Dimitris Glynos (@dfunc) profile picture

Cybersecurity | Product Security Expert | Founder of https://nitter.gq/t.co/G7a2pmP8WP

Proxima Centauri
Joined September 2010
Photo by Dimitris Glynos (@dfunc)Photo by Dimitris Glynos (@dfunc)Photo by Dimitris Glynos (@dfunc)Photo by Dimitris Glynos (@dfunc)Photo by Dimitris Glynos (@dfunc)Photo by Dimitris Glynos (@dfunc)Photo by Dimitris Glynos (@dfunc)Photo by Dimitris Glynos (@dfunc)Photo by Dimitris Glynos (@dfunc)Photo by Dimitris Glynos (@dfunc)
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
287
3,261
675
22,593
2,280,912
Dimitris Glynos retweeted
The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. emudhra.we-have-a-problem.co…
14
96
8
498
45,473
Dimitris Glynos retweeted
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more! projectzero.google/2026/09/m…
4
114
4
446
40,657
Delete the file - the data's still there. 🔍️ Great write-up from our partners at intWave on secure deletion in littlefs. Deleting a file, or even formatting the filesystem, can leave sensitive data behind in flash. The reference disappears - the bytes don't. For products entering the EU market, that falls short of the Cyber Resilience Act's requirements for permanently removing sensitive data. intWave's recommendation is cryptographic erase and it only holds if you can truly destroy the key. That's the case for a secure element. 🛡️ With TROPIC01, keys live in tamper-resistant memory, and you erase the data by destroying the key inside the chip. That gives manufacturers a verifiable way to actually meet the bar, not just hope the flash block was clean. 🔗 Well worth a read bit.ly/4wNdwK6
2
6
632
Dimitris Glynos retweeted
Unhappy with NSA's SIGINT Enabling Project sabotaging cryptographic standards? This week you can take action to register an objection with IETF regarding an NSA-funded project to standardize ietf-tls-mlkem, a weakened version of ietf-tls-ecdhe-mlkem: nsa.2026.action.cr.yp.to/
3
27
4
73
8,381
Dimitris Glynos retweeted
Some notes on Copy Fail or CVE-2026-31431, found by Xint Code (xint.io/blog/copy-fail-linux…). This is a very stable and very straightforward exploit. It worked almost on anything I tested and in some cases, there are no Kernel patches available in stable distributions (eg. Debian 13). Debian has not yet released a patched kernel for Trixie. The upstream fix landed in mainline 6.18.22 / 6.19.12, but the backport to Debian’s 6.12 kernel series for Trixie is not available yet. The available mitigation is pretty much the only option at the moment.
1
10
1
37
4,559
Dimitris Glynos retweeted
I'm hiring a research intern for summer 2026 to work with me on applied cryptography research projects. This is a paid, three-month, fully remote position. Check it out, and please spread the word! symbolic.software/blog/2026-…
17
55
1
496
31,410
My CISO called me at 3 AM last Tuesday. "We caught someone." I asked, "Caught them doing what?" He said, "Typing." Let me explain. We have an employee in IT. Great worker. Always online. Never complained. Perfect Slack etiquette. One problem. His keystrokes were arriving 110 milliseconds late. One hundred and ten milliseconds. That's 0.11 seconds. The average American remote worker has 20-40ms of latency. This guy? 110ms. Every. Single. Keystroke. My security team ran the numbers. That latency doesn't come from a bad router in Ohio. That latency comes from Pyongyang. Our "Senior DevOps Engineer" was a North Korean operative. Running his work laptop through a laptop farm. In America. While he worked from a government building. In North Korea. He passed the interview. He passed the background check. He passed the vibe check. He did not pass the speed of light. Here's what people don't understand about physics: Light travels 186,000 miles per second. But it still has to go through China. And China adds latency. Since April, Amazon has caught 1,800 of these attempts. Eighteen hundred. I called an emergency meeting with my board. I said, "We need to implement Keystroke Velocity Auditing across all remote employees." They said, "That sounds invasive." I said, "You know what else is invasive? The Democratic People's Republic of Korea in your Jira tickets." They approved the budget. We now monitor keystroke timing to the microsecond. If your latency exceeds 60ms, you get a call from HR. If it exceeds 100ms, you get a call from the FBI. We've already flagged 47 employees. Turns out 44 of them just have bad Wi-Fi. 3 of them are "still under investigation." The lesson? You can fake a resume. You can fake a background check. You can fake an American accent on Zoom. But you cannot fake the speed of light. Physics is the ultimate background check. Hire accordingly.
619
3,367
517
18,624
1,452,821
Dimitris Glynos retweeted
Top researchers do their best to exploit bugs. "Something from Nothing - Exploiting Memory Zeroing in XNU": objectivebythesea.org/v8/tal…
17
86
8,065
Dimitris Glynos retweeted
Apparently the maintainer ~qix has been compromised affecting billions of installations on @npmjs Here are the top 20 packages that qix contributed to with the number of installations per months: 1.6B --> ansi-styles 1.5B --> debug 1.3B --> chalk 1.2B --> supports-color 1.1B --> strip-ansi 1.0B --> ansi-regex 828.4M --> color-convert 823.1M --> wrap-ansi 820.8M --> color-name 310.9M --> is-arrayish 245.6M --> slice-ansi 202.5M --> error-ex 133.7M --> color 118.9M --> color-string 111.5M --> simple-swizzle 50.9M --> has-ansi 17.2M --> chalk-template 1.1M --> backslash 408.2K --> handler-agent 25.1K --> strip-ansi-stream Source of claim: github.com/Qix-/node-error-e…
9
70
18
237
44,176
Dimitris Glynos retweeted
1/N I’m excited to share that our latest @OpenAI experimental reasoning LLM has achieved a longstanding grand challenge in AI: gold medal-level performance on the world’s most prestigious math competition—the International Math Olympiad (IMO).
391
1,278
795
7,216
5,739,846
Dimitris Glynos retweeted
We have @dfunc From SSRF to sustained server engagement @BSidesAth
3
5
414
Dimitris Glynos retweeted
I had a lot of fun making this challenge. I wanted to do a cloud security challenge where the cloud infrastructure is secure (IMDSv2, data perimeters), but something still allows it to be hackable and you need to know some advanced AWS security tricks to abuse it. 🤫 Try it out!
1
9
49
4,911
New public statement from Apple (sent to me privately): “As of Friday, February 21, Apple can no longer offer Advanced Data Protection as a feature to new users in the UK.”
16
102
48
380
64,435
As a general rule, if you’re doing the right thing you don’t surprise people with a new privacy-invasive feature that’s turned “default on” over the holidays when nobody is paying attention. You do that if you’re doing the wrong thing.
5
14
1
124
18,235
Dimitris Glynos retweeted
“My wife complains that open office will never print on Tuesdays” A bizarre sentence; which kicked off one of the most interesting bug hunts in Ubuntu’s history. It all starts with some goofy pattern matching.
56
785
100
5,543
438,786
Dimitris Glynos retweeted
How can you tell a file format was designed in the 80s (wavefront OBJ) ... hopefully nobody implements that part any more :)
1
1
311
Dimitris Glynos retweeted
I figured out this prompting pattern for getting Claude to produce fully self-contained Python scripts that execute with "uv run" using PEP 723 inline script dependencies - and now I can one-shot useful Python tools with it
21
88
15
1,401
104,823
Dimitris Glynos retweeted
Consider submitting to the *first* POPL workshop on the theory and practice of static analysis: popl25.sigplan.org/home/tpsa… h/t @NZComplete @AzaleaRaad This should be a lot of fun.
2
9
21
3,377