Nik Cubrilovic

data + ai + infosec engineering. @squirrelscan_ @opennem. at and

[Nik Cubrilovic @dir]

I'm very smart. Ask me anything.

[Nik Cubrilovic @dir]

Phone numbers aren’t authenticated and can be spoofed.

We can’t be far away from banks and other critical apps abandoning phone support for in-app support only

[Tinkered Thinking @TinkeredThinker]

My cousin had his bank account completely emptied yesterday and the nature of the fraud is breaking my brain.

Somehow they are calling using the bank's actual phone number? How is this possible?

[TheCyberGeek @TheCyberGeek19]

https://t.co/ZDBbde7XfM
php2shell OOM in mod_php (CVE-2026-109618): the fake-HashTable fire only runs ~14-byte commands, too short for a shell. Poison a PHP session via upload_progress with <?php system(base64_decode())?>, then exec in 11 bytes: php /tmp/s* www-data shell. Full PoCs in my github repo!
#php2shell #CVE #InfoSec #PHP #RCE

[Nik Cubrilovic @dir]

@FireworksAI_HQ when abliterated

[Nik Cubrilovic @dir]

How do you write an entire book about teenage hackers hijacking the internet and not know what PHP is? It would be the main character ..

[Nick e/code @nicksdot]

You gotta be kidding me.

[Nik Cubrilovic @dir]

BYO iPhone as a diplomat is a security nightmare - they all know that. It's a choice between having a secure gov device + network but having to comply with records retention + preservation, or going in raw into a hostile environment but being able to remain freelance

[Michael Weiss @michaeldweiss]

The GRU hacked into Jared Kushner's iPhone. Dutch military intelligence (MIVD) then recruited a GRU spy who gave them access to the hacked phone. What MIVD discovered was that Kushner had access to two bank accounts --one Azerbaijani, the other Israeli --where Saudi Crown Prince Mohammed bin Salman and Emirati ruler Mohammed bin Zayed deposited money. It sounds like a slightly far-fetched episode of "Slow Horses," but it's real. And it proves just how eye-poppingly corrupt this administration was and continues to be as its "special envoy" decides the fate of tens of millions in Europe in the Middle East. Simply incredible reporting by Matthew Cole, drawn from his new book on Kushner. https://t.co/8AyV60gg1X

[Nik Cubrilovic @dir]

Seemingly launched with support for every agent out there except OpenClaw and Hermes - both starting to feel a bit dead in the discourse

[1Password @1Password]

Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉

We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly.

1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials.

The agent gets the task done, but it doesn’t get your passwords..

You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault.

➡️Learn more: https://t.co/KxDcCum2iE

[Nik Cubrilovic @dir]

long day and it feels like we're only 36 hours in

[Tony Ma @t1o6n3y]

🚨 Security vulnerabilities reported in a SINGLE day:

PHP — 2 CVEs
Node.js — 10 CVEs
NGINX — 5 CVEs
Go — 1 CVE
GitLab — 12 CVEs
eMudhra — CA certificate compromise

[Nik Cubrilovic @dir]

Chrome has nerfed ublock origin with Manifest V3 so you need Brave

[Nik Cubrilovic @dir]

Reminder that ad blockers are absolutely an essential part of staying safe and secure on the internet

[Reuters @Reuters]

Israeli firm used online ads to run vast spy operation, researchers say https://t.co/ntPvVU94A4 https://t.co/ntPvVU94A4

[Nik Cubrilovic @dir]

@oldstackjournal fresh account with this message

[Nik Cubrilovic @dir]

@elshayib_ Too early to tell - late November or so we'll know

[Nik Cubrilovic @dir]

Planetscale moved from Vercel to Cloudflare. Not the only ones.

[Nik Cubrilovic @dir]

it's brilliant - btw, go see it

[Nik Cubrilovic @dir]

Digger is seeing this viral / word-of-mouth awakening in its third week of release. My local theatre pulled it - I got to catch the final session on a weekday morning this week - it was half full after every prior session selling &lt; 10 tickets.

[danielle @_danielle_carr]

Digger is the best movie I’ve seen in years

[Nik Cubrilovic @dir]

The previews and media tour and initial reviews didn't help - but this is starting to feel like Blade Runner, Donnie Darko, Fight Club et al where it becomes a cult hit and critics then re-evaluate.

[Dan Kornas @DanKornas]

Your coding agent can write the fix. It still needs to find the website problem.

squirrelscan is an open-source CLI website QA tool for builders using coding agents.

It helps you audit a site and give your agent specific fixes by crawling it against 300+ rules across SEO, performance, security, accessibility, and agent experience.

Key features:

• Broad audit coverage – 300+ rules across 21 categories cover website QA in one CLI
• Agent experience checks – tests whether agents can discover, read, and act on your site
• MCP and skills support – connect the tool to coding agents and run audit-and-fix workflows
• Incremental crawling – uses ETag, Last-Modified, and content hashing, with checkpoints for resuming
• Flexible reports – export findings to console, JSON, HTML, Markdown, text, LLM, or XML formats

It’s open-source (MIT license).

Link in the reply 👇

[Nik Cubrilovic @dir]

Great way to publish benchmarks :)

[Diogo Almeida @CompleteSkeptic]

Evals?!?!?!

As you all know, I dislike public benchmarks, but we do have to measure intelligence somehow.

We are trying an experiment in communicating our internal measure of intelligence.

See the blog for more details, but don’t treat it like it’s absolutely gospel, and you don’t even have to believe it fully, and it’s likely biased to our models so feel free to only pay attention to the relative ranking of open models. Shout outs to the Kev guy!

(We did not include hosted models because of what they do with their data and we want to keep our validation set very secure…)

[Nik Cubrilovic @dir]

@0xSero

[Nik Cubrilovic @dir]

Good enough for 80-90% of coding tasks

[OpenCode @opencode]

DeepSeek V4.1 Flash is now free in OpenCode

[Nik Cubrilovic @dir]

@nateberkopec @robbyrussell interesting. across 3 reasonably popular docs sites I have .md + llms.txt range from 12 - 40% of requests