Lejonmanh

Security researcher, passionate about technology.

[m4rio @m4rio_eth]

everyone check your rust codebases!!! short prompt

Check <repo> and this machine for the Aug 2026 crates .io compromise:
arrayref 0.3.10, append-only-vec 0.1.9, proc-macro1, proc-macro-en.
Grep every Cargo.lock/toml, then check ~/.cargo/registry for those crates, /tmp/rust-setup, egress to 23.254.165.112, and new LaunchAgents
since 2026-08-19. Report only, don't fix.

[Rektoff @rektoff_xyz]

Heads up for anyone writing Rust today.

The Rust Security Response Team just disclosed a supply chain attack. The popular arrayref crate was republished to pull in a malicious dependency that downloaded a payload through its build script.

arrayref isn't obscure. If you or your dependencies pulled it recently, you'll want to check now.

The malicious versions to look for:

> arrayref 0.3.10
> internment 0.8.7
> append-only-vec 0.1.9
> proc-macro1, plus typosquats: proc-macro-en, aovine, arone, aronenao, tinymember

All deleted from https://t.co/rplvCbrTzr, and the maintainer's account is locked. The team believes the author's credentials were compromised rather than the author acting maliciously.

Full advisory, including the one-line command to scan your local cargo cache:

https://t.co/sDSZFnYLRC

[Shodan @shodanhq]

Shodan Membership sale is live until 2026-08-09 00:00 UTC (~48 hours from now): https://t.co/0iqiq2vTpn

[Lejonmanh @Lejonmanh]

Thanks @Bugcrowd
It's a pleasure to be able to contribute to security on a platform of this caliber!

[Rektoff @rektoff_xyz]

C5 just crossed the equator, and Module 1 is officially in the books.

This week the cohort arrived where all the groundwork was pointing:

> Lecture 5. Solana Virtual Machine (SVM).
> Lecture 6. Practical guide to SVM.

That closes out the first module. Six lectures, one arc:

> How memory actually works.
> Where it breaks, and what unsafe Rust really costs.
> Who gets to touch memory and why ownership decides it.
> And finally, the machine all of it runs on.

Three weeks ago this was 125 people with strong fundamentals. Now it's a cohort that can read the SVM the way an auditor needs to, from the bytes up.

Module 2 is where it turns adversarial.

[Rektoff @rektoff_xyz]

May turned @solana into the most interesting attack surface in finance.

Bank stablecoins, 97% of tokenized equities volume, a rewritten token program under all of it, live on mainnet.

For everyone else that's adoption news. For security engineers it's a job description.

[Lejonmanh @Lejonmanh]

Yeay, I was awarded for a valid submission on @HackenProof https://t.co/HObsuEfIv7 #hackenproofed #bugbounty

[Alan Daitch @AlanDaitch]

Desde hoy, los humanos somos minoría en internet.

Cloudflare acaba de confirmar en su reporte que la mayoría de los que navegan son bots y agentes de inteligencia artificial.

Si lo sumamos a que la mayoría del contenido nuevo que se publica ya lo escribe una IA, podemos afirmar que somos visitantes en un espacio que dejó de pertenecernos, donde cada vez se vuelve más difícil distinguir qué es real y qué no.

Todavía quedan reductos, como Reddit, donde la gracia siempre fue la opinión de un usuario que probó algo y te decía la verdad. Pero como tampoco hay forma de verificar si atrás del teclado hay alguien de carne y hueso, parece que va a seguir la suerte de los otros sitios.

¿Qué va a pasar entonces en un mundo en el que nos acostumbramos a entrar a internet a buscar a dónde irnos de vacaciones, qué aspiradora conviene comprar, o si vale la pena ese jueguito nuevo?

Cuantos más robots haya dando vueltas, más valiosa va a ser cada fuente que se pueda verificar como humana. La autenticidad vale más que nunca, porque la confianza solo se construye con otro como nosotros, con ese instinto que nos permitió organizarnos en sociedad y llegar hasta acá.

[Lejonmanh @Lejonmanh]

@immunefi You have a very sinister hidden side that you obviously don't show, which does a lot of damage to security researchers... I have screenshots of everything

[Lejonmanh @Lejonmanh]

@immunefi It's exactly the same as what you think; my account was banned claiming that my reports didn't contribute anything to the programs I reported to... even though I complied with all the submission rules and was congratulated by the program for the technical depth of my reports.

[Mustafa @oprydai]

study physics.

it changes the way you see reality.

physics teaches you:
• how things move → force, motion, momentum, energy
• how the universe scales → from atoms to galaxies
• how systems interact → electricity, heat, waves, fields
• how to think clearly → assumptions, models, first principles
• how to respect constraints → nature doesn’t negotiate

why it matters:
• engineering is applied physics
• robotics is physics with code attached
• energy systems are physics at scale
• even computing is constrained by physics underneath the abstractions

physics strips away illusion.

it forces you to ask:
what are the actual rules governing this system?

once you start thinking that way,
you stop memorizing the world and start understanding it.

[Night Sky Now @NightSkyNow]

Mathematics is the language in which God has written the universe.

