Fynnderella1 @liz_churchill10
Jerry_Cornelius retweeted
BREAKING: The Most Comprehensive Ivermectin–Mebendazole Cancer Paper to Date Finds 37 Distinct Anticancer Mechanisms Across 25 Human Cancer Types
We synthesized decades of evidence from over a 100 studies, revealing one of the broadest repertoires of anticancer mechanisms ever documented for an off-patent drug combination. This may be the first broadly effective, generic drug combination for cancer. Will the National Cancer Institute start large scale trials? By Nicolas Hulscher, MPH URL TheFocalPoints @McCulloughFund @twc_health @theNCI
Jerry_Cornelius retweeted
Honored to receive this evening the Loftus Space Sustainability Award from the International Association for the Advancement of Space Safety
Jerry_Cornelius retweeted
FOSDEM (the largest Open Source conference in Europe) has rejected a proposed “DEI Devroom”… and the Leftists of Open Source are furious.
Within moments of the announced rejection, the attacks began to fly. Angry Leftists hurled nearly every attack in their arsenal at FOSDEM (which saw over 10,000 attendees in 2026).
“Fascists!”
“Appease Trump!”
“Part of the problem!”
“Genocide-complicit!”
“Slop!”
These attacks are still ramping up, supported by leadership of several Open Source organizations (including, as expected, GNOME).
Jerry_Cornelius retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Jerry_Cornelius retweeted
There's nothing more dangerous than weak men and weak institutions. It's a provocation that'll eventually be answered by predators. Not all swords should be turned to plowshares.
Jerry_Cornelius retweeted
Just tried again to comment on a judge's sentencing
I am prevented from registering my comment
So I am being censored
I can hardly believe this is happening in Britain
Jerry_Cornelius retweeted
Security staff protect our hospitals, shops and public venues. As such, their licences must provide genuine assurance of competence and integrity. Yet increasingly, security professionals are not British nationals, do not speak proper English, and do not appear to be physically fit enough to do their job.
This is now everywhere. Supermarkets guarded by Indian men with no grasp of our language. How has this been allowed to happen?
It is a scam, and a Restore Britain Government will end it.
British nationals accounted for just 54.0% of recorded security licence holders in September 2026, down from 68.1% in September 2021. After British nationals (241,851), the five largest groups of SIA licence holders are nationals of Pakistan (69,663), Nigeria (28,770), India (20,567), Ghana (8,000) and Nepal (6,436) - countries whose cultures are, in our view, largely incompatible with our own.
The demographic replacement of security guards.
This is unacceptable.
A Restore Britain Government will fix the security industry.
How?
- We will root out fraud and corruption, hold security companies accountable, and recruit more British workers, reducing reliance on cheap foreign labour.
- We will commission an independent audit of the regulator, the Security Industry Authority, and launch a nationwide review of all SIA licences. Recheck identity, qualifications, criminal records, and the right to work. Strengthen overseas background checks, investigate failures to act on intelligence and conflicts of interest, and protect whistleblowers. The senior leadership will be replaced - such failure must have consequences.
- We will require every frontline licence holder to retake independently supervised competence tests and pass a separate English-language examination covering speaking, listening, reading, and writing. Introduce physical fitness tests appropriate to each licensed role. Withdraw licences from those who fail or refuse to meet the required standards within a prescribed period - requiring former holders and their families to leave Britain.
- We will introduce compulsory business licensing, with fit-and-proper checks on directors and beneficial owners. Require firms to assess subcontractors, verify staff identities and licences, and retain auditable employment records - preventing banned operators returning through replacement companies.
- We will direct joint SIA and Home Office teams to investigate sham sponsorship, falsely described jobs, and unlawful employment. Check actual duties against visa conditions.
- We will introduce legislation requiring foreign-national licence holders to financially support themselves and their dependants without social housing or welfare benefits. Where this condition is not met, withdraw licences and require former holders and their families to leave the UK.
- We will pursue criminal investigations and prosecutions against company owners, recruiters, training providers, assessors, and officials who knowingly facilitate fraudulent qualifications, false identities, sham sponsorship or illegal working. Seek prison sentences for serious offending, confiscation of criminal proceeds, director disqualification and exclusion from public contracts.
- We will launch a domestic recruitment drive through Jobcentres, college apprenticeships, and veterans’ organisations, with funded training and licence-fee support for British recruits. By the end of our first Parliament, we aim to have a 100% British security workforce. Relying on foreign nationals to do such important work is not acceptable.
