Insights on security, privacy, technology, money · Co-founder & Chief Security Officer @CasaHODL · creator of https://xitter.cf/t.co/q2pgFGTJZh, https://xitter.cf/t.co/xUkNreXj20

Cyberspace
Joined March 2009
Pinned Tweet
An open letter to the Bitcoin ecosystem:
30
74
12
669
38,973
Vibe coding software wasn't dangerous enough, so @DEFCAD trained a model called GatGPT 😎 gatgpt.defcad.com/
1
1
16
2,446
Seeing reports of another round of snail mail social engineering letters from "Ledger" that try to trick you into scanning a QR code that takes you to software that steals your seed phrase.
72
13
1
50
9,870
Today is a good day to instruct your clanker to rewrite your PHP app in Rust.
12
15
3
168
15,952
Anyone who has been maintaining internet-facing infrastructure for the past 3 months: xitter.cf/ThePHPF/status/2112828…
Replying to @ThePHPF
If you rely on the volunteer maintained rpms.remirepo.net we urge you to move to distro packages or building from source now, so you can immediately apply updates. The repo will not have updates today.
2
6
2
106
9,300
🚨DEFCON 1🚨 In a few hours, a critical vulnerability that affects ~70% of web sites will be disclosed. It allows an attacker to upload and execute arbitrary code. It's probably best if you stop browsing the internet for the rest of the week. xitter.cf/ThePHPF/status/2112633…
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Readers added context they thought people might want to know
These are server-side PHP RCE vulnerabilities for which web hosts/admins should prepare to patch per official notice; general users face no direct need to stop browsing. PHP detected on ~69% of sites with known server-side language. php.net/archive/2026.p… w3techs.com/technologies/d… cert.europa.eu/publications/s… sansec.io/research/php2s… arstechnica.com/security/2026/…
135
403
87
4,317
850,610
Since morons are noting my post, claiming that it's only a server side issue that doesn't affect clients, here's why interacting with compromised servers is A BAD IDEA:
1
9
58
7,397
Seems like the only thing I ever randomly win is enhanced screening by TSA.
16
87
14,364
October is Cybersecurity Awareness Month. Remember: the less data you share with online services, the smaller your attack surface and safer you are!
15
9
105
15,709
Jameson Lopp retweeted
The sovereign individual predicted this.
Dior had no faith in the French police to protect their store so they brought in their own security team to protect the flagship store in Paris tonight
5
20
179
14,010
We got flying cars before we got Half-Life 3 🥲
15
3
82
18,428
Pretty amazing how it's possible to cram more courage than the entire Uvalde police department into a single man. xitter.cf/CollinRugg/status/2111…
JUST IN: The man who stopped the school shooting in Bend, Oregon, has been identified as 36-year-old Kalub Giamanco. Giamanco, a carpenter, was reportedly driving home for lunch when he heard gunshots. After hearing the gunshots, Giamanco, who has a concealed carry permit, followed the suspect into the school. He then shot and killed 16-year-old John J Griffin moments after the teen opened fire into a special education classroom. Giamanco, who has two children of his own who attend the school, is family friends with one of the victims, a 7-year-old who uses a wheelchair and was shot in the face. The 7-year-old survived and is in the hospital. Three children at Silver Rail Elementary School were killed. Their ages are 5, 8, and 11. According to Giamanco's brother, Giamanco doesn't feel like a hero because he feels guilty for not being able to save more children. You are a hero, Kalub.
5
16
270
18,719
Good news: the Bitcoin Wrench Attack archive just got a lot more accurate. Bad news: we just doubled the total number of known attacks to over 700. Kudos to @pizza_bitcoiner for finding hundreds of new attack reports via agentic searches. jlopp.github.io/physical-bit…
37
39
8
330
49,596
More evidence you can't trust anyone with your personal data. 9 million people had their records leaked because some fool set an admin password to "123456" en.cryptonomist.ch/2026/10/1…
18
14
1
93
9,640
Jameson Lopp retweeted
WELCOME TO SLOPPYWOOD 🎙️🧡
115
241
72
1,237
196,058
No, I'm not worried that the future of self custody is in peril simply because a bunch of edge case attacks and vulnerabilities I've been warning people about finally started happening in a short time span. This is vindication for a decade of grinding @CasaHODL
26
14
2
272
17,389
Jameson Lopp retweeted
Resilience > Security
3
3
32
4,705