Lawrence Eng

Searching for the pot of gold at the end of the rainbow… *All views and opinions are solely my own and not of my employer*

[Lawrence Eng @LawrenceEng]

Not a drill: BTCPay Server is telling operators to shut down now (./btcpay-down.sh) after reports of hot wallets being swept. No cause, versions, or patch yet. Running one with a hot wallet? Take it offline and wait for their update. https://t.co/svxqyJSpU4

[Lawrence Eng @LawrenceEng]

Self-hosting Beam Cloud's Beta9 for GPU sandboxes? Check your worker version. CVE-2026-120306 (CVSS 9.9, published today) lets a tenant with just a workspace token escape an image build into the privileged worker. Fixed in worker 0.1.756. https://t.co/GIY9rsJmkb

[Lawrence Eng @LawrenceEng]

Ukraine's Air Force says its Air Alert app was likely hacked tonight, pushing fake radiation, chemical and street-fighting warnings. Officials say don't tap links in those alerts. Whoever controls the push server controls the panic. https://t.co/HTB9WmjkDw

[Lawrence Eng @LawrenceEng]

@KobeissiLetter Big number, but a lot of that gear is imported. BEA says the Q3 computer estimate leans mostly on import data, and imports get subtracted from GDP. So the AI boom is huge for spending and a smaller boost to US production than the headline suggests.

[Lawrence Eng @LawrenceEng]

Social Security isn't going to zero, but trustees project the retirement trust fund runs dry in Q4 2032, with a 22% benefit cut unless Congress acts. CRFB puts the average hit around $500 a month. Plan as if you'll get 75-80% of your estimate. https://t.co/vGx7jWA0Xf

[Lawrence Eng @LawrenceEng]

A ransomware crew called n0n left its own staging server wide open. SOCRadar found 1,719 files and $7K+ in AI coding agent spend. Every documented break-in used weak or stolen credentials. MFA on VPN and RDP still stops most of this. https://t.co/DMtrY3Juis

[Lawrence Eng @LawrenceEng]

Student loan heads-up: miss your servicer's final SAVE deadline and you're moved to a Standard or Tiered Standard plan, so your payment (and autopay) can jump. You can still switch to an income-driven plan before the first bill. Check your servicer inbox. https://t.co/p8MJ03Qq17

[Lawrence Eng @LawrenceEng]

@Cointelegraph @blockaid_ "Same playbook, bigger bill" is the scary part. Bybit should have been the warning shot. If the same approach still lands at a bigger exchange 20 months later, the gap isn't fancy tech, it's how hot wallet signing and approvals get checked.

[Lawrence Eng @LawrenceEng]

Running VMware Cloud Foundation? Broadcom's VMSA-2026-0008 covers a Brotli bug in SDDC Manager (CVE-2026-111497), CVSS 9.8 on 9.1.1. No patch yet, just manual workarounds (KB460732, KB460734). Apply them and limit who can reach SDDC Manager. https://t.co/FikegKzJZK

[Lawrence Eng @LawrenceEng]

WordPress 7.1.4 fixed a core bug (CVE-2026-119977) that lets an attacker hit the temporary installer mid-update and run code. Wordfence blocked 45,000+ attempts in a day. Make sure your sites actually updated, and block web access to wp-content/upgrade/. https://t.co/bMXL9NjOua

[Lawrence Eng @LawrenceEng]

@WatcherGuru The SEC rule makes this an easy call: objecting within 30 days costs a company nothing, and staying quiet lets third-party trading start with no way to pull consent later. 50 no's says less about tokenization than about letting someone else tokenize your stock.

[Lawrence Eng @LawrenceEng]

On Northflank? Rotate your secrets today. After a breach flagged by Wiz, the company says to assume every environment variable was decrypted, and customers report their AI API keys being abused. Revoke keys at the provider and check your AI bills. https://t.co/CvTsuImAYv

[Lawrence Eng @LawrenceEng]

X Money is putting a ceiling on its 6% savings rate. From Dec 1, 6% APY applies to the first $150,000 and 4% above that. Under that, nothing changes for you, but the rate is variable, so don't treat 6% as permanent. https://t.co/JqI75md0YL

[Lawrence Eng @LawrenceEng]

ACA Marketplace open enrollment for 2027 coverage starts today. Enroll by Dec 15 for Jan 1 coverage; the window closes Jan 15. Plans and prices change every year, so even if you're keeping your plan, a quick compare is worth it. https://t.co/2y5ha19ebA

[Lawrence Eng @LawrenceEng]

Amadeus, a booking provider, was breached. Japan Airlines (92,000 customers), Cathay Pacific (53,000 bookings) and Malaysia Airlines are warning passengers. Exposed: names, booking codes, sometimes passport numbers. No payment data. Watch for phishing. https://t.co/IE0yW95Duy

[Lawrence Eng @LawrenceEng]

@puckrin @elonmusk Reddit just went on sale, 44% off in two weeks. You already know how to turn a social network into an AI training goldmine. Grok could use the snacks.

[Lawrence Eng @LawrenceEng]

If you ever applied for Florida student aid (Bright Futures and the like), assume your SSN, birthday and address are out there. FLDOE says about 4.9 million people were hit. A credit freeze at Equifax, Experian and TransUnion is free. Worth doing tonight. https://t.co/u9CoIMqvyQ

[Lawrence Eng @LawrenceEng]

Nasty Gmail scam: crooks name a Google app password after a fake $399 invoice plus a phone number, so a real Google security alert carries their text. Never call a number in an alert. Go to https://t.co/5ZOWWLhvdU yourself and delete app passwords you don't recognize. https://t.co/z5DG1mEQQh

[Lawrence Eng @LawrenceEng]

@elonmusk @SpaceX 700 flights in and the wildest part is how boring booster landings have become. People used to stay up just to watch one stick. Now it barely makes the timeline.

[Lawrence Eng @LawrenceEng]

Proton's CEO canceled the AI "re-interviews" for staff and apologized after 404 Media's reporting, but also said he's still going to push AI. For a privacy company, the real test is whether it actually publishes how its code and security reviews work. https://t.co/BEnOZc7pUS