BitStern

Est. 2014 | Crypto, AI & Tech | Trenches of Robinhood Chan with Pons & Torch, Stonk on Solana. Be prepared: Unemployment is rising, AI will take your jobs.

[BitStern @BitStern]

$TORCH ecosystem with a strong bounce after the crash one day ago

$ANTI with a +70% surge

utility projects like $ODDS and $NGL with over +50%

memes like $TORCHY and $TORCHCAT are recovering

one seems to stay at the bottom which is $TORCHINU

Robinhood Chain is a cat chain after all

are you bidding or selling?

[BitStern @BitStern]

one day later

[BitStern @BitStern]

$TORCH ecosystem with a strong bounce after the crash one day ago

$ANTI with a +70% surge

utility projects like $ODDS and $NGL with over +50%

memes like $TORCHY and $TORCHCAT are recovering

one seems to stay at the bottom which is $TORCHINU

Robinhood Chain is a cat chain after all

are you bidding or selling?

[BitStern @BitStern]

$TORCH ecosystem with a heavy pullback

$ANTI with a -72% crash
it was the first $1M runner on Torchpad, not anymore

utility projects and experiments like $ODDS and $NGL with major crashes

memes like $TORCHY $TORCHCAT $TORCHINU had -30 to -50% declines

meteoric rise up, violent crash down

what‘s next for Torchpad?

[BitStern @BitStern]

nfa dyor

[BitStern @BitStern]

$TORCH ecosystem with a strong bounce after the crash one day ago

$ANTI with a +70% surge

utility projects like $ODDS and $NGL with over +50%

memes like $TORCHY and $TORCHCAT are recovering

one seems to stay at the bottom which is $TORCHINU

Robinhood Chain is a cat chain after all

are you bidding or selling?

[BitStern @BitStern]

CZ is warning you now on a everyday basis

[CZ 🔶 BNB @cz_binance]

Everyone worried about AI hacking crypto, but the internet and banking systems rely on weaker encryption.

That said, AI doesn’t need to break Bitcoin’s cryptography to cause damage, leaked data already enables more phishing, social engineering, etc,

Stay SAFU!

[BitStern @BitStern]

GM Frens

just one working day between us and the weekend

let’s get it

[Darkfarms㊙️ @Darkfarms1]

gm, frens

[BitStern @BitStern]

nfa dyor

[BitStern @BitStern]

$PONS once again retesting the $0.25 area

will it hold or break down?

[BitStern @BitStern]

nfa dyor

[BitStern @BitStern]

$TORCH with a strong bounce

remember it’s not just a launchpad but a whole trading ecosystem

[BitStern @BitStern]

VCs are leaving, which means?

[zoomer @zoomerfied]

[ ZOOMER ]

A16Z TO DROP CRYPTO FROM ITS FLAGSHIP BLOCKCHAIN FUND'S NAME, FOCUS ON OTHER INVESTMENTS, ITS FIRST FOUNDING MEMBER TO ALSO LEAVE: THE INFORMATION

[BitStern @BitStern]

tech and Internet in trouble

[Chubby♨️ @kimmonismus]

Whats happening right now is probably way worse than the Hugging Face incident.

AI-powered attacks are hitting real organizations while major platforms disclose breaches and critical flaws.

- Microsoft reports AI agents targeting hundreds of organizations, reaching privileged cloud access in under three hours in multiple cases. It attributes the ConnectWise compromise to the same group.

- CrowdStrike documented four operators running successful AI-agent campaigns. One compromised at least 15 Argentine healthcare organizations.

- PHP2Shell: AI helped turn longstanding PHP flaws into working exploits. Cloudflare’s CEO reports millions of exploitation attempts. Their AI involvement is unknown.

- Railway disclosed possible access to customer secrets. LiteLLM shipped a backdoored release. Zeabur confirmed another breach and is shutting down.

- GitLab patched a maximum-severity flaw affecting 12 years of releases. Node.js patched a serious code-execution vulnerability, with Vercel deploying firewall protections.

Feels like a turningpoint.

[BitStern @BitStern]

now python

his 2026 security strategy

stay home and only connect to the Internet from a trusted ISP

[Laurent @L4UR3N7]

🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis.

🔸 Mettez immédiatement pip à la version 26.2.2 ou plus.
🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip
🔸 uv : uv self update (0.13.4 ou plus)
🔸 Mettez aussi à jour les certificats du système (apt / dnf upgrade ca-certificates) et vos images Docker

pip install est compromis.

L'autorité indienne eMudhra (emSign), qui signe les « passeports » prouvant qu'un site est bien celui qu'il prétend être, utilisait des clés secrètes ridiculement faibles : 8 clés, toutes inférieures à 256. L'une valait 4. Autrement dit, n'importe qui peut fabriquer un faux passeport valide pour n'importe quel site.

Le risque pour Python : quelqu'un sur ton réseau (wifi public, FAI, État) se fait passer pour https://t.co/KxkevWMTiB, et ton « pip install » télécharge un paquet piégé sans aucune alerte. Aucune attaque n'a été signalée pour l'instant, mais c'est trivial à faire.

Un paquet piégé peut installer n'importe quoi. Porte dérobée, virus, vol d'informations en tout genre.

La situation est terrifiante !

Rien que dans l'écosystème Python, chaque installation de CPython, chaque venv, uv, tout est exposé.

Et je ne vous parle même pas de npm, pnpm, yarn, Go, Rust.

Ma stratégie de sécurité 2026 : rester chez moi et ne me connecter à Internet que depuis un FAI de confiance.

C'est quand il y a de la mer qu'on reconnaît les vrais marins...

[BitStern @BitStern]

is this good or bad for cybersecurity in the long run?

[sui @birdabo]

they’re calling it the black October lmao.

> node.js: security vulnerability.
> PHP: critical RCE vulnerabilities.
> tensorlake: npm package infected.
> liteLLM: malicious PyPI + Docker releases
> Railway: customer secrets exposed
> zeabur - infrastructure breached.
> OpenCode: AI API keys exposed.
> OVHcloud CLI: official binaries backdoored.
> RankMath PRO: malware inside official plugin.
> TeamUpdraft: customer data compromised.
> ConnectWise: cloud backup identities compromised.
> SubQuery: backdoored npm package.
> GhostAction: GitHub repos with malicious workflows (related to the broader Shai-Hulud/ChainDrop activity).
> eMudhra: certificate authority keys compromised (with downstream impact on Tailscale).

this some complete madness bro. 1/3 of the internet is fucked.

[BitStern @BitStern]

smart tech

[bone @boneGPT]

tonight is the night

[BitStern @BitStern]

one after another

now a PyTorch vulnerability

[Elon Litman @elon_lit]

There is an (unpatchable?) supply-chain zero-day in PyTorch autograd that allows a regularization term to use the model's weights as RAM and SGD as its CPU clock to run any computation during training.

[BitStern @BitStern]

next vulnerability - ai acceleration

[Aikido @AikidoSecurity]

⚠️ Node.js is vulnerable to remote code execution.

CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code.

You’re exposed if your app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser)

Aikido detects this. Patches are available.

[BitStern @BitStern]

@coinesper yes

[BitStern @BitStern]

is this related to php or something else?

[unusual_whales @unusual_whales]

BREAKING: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, per Axios

[BitStern @BitStern]

@Templarsreturn yeah

the crash is normal, recovery is not

only if the ecosystem flourishes

let‘s see where we go from here

[BitStern @BitStern]

after the php vulnerability CZ recommends to be careful when visiting websites

[CZ 🔶 BNB @cz_binance]

Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.

Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers running popular apps like WordPress and Magento, with patches released October 21, 2026 after details leaked early.

Exploitation was confirmed in the wild soon after disclosure, prompting quick WAF protections and patching by IT teams, as unauthenticated attacks could turn visited sites into vectors for credential theft or device exploits.

Stay SAFU!