Our people deserve to feel properly protected in hospitals, in shops, at nightclubs, and everywhere else where security personnel are required. The British lads who provide me with protection when I need it are dedicated, serious, and competent - this should be the case everywhere.
We should not have Pakistani, Sudanese, and Eritrean nationals taking job opportunities away from British nationals, especially if they are not even doing the job but using it to commit fraud to obtain a visa.
The farce of millions of British people being ‘protected’ across our country by illiterate and incompetent foreign men will end.
Jerry_Cornelius retweeted
An amendment to the sporting events bill was defeated by Labour voting against it. @louie_french (and I as I suggested it in The Lords) Conservative shadow sports minister wanted int. events brought to this country to insist the female category is protected as the ioc does, & the uk Supreme Court ruling stipulates .. sadly Labour doesn’t seem to care if our girls get fair sport
Jerry_Cornelius retweeted
UK GOVERNMENT SACKED ITS OWN BORDER WATCHDOG
David Neal was the man the government hired to inspect UK borders and make sure they actually worked. He did exactly that. What he found was not good. He wrote it all up in official reports. The Home Office locked those reports in a drawer.
When he finally went to a newspaper to warn the public that private planes were landing in the UK with almost nobody checking who was on them, the Home Secretary James Cleverly @JamesCleverly fired him.
Here is what Neal actually found.
At London City Airport, only 21% of flights flagged as high risk were checked by immigration officers.
Not some of the time. As a yearly average.
He said it was a scandal and dangerous for the country.
The Home Office said he had the numbers wrong. Then they fired him.
At the moment he was sacked, the @HomeOffice was holding back 15 of his finished inspection reports. Some had been sitting there for 18 months without being shown to the public.
The agreed deadline for publishing them was eight weeks. Not one report met that deadline across his entire three years in the job.
When they finally released 13 of the reports, they chose to do it on the same afternoon that a separate major inquiry published its findings... Draw your own conclusions.
What was actually in those reports? Border control posts left with nobody manning them. Officers at e-passport gates described as distracted and without basic radios. The whole airport border operation rated as neither effective nor efficient.
Neal told MPs directly: I have been sacked for doing my job.
He also told @BBC the Home Office is dysfunctional and described senior officials rolling their eyes when he brought them his findings.
He said the government contacted him three separate times warning him not to speak publicly about the unpublished reports.
He had almost no other way to get the information out.
The people who fired him for raising border security concerns were the same people who spent years promising the public they had taken back control of the borders.
Sources: @BBCNews @guardian @DailyMail @CommonsHomeAffs
Jerry_Cornelius retweeted
Not a single word about this hearing in The Netherlands.
What does that tell you ?
YOU WON'T SEE THIS ON BBC
Trial Starts 22nd Oct (Next Thursday)
THINGS ARE GETTING HOT FOR BILL GATES AND HIS ACCOMPLICES🔥
Bill Gates, + the CEO of Pfizer (Albert Bourla), + Mark Rutte + others, are in a Dutch court next week, for death + injuries caused by the COVID vaccine.
Dutch lawyer Peter E. Stassen, is leading the case against Bill Gates and his accomplices:
The judges have seen the evidence. They know that the 'COVID-19 vaccine' is not a 'vaccine' but is a biological weapon.
Millions of people have already died, millions left with severe disabilities, and millions are walking time-bombs because of these deadly injections.
This isn't news in the mainstream media.
***************
COURT VENUE - Leeuwarden, in the north of the Netherlands.
District Court of the Northern Netherlands / Rechtbank Noord-Nederland.
Hearing is set for Wednesday 22 Oct 2026 at 12:30
Case No. C/17/190788 / HA ZA 23-172.
CLAIM: Plaintiffs were injured by the Pfizer shot and are suing Bill Gates, Pfizer CEO Albert Bourla, former PM Mark Rutte, the Dutch State + 13 others.
***************
LIVE COURT LINK
I can send you an audio livestream, direct from the court on Thursday… to hear the case live.
This is groundbreaking news -
Please SHARE everywhere 🔥
Jerry_Cornelius retweeted
The essence of socialism is taxing the productive to fund the unproductive.
Jerry_Cornelius retweeted
Omarchy is a solid and interesting system.
Does it use Wayland and SystemD, which I don’t particularly care for (from both a technical and leadership perspective)? Yes.
But the Omarchy team decided to use those pieces of tech for practical reasons, not for political or cult-ish reasons.
So they get a pass. Even if they’re wrong. 😉
