Daniel Satragno

To tweet or not to tweet. That is the topic.

[Raunak Yadush @raunak_yadush]

Windows 11 has been secretly running a keylogger in the background

this whole time

and sending every keystroke to Microsoft servers.
Here's the fix they don't want you to know about

Win+R → regedit → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\TIPC → Double click "Enabled" → Set value to 0 → Restart PC

Stop Microsoft from reading every word you type in Valorant chat, Discord, and Chrome.

[Daniel Satragno @lubricante]

Una ayudita para los creadores de futuro
https://t.co/suBa67AkHJ

[BowTiedMara @BowTiedMara]

Peter Thiel bought land in Maldonado (Uruguay 🇺🇾) for US$10 MILLION

Tech entrepreneur Peter Thiel acquired five plots of land in Fasano Las Piedras, Maldonado, for approximately US$10 million. He is building a high-end residence there with robust privacy and security measures.

The house will feature reinforced concrete structures, five bedrooms, cold storage, and contingency plans. Thiel, co-founder of PayPal, also reportedly purchased a home in Buenos Aires for US$12 million.

[Too many ways to d*e @waysxmany]

That sudden realization that the consequence of your actions will lead you to spending the rest of your life in prison.

[VECERT Analyzer @VECERTRadar]

🚨 CYBER INTELLIGENCE ALERT: GOVERNMENT DOXXING - URUGUAY 🇺🇾

⚠️ CRITICAL THREAT: SALE OF ACCESS TO STATE DATABASES AND LEAK OF YOUR DNIC AND YOUR IDENTITY (TuID)