DCWebGuy

Malware hunter/analyst. PCAP denizen. Old-school webdev. (re-)Tweets mainly infosec IOCs, plus some politics and science. Consilience bias. I hate ideologies.

[DCWebGuy @DCWebGuy]

This is important, you should watch it. Knowledge is going public.

[ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ 🛡️ @DanielMiessler]

https://t.co/YgsGdPRvAI

[DCWebGuy @DCWebGuy]

https://t.co/9SGcJinw1f
Among the payloads distributed through this TDS infrastructure, we identified several malware families:

SessionGate — A previously unknown multi-stage loader with heavy obfuscation and extensive anti-analysis mechanisms, which makes obtaining the final payload extremely difficult. In the chains we observed, it was used to deliver potentially unwanted applications (PUA). We examine SessionGate more deeply later on this article.

RemusStealer — a newly emerged infostealer designed to steal data from more than 20 browsers and targeting hundreds of browser extensions and applications, including cryptocurrency wallets, two-factor authentication tools, and password managers.

AnimateClipper — A cryptocurrency clipper capable of hijacking transactions across more than 20 blockchain ecosystems.

[DCWebGuy @DCWebGuy]

These convincing copyright notices are designed to steal Google logins https://t.co/CqnfdRS5sx via @Malwarebytes

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Removes LLM censorship with a single click.
credit via @elder_plinius bro,

Obliteratus, the open-source weapon that hunts down the exact weights causing refusals and surgically projects them out, is helpful for cybersec.

Obliteratus uses advanced techniques (SVD, mean-difference analysis) to detect refusal behaviors and remove them at the weight level without retraining
One-click ablation, Gradio playground for no-code use, Reversible steering vectors,

Supports 100+ Hugging Face models, Multi-GPU ready.

- https://t.co/3sMeMv1M45

[Spencer Baggins @bigaiguy]

A French engineer who lives quietly in Paris has spent 30 years writing software that the entire internet now runs on without knowing his name.

He wrote the code that streams every YouTube video, every Netflix show, every TikTok clip. He wrote the code that runs the virtual servers underneath AWS, Google Cloud, and Microsoft Azure. He calculated more digits of pi than anyone in history. He has no Twitter. He has no marketing. He just keeps shipping.

His name is Fabrice Bellard.

Here is the story, because almost nobody outside the systems programming world knows what one man has built.

Fabrice was born in 1972 in Grenoble, France. He studied at École Polytechnique, the top French engineering school. He never went to Silicon Valley. He never built a startup empire. He just wrote code.

In 2000 he started a project called FFmpeg, an open-source multimedia framework for encoding, decoding, and streaming video. He was 28. The project did one thing nobody else had done well. It handled every video and audio format that existed, in one library, on every operating system. He led it himself for years.

Today FFmpeg is the invisible engine of the internet. YouTube uses it. Netflix uses it. VLC uses it. Chrome and Firefox use parts of it. Every Android phone, every iPhone, every smart TV, every video editing tool you have ever touched runs FFmpeg somewhere underneath. If you have watched a video on a screen in the last 20 years, Fabrice's code processed it.

He was not done.

In 2003 he started QEMU, a machine emulator and virtualizer. He wrote it solo until version 0.7.1 in 2005. QEMU lets you run any operating system on any other operating system. It became the foundation of modern virtualization. KVM, the Linux kernel hypervisor, runs on top of QEMU. Every major cloud provider, AWS, Google Cloud, Microsoft Azure, IBM Cloud, runs virtual machines on infrastructure built around it. The Quick Emulator is the most cited piece of cloud infrastructure code on Earth.

He kept going.

In 2001 he won the International Obfuscated C Code Contest with a small C compiler that grew into TCC, the Tiny C Compiler. TCC can compile and boot a Linux kernel from source in under 15 seconds. In 2004 he calculated the most digits of pi ever computed at the time, using a personal desktop computer and an algorithm he derived himself called Bellard's formula. In 2011 he wrote a complete PC emulator in pure JavaScript that runs Linux in your browser, a project called JSLinux that engineers still cannot believe is real.

In 2019 he released QuickJS, a small but complete JavaScript engine that fits where V8 cannot. In 2021 he released NNCP, a neural network based lossless data compressor that immediately took the lead on the Large Text Compression Benchmark.

Then he turned his attention to large language models. He built TextSynth Server, a web server with a REST API for running LLMs locally. He released ts_zip and ts_sms, compression utilities that use language models to compress text and short messages at ratios traditional algorithms cannot reach. He released TSAC, a very low bitrate audio compression system. In December 2025 he released Micro QuickJS, a new JavaScript engine for microcontrollers, separate from QuickJS, designed for environments with almost no memory.

Fabrice co-founded a telecom company called Amarisoft in 2012, where he serves as CTO. Amarisoft builds 4G and 5G base station software used by carriers and labs around the world. He has been running it for over a decade while continuing to ship personal projects from his own home page at bellard dot org

He has no Twitter. He has no Instagram. He gives almost no interviews. His personal website is a flat list of projects with no styling, no fonts, no marketing copy. Just titles and links.

A quiet French engineer who never moved to Silicon Valley wrote the code that quietly runs the internet.

He is still shipping.

[Bridget D 🐝🌷🪻⚘️🦋 @ZoeyCatBell]

Today's 82nd anniversary of D-Day comes with the unveiling of a new national tribute to those who changed the course of World War II.

The National Memorial of Military Ascent (NMMA) is a tribute to the U.S. Army Rangers who scaled the 100-foot cliffs of Pointe du Hoc during the D-Day invasion of Normandy in World War II. Located in Grafton, Illinois, the memorial utilizes the steep limestone bluffs along the Mississippi River to visually recreate this historic 1944 climb.
#Dday
#OmahaBeach
#WW2
#LestWeForget

[UnveiledChina @Unveiled_ChinaX]

A careless code blunder just blew the lid off Beijing’s multi-million dollar AI propaganda operation targeting the West. France's digital interference watchdog, Viginum, has officially exposed "Fawn Mianju," a covert network of 13 multilingual fake news sites running on advanced automation and generative AI. The sophisticated network was completely compromised after a computer engineer working as a Senior Project Manager at China's state-run CGTN Digital accidentally left his login credentials exposed in the code.

This operation, which expanded on findings first uncovered by U.S. cybersecurity firm Graphika in 2025, operated with deep financial backing. The domains were registered in Beijing, hosted on Alibaba Cloud, and utilized expensive infrastructure alongside paid plugins to artificially manipulate search engine rankings. Using digital keys linked directly to AI language models, the network automatically scraped CGTN articles, lightly rewrote them, and republished over 2,300 articles, often within less than an hour of the original state media broadcast.

Sites like the French-language "Actu Méridien" were weaponized to manipulate public opinion across 89 countries, heavily targeting Western audiences and Francophone African youth. The articles aggressively peddled pro-Beijing narratives, painting China as the undisputed leader of the Global South and green energy transition while explicitly telling Western readers that aligning with Chinese interests would bring them massive benefits.

Despite the cutting-edge tech and heavy state funding, the operation was an organic flop. The articles struggled to breach 15,000 views, with nearly 40 percent of its top social media engagement traced back to fake accounts in Burundi whose sole purpose was to artificially inflate the content. While the reach was limited, French authorities warn that the operation exposes Beijing’s rapidly escalating capability to launch fully automated, stealth disinformation campaigns designed to quietly erode Western democratic alignment.

#Disinformation #CyberSecurity #France #China #AIPropaganda #Geopolitics #Viginum #NationalSecurity

[stephanie wakefield @stephwakefield_]

Here's a draft excerpt from our film project THE WILD CITY, chapter on contemporary warfare. Needs more reality melt - suggestions would be welcome

[Legal Mindset @TheLegalMindset]

Translation: Sorry, we were accidentally transparent, we meant to edit the files to solely support Bricks and Minifigs.

[International Cyber Digest @IntCyberDigest]

❗️Update: Bright Data calls itself "inherently safer and more ethical."

But its SDK turns Samsung/LG TVs into scraping exit nodes with no signing, no auth, no attestation. Less secure than typical malware C2 according to a recent analysis.

And how is routing scraping through residential IPs to dodge blocks "ethical"?

[Miles Cranmer @MilesCranmer]

This is an insane paper and I love it

https://t.co/DP8OR5NJf2

[solst/ICE of Astarte @IceSolst]

Claude code’s /security-review is just a Skill, and the whole prompt is in this repo

It’s p generic and imo you can tailor it to each repo to language you’re scanning to get better results

https://t.co/1a4puZSASL

[\newcommand{\femb0t}{ @__femb0t]

Found the best tweets on this website

[John Sailer @JohnDSailer]

NEW: a report from Vanderbilt and WashU just dropped, taking on the "state of scholarship in the humanities and social sciences," a big topic among critics of higher ed.

Read along w/ me 🧵

[International Cyber Digest @IntCyberDigest]

❗️🚨 An Israeli company has backdoored hundreds of millions of households through countless Smart TV apps, and they're quietly turning Samsung and LG TVs into exit nodes for AI web-scraping. Your TV is relaying strangers' web traffic from your home IP, your bandwidth, your address attached to whatever those scraping jobs touch.

Roku, Fire TV and Google TV banned the practice. Samsung and LG didn't. The culprit is Bright Data's proxy SDK, which rides inside Tizen and webOS apps, 200+ on webOS alone. Datacenter IPs get blocked, home IPs don't.

Include Security reverse-engineered the SDK and found its relay protocol has no message signing, authentication, or device attestation. Their words: less secure than typical malware command-and-control.

To make things worse, they found that in iOS the relay tunnel binds straight to the physical network interface, so it routes around any VPN the user is running.

Bright Data's config also ships per-country tiers. Devices in Uzbekistan and Oman are cleared to relay down to 1% battery, with data caps up to 60x the worldwide default.

Before the BaCkDoOrEd replies land: technically you agreed. In practice you were enrolled into a global proxy network you were never given the information to refuse. And these exit nodes drag down your IP's reputation, potentially leaving you with blocks from providers.

[DCWebGuy @DCWebGuy]

@GodSpawned @Math_files Thank you for posting this link!

[Mandiant (part of Google Cloud) @Mandiant]

🚨 UNC3753 is targeting US law firms using vishing and RMM tools for data extortion.

In instances linked to UNC3753, individuals posing as IT technicians attempted direct data theft using physical, in-person access.

Read more & get IOCs ➔ https://t.co/0SDAcovfSY

[Nicolas Hulscher, MPH @NicHulscher]

BREAKING: ADVANCED ALZHEIMER’S PATIENT REGAINED SPEECH, MEMORY, AND BLADDER CONTROL AFTER SINGLE PSILOCYBIN DOSE

An 80-year-old woman with advanced Alzheimer’s — who had barely spoken for YEARS — experienced RAPID and SUSTAINED improvement after taking 5g of psilocybin mushrooms.

During the acute phase, she entered a prolonged deep sleep-like state with profuse sweating.

~19 hours later, she spontaneously started talking again for HOURS — sharing detailed autobiographical memories she hadn’t expressed in years.

Over the following days, her family reported improved memory, walking, emotional connection, speech, and regained bladder control.

After 1 month, bladder control REMAINED RESTORED, and she was still functionally improved compared with baseline.

While this is just one published case report, the implications are enormous given that there are currently NO approved medications known to produce effects like this in advanced Alzheimer’s.

These findings urgently need replication. For millions watching a parent or loved one disappear to Alzheimer’s, even the possibility of restoring lost function warrants serious scientific investigation.

[DCWebGuy @DCWebGuy]

@EMBurlingame Bought, looking forward to reading it.