Liko

☕️互联网穿梭| 咖啡续命| 创造学习分享 👨‍💻 对生产力工具，LLM 人工智能感兴趣 🏦美股| 数字货币，构建被动收入。来了就点个关注 👋

[Liko @liko2049]

#分享 推特真的是个被严重低估的内容平台！

最近发现大家都在疯狂挖掘各种AI工具，但推特搜索这个神器居然被忽略了（高级搜索/advance search）；正好看到网页版本的Twitter 右边的功能基本属于没有怎么用还占位的位置可以利用起来。

所以直接写了一个 随机漫步 中发现高价值推文的chrome 插件，专门用来快速挖掘推特用户的历史宝藏内容

用了一段时间感觉挖掘了很多好东西，值得分享出来～ 插件地址在评论区

[Liko @liko2049]

ShipSec Studio cross-references scan output with runtime context and asset tags to surface exactly those.

https://t.co/SP8vUOJFAK

[Liko @liko2049]

The median software dependency is now 278 days out of date.

That's not a stat about negligent teams. It's a stat about the impossible math of modern AppSec.

Datadog scanned tens of thousands of organizations for their 2026 DevSecOps report:

[Liko @liko2049]

The fix isn't scanning more. It's scanning with context:

- Which 278-day-old deps actually execute in your production traffic?
- Which have active exploits?
- Which have a patch with no breaking changes?

Those 3 questions cut your risk list from hundreds to single digits.

[Liko @liko2049]

ShipSec Studio 支持 AI workflow 配置扫描，帮你发现这类 MCP 安全盲区。开源，Apache 2.0。

https://t.co/cbkYdpRwSx

[Liko @liko2049]

你的团队引入了多少个 MCP server？

大多数人的诚实答案：不知道。

开发者在本地或测试环境悄悄跑起来的 MCP 实例，完全在安全治理之外——OWASP 把这个问题单独列入 MCP Top 10，编号 MCP09：Shadow MCP Servers。

[Liko @liko2049]

你现在能做的事：
→ 列出你在用的所有 MCP server
→ 把它们跑在隔离的 sandbox 里
→ 把 MCP 配置当作不可信输入来处理
→ 加审计日志，你需要能回放它做了什么

AI 工具的攻击面扩展速度，比你的安全团队审计速度快得多。

[Liko @liko2049]

This is a supply chain event, not a single CVE.

ShipSec Studio scans AI workflow configs for this class of issue - version pinning, input validation gaps, shadow service detection.

https://t.co/qZspUl0e3J

[Liko @liko2049]

Researchers found a design flaw in Anthropic's MCP SDK that enables RCE.

Not in one project. In every project that imported the SDK.

7,000+ publicly accessible servers. 150M downloads. 11 CVEs.

[Liko @liko2049]

If you're running any MCP-enabled tool in prod right now:
- Block public IP access to MCP services
- Run MCP servers in an isolated sandbox
- Treat external MCP configs as untrusted input
- Audit your installs - shadow MCP servers are real (OWASP MCP Top 10 #MCP09)

[Liko @liko2049]

VASO launched today - @simonroses open-source agentic security scanner. Good to see more tools here. ShipSec Studio already does this: Apache 2.0, 60+ tools (Nuclei, Trivy, Prowler), https://t.co/dEbvmqqjXj durability. 247 findings → 3 actionable. https://t.co/ctuTV3TLXA

[Liko @liko2049]

安全扫描器247个findings你会怎么做？大多数工程师的真实答案：关掉面板继续写代码。不是懒，是244条根本不是真实风险。我们做的事很简单：把Jira、Git历史、RBAC、云标签和扫描结果交叉比对，筛出3条。247→3，噪音砍98.8%。这才是安全自动化该做的事。开源：https://t.co/xn1CWGo33Q

[Junyang Lin @JustinLin610]

https://t.co/mgVhhZVTKg

[Liko @liko2049]

@altryne @TwemexApp You may actually try DeepTweet, have better features.https://t.co/oJnTN9xJzf

[Ivan Zhao @ivanhzhao]

https://t.co/fxHYR6S29D

[Andrej Karpathy @karpathy]

https://t.co/Lb6T42n5jl