Vincent

🌱. Attempted leader of my own thoughts. Apparently addicted to coffee.

[Pierre @pierrecomputer]

Today we're launching an exciting new project: Highlights

Highlights is a syntax highlighter that outputs HTML. It improves on both speed and correctness compared to the existing industry standard libraries.

It's an optional drop-in replacement in Diffs, and it's ready to use today. In fact, it's already powering diffshub․com!

Check it out at https://t.co/jji0c8fzC4
OR `pnpm install @​pierre/highlights`

[s1r1us @S1r1u5_]

On July 25, we hacked OpenAI.

Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.

We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵

[blasty @bl4sty]

do not leave your omarchy machine unattended, people!

[Stanislav Fort @stanislavfort]

OpenAI's Codex Security and Anthropic's Mythos both reported 0 remaining security issues in curl

AISLE then discovered 6 new zero-days that curl's security team validated & has now assigned CVEs to

6-to-0 on one of the world’s most hardened codebases:
https://t.co/MEmaKOatT2

[vx-underground @vxunderground]

I really recommending reading this.

In summary, a company which does ID verification for in-person interactions (hotels, car rentals, ID verification for alcohol or marijuana, etc) has some how exposed over 153,000,000 drivers licenses for people in the United States and Canada.

It is a catastrophic data breach, probably one of the worse I've ever seen. If you're in the United States and have traveled, gotten a hotel, purchased marijuana or alcohol, there is a high probability you're in this.

Unlike other breaches, this includes a photo of the person (from the license), making verification you've identified the person significantly easier.

This poses a significant threat to celebrities (musicians, YouTubers, streamers, adult entertainers, actors, etc), politicians, lawyers, wealthy people (CEOs, investors, people of public interest), Law Enforcement Officers, etc

Krebs himself, and several other security researchers, have already confirmed they're in the data leak.

tl;dr gah damn dawg this company is going to be sued into oblivion

https://t.co/QpsegBUzH5

[vx-underground @vxunderground]

Dawg, they got Pete Hegseth in the data breach. It's available for sale for $100

[lcamtuf @lcamtuf]

Few people know this, but in the era of AI, traditional ISPs are cooked. You no longer need to pay for a TCP/IP stack. You can ask Claude. I have seventeen network stacks right now

[Z.ai @Zai_org]

GLM-5.3 is now open-weight.

Our most capable model for agentic coding and cyber defense is now available to download, run, and customize.

Weights: https://t.co/v1IbWMXxg4
Tech blog: https://t.co/ekQkO83jCv

[John Hammond @_JohnHammond]

🧵 Here's how a TeamPCP hacker got doxxed.

[Trail of Bits @trailofbits]

We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times.

In its final escape, the agent found three 0-days on its own and chained them into a working exploit. https://t.co/3JRVWgPxHx

[Het Mehta @hetmehtaa]

someone just plugged a cable into a Tesla charger and turned it into a computer virus.

@ScepticCtf compromised a Tesla Universal Wall Connector through the charging cable itself.

the chain:

→ compromise the Tesla Wall Connector through the charging cable itself (SWCAN protocol on the Control Pilot line, the wire that's supposed to just talk power levels)

→ the charger then hacks the car's infotainment system over wifi. on its own

→ the car parks near chargers from other brands

→ the infotainment system hacks an Autel MaxiCharger and a ChargePoint Home Flex over bluetooth. also on its own

one plug-in. four vendors. zero clicks after the first move.

but the exploit isn't the interesting part.

the wall connector firmware is bare metal ARM, binary only, no source, no symbols.

testing it live on the device gets you one attempt every few seconds and a single bit of feedback: did it crash.

they built an emulator to run the firmware off the actual hardware. same testing, 1000x faster. that's the difference between "this chip is unfuzzable" and finding a critical bug in hours.

the bug: a signed integer read from the firmware header turns into a memory write past where it should stop, during the exact step meant to verify the firmware is legit. it had been sitting there through however many people read that code.

slides in the reply.
this might be my favorite Black Hat talk this year.

[Vincent @_evict]

@Audrey_Sage_ That's exciting! Congrats!

[Eric Simons @EricSimons]

Code Storage is an incredible piece of technology

They have seamlessly scaled to tens of millions of Git repos backing Bolt projects without a hiccup

Jacob and their team have been excellent partners for us at Bolt - can't recommend higher

[Jacob @fat]

Signups are now open on Code[dot]Storage.

Today, more new repos are created per second on Code Storage than any other platform.

Lovable, Bolt, Amp, Poke, and many more of the largest agentic workloads store their code and agent memory at scale using https://t.co/oJLq0faUTg.

[domas @xoreaxeaxeax]

New exploit: “xor dword [0xf80c2094], 1<<22”

Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.

https://t.co/sgAfneFSsf

[The Hacker News @TheHackersNews]

‼️ BREAKING: A 40-minute LiteLLM PyPI compromise potentially exposed 2,100+ organizations.

Tied to Trivy's supply-chain attack, the malicious releases stole cloud, SSH, Kubernetes, and database credentials. Researchers later obtained roughly 434,000 captured files mapping potential exposure across thousands of organizations.

See what the stolen data reveals: https://t.co/eWBbLC8Ech

[Mitchell Hashimoto @mitchellh]

Been fighting the Great Firewall of America all day (Fable too, though this screenshot is from Codex). I truly believe this is resulting in software being less secure because we can't find and fix security issues in our own software that we control without a bunch of red tape.

[Jacob @fat]

Edit is now live on diffs[dot]com.

This isn't just another Monaco or ProseMirror wrapper.

This is an entirely new edit implementation, built on top of our file and diff rendering primitives.

- Over 189 commits
- Over 900 new tests

Try it out now – https://t.co/p2rSGxCFf0