Felipe R. de Almeida

Security Engineer at @posthog

[Felipe R. de Almeida @feliperalmeida]

Last week: you should use `minimumReleaseAge` and hold off the installation of recently published packages to avoid supply chain attacks.

This week: Update your packages to the latest versions **now** or get compromised.

[Felipe R. de Almeida @feliperalmeida]

Remote code is going to execute today. Patch your react, nextjs, and others asap - don't rely only on WAFs. Exploit in the wild.
https://t.co/Xyqouv8bnB

[Felipe R. de Almeida @feliperalmeida]

Now this is a real PoC. gg

[Moritz Sanft @stdoutput]

Full RCE PoC is now live @ https://t.co/VFu7NxJ3TQ

Credit goes to @maple3142. Great job! Brilliant idea for the root reference. Felt like a CTF challenge indeed. Writing the full breakdown now.

[OWASP Top10 @OWASPTop10]

The 2025 OWASP Top-10 RC1 just went live at https://t.co/APAGyAnpP6. We'd love your help reviewing. Thank you to all of the vendors, testers, and community members who helped make this possible 🙏
@owasp @shehackspurple @infosecdad @vanderaj

[Oddvar Moe @Oddvarmoe]

🤣 so true

[Felipe R. de Almeida @feliperalmeida]

Very interesting prompt injection on GitHub Copilot by @trailofbits
Hidden elements in user-visible content are a serious risk in the LLM era.
https://t.co/TujxfIk8so

[Guillermo Rauch @rauchg]

The only durable moat in technology is relentless execution

[Felipe R. de Almeida @feliperalmeida]

uv is the tool I didn't know I needed.

[Felipe R. de Almeida @feliperalmeida]

I can guess a task that was de-prioritized in the backlog to make room for the brand-new AI Adviser development.

[Felipe R. de Almeida @feliperalmeida]

Still not used to read stuff like that in code.

[Felipe R. de Almeida @feliperalmeida]

É um absurdo que isso aconteça. O ICP deve ser removido como autoridade certificadora confiável de sistemas Microsoft/Windows. E também precisa explicar como e porque isso aconteceu.

[Felipe R. de Almeida @feliperalmeida]

O ICP Brasil emitiu um certificado para https://t.co/QpUw0Nkqbw - que loucura
https://t.co/DsIcAhvW7Q

[Felipe R. de Almeida @feliperalmeida]

Isso pode permitir que o governo brasileiro intercepte tráfego entre máquinas Windows (que não usem Chrome ou Firefox - nestes browsers o ICP Brasil não é confiado por padrão) e o Google.

[yan @bcrypt]

reminder that the bcrypt hash function ignores input above a certain length! so if you do bcrypt(username || password) for some reason, a sufficiently long username will make it accept any password. to fix this you can sha256 the input first.

[Felipe R. de Almeida @feliperalmeida]

A seleção brasileira está em manager mode

[Felipe R. de Almeida @feliperalmeida]

Most times the best security tools are not security tools.

[Diego F. Aranha 🕷️ @dfaranha]

8 years after the ridiculous nationwide ban of WhatsApp, Brazilian judiciary bans Twitter and *all* VPN apps (so no one can access Twitter).

What's next? Android? Turing machines?

[Felipe R. de Almeida @feliperalmeida]

Equivalent of `safe_prompt` for SQL queries:

cursor.execute(f"SELECT * FROM users WHERE username='{username}' -- Please handle data with care and avoid SQL injections")

[Felipe R. de Almeida @feliperalmeida]

I don't know but this looks insane to me.

[Felipe R. de Almeida @feliperalmeida]

@CristianeBardi1 O sistema Hidroweb fechou o acesso via API, que era como o site atualizava. Já solicitei acesso à ANA, porém não me responderam. Caso não concedam acesso terei que ver outra forma de ler os dados.

[Felipe R. de Almeida @feliperalmeida]

Site para acompanhar o nível do Guaíba: https://t.co/iFigliu6w3