Crypto is freedom! 🦅 | Privacy is a human right! | #JusticeForJohnMcAfee | $XMR | #Bitfi
Joined November 2018
- Tweets15.5K
- Following457
- Followers1.3K
- Likes19.1K
CryptoSpawn retweeted
This week brought critical vulnerabilities in Linux, PHP, Node.js, GitLab, Python and more. Several were disclosed before patches existed.
None of this surprises us. Bitfi was designed from day one on a single assumption: every system will eventually be broken. Hardware, firmware, secure elements, operating systems, cloud backups. All of it.
Most wallets respond by building thicker walls around a stored secret. But a stored secret is a permanent target. It only has to be found once.
Bitfi is the only wallet technology that takes a different approach. Your private keys are never stored anywhere. They are computed only at the moment you need them and discarded immediately after. There is no key on the device, no key in a chip, no key in a backup.
Every storage-based wallet, no matter how well engineered, is one disclosure away from compromise. That is not a criticism of their engineers. It is the nature of storing secrets.
You can't hack what isn't there.
🚨 BREAKING: LINUX IS NOW FACING TWO CRITICAL SECURITY VULNERABILITIES, AND THERE ARE NO OFFICIAL KERNEL FIXES YET.
Both rated 9.0/10 in severity.
One could allow hackers to take control of vulnerable servers WITHOUT EVEN LOGGING IN.
And the most alarming part? The flaws were made PUBLIC before patches were ready.
Here's what's happening:
→ TWO CRITICAL RCE FLAWS: Both affect KSMBD, Linux's built-in SMB file server.
→ NO PASSWORD REQUIRED: One vulnerability could allow unauthenticated attackers to execute malicious code on vulnerable servers.
→ KERNEL-LEVEL ACCESS: Successful exploitation could potentially give attackers control within the Linux kernel itself.
→ NO MAINLINE PATCH YET: Both vulnerabilities were publicly disclosed before official kernel fixes were available.
→ DISCOVERED BY AI: Trend Micro's AI-powered security scanner identified the flaws.
→ SERVERS AT RISK: Linux systems running the vulnerable KSMBD service need immediate attention, especially if port 445 is exposed.
First PHP. Then Node.js. Then GitLab. Then Python.
NOW LINUX.
And this time, the vulnerabilities are PUBLIC before the fixes are ready.
If you manage Linux servers, CHECK YOUR EXPOSURE NOW.
Readers added context they thought people might want to know
KSMBD is a rarely used optional in-kernel SMB server distinct from the common Samba implementation; it is not enabled or shipped by default on major distributions like RHEL, and the flaws affect only systems explicitly running it with port 445 exposed.
thehackernews.com/2026/10/two-cv…
threatlandscape.io/blog/ksmbd-zdi…
CryptoSpawn retweeted
When people with a drawer full of hardware wallets conclude that a spare phone is safer, the industry should take that as a verdict.
And they’re not wrong about the problem. Every one of those devices does the same thing: it generates a seed, stores it on a chip, and asks you to trust the chip, the firmware updates, the box it shipped in, and a piece of paper in your drawer. A second phone does the same thing with a bigger attack surface.
The problem was never the form factor. It’s the stored secret. Anything that holds your keys can be extracted, pre-loaded, intercepted in shipping, or seized.
Bitfi took a different path in 2018: store nothing. Your keys are computed from a salt & phrase that only you know, used to sign, and erased. Nothing sits on the device to steal. No seed card to find. No reseller to trust. The firmware is open source and has been frozen for years.
Bitcoin can’t reach its potential while self-custody means choosing which stored secret to worry about. Every incident like this week’s sends more people back to exchanges and ETFs, and that is the opposite of what Bitcoin was built for.
There is no end to this cycle until the keys stop being stored.