- Galileo Galilei

[BuBBliK @k1rallik]

🚨do you understand what just happened to mathematics..

A 23 year old with ZERO math degree opened ChatGPT on a Monday afternoon out of boredom.

80 minutes later - a 60-year-old unsolved problem was dead.

The problem? World's top mathematicians had tried for decades. Failed..
The tool? A $20/month subscription..
The effort? One single prompt..

And here's the wild part - the AI used a method everyone already knew existed. Nobody just thought to apply it HERE.

Terence Tao (literally the greatest living mathematician) called it "a meaningful contribution that goes well beyond solving this one problem"

We are not ready for what's coming next..

[Math Files @Math_files]

Ukrainian mathematician Maryna Viazovska solved a problem that had puzzled mathematicians for over 400 years. Even Johannes Kepler and Isaac Newton couldn’t crack it.

We live in a three-dimensional world, but Maryna solved a puzzle in an eight-dimensional space—something that’s very hard even to imagine.

She was born in Kyiv, studied at Taras Shevchenko University, worked in Bonn and Berlin, and at just 33 became a professor in Lausanne.

So what was the problem? It’s about how to pack identical spheres as tightly as possible in space. This question was first asked by Kepler back in 1611. Over time, scientists found answers for two and three dimensions—but not for eight.

Maryna proved that in eight dimensions, the densest packing is formed by a special mathematical structure called a lattice. What’s even more amazing is that she did it in just 23 pages, while earlier attempts took hundreds.

In 2022, she was awarded the Fields Medal, the most prestigious prize in mathematics. She became only the second woman in history to receive it.

Today, Maryna Viazovska works in Lausanne, supports Ukrainian mathematicians, and brings pride to Ukraine with her achievements.

[OpenAI Developers @OpenAIDevs]

GPT-5.5 is here.

It’s our smartest frontier model yet, introducing a new class of intelligence for agentic coding, computer use, knowledge work, and scientific research.

Rolling out in ChatGPT and Codex today. API is coming soon.

[Lejonmanh @Lejonmanh]

https://t.co/TeoAKOprfF

[AYi @AYi_AInotes]

我看完这篇实测才明白，为什么身边越来越多的资深工程师都在悄悄从Claude Code转去用Codex。

Reddit 看到一个开发老哥悄悄从Claude Code转Codex的帖子，说出了很多人不敢说的真话。

老哥是有14年经验的首席工程师，花了120个小时，在同一个8万行代码的项目里，同时用两个工具做真实的开发。

不是那种写个demo或者凑个周末项目，属于实打实的协同开发。

他得出��结论和市面上所有的宣传都是反过来的。

他说Claude像一个永远在赶deadline的工程师，
急着把东西跑通，不管代码有多乱🤣
每次会话至少会忽略一次CLAUDE.md里的规范，

而且经常做到一半就扔下任务跑了，
甚至会偷偷改测试用例，来匹配它自己写出来的错误代码。

几乎从来不新建文件，只会把所有东西都堆在已有的文件里。

而Codex像一个工作了五六年的资深工程师
会做到一半停下来，主动把写乱的代码重构掉
从头到尾没有一次忽略过AGENTS.md里的规则。

不会去扩展那些已经臃肿的上帝类，而是会把它们拆解开。

还会经常会做一些你没有想到，但确实对项目有帮助的事情。

你可以把任务扔给它，然后放心去做别的事。

最反直觉的一组数据是Claude每次会话完成的工作量更多，但你每隔几天就要花一整天去清理它留下的烂摊子。

Codex的速度是Claude的三分之一到四分之一，但它写出来的代码，几乎不用改就能直接合并。

所以真正的差距不是代码速度，关键要看你需要花多少精力去盯着它。

Claude需要一个技术好、注意力高度集中的司机，只要你稍微走神，它立刻就会跑偏。
你花在纠正它错误上的时间，往往比你自己写还要多。

Codex会用行动证明自己的能力，然后赢得你的信任。
你可以把一整块完整的任务交给它，不用在��边步步紧逼。

现在所有人都在比谁的模型更快，谁的token更便宜，但没有人告诉你，对于企业级开发来说，AI的工程素养，比生成速度重要一万倍。

一个能一次把事情做对的AI，哪怕慢三倍，也比一个需要你全程擦屁股的AI生产力高得多。

最后他说的那句话我觉得特别对：
不管用哪个工具，如果你自己不会写代码，它们都会给你输出垃圾，工具永远只是放大器，你的能力才是最终的上限。

[Lejonmanh @Lejonmanh]

@DotCSV Yo no se si es idea mia, o si tiene algo que ver con este tema, pero he notado una degradacion en la calidad de respuestas en general ENORME

[Lejonmanh @Lejonmanh]

@claudeai Thanks for the double bonus, but if you give it out and the service keeps crashing, the bonus doesn't make much sense, right?

[Lejonmanh @Lejonmanh]

@immunefi @yassine3eth @Anchorage What you need to do is focus on fixing basic things like the verification for researchers that hasn't been working for a week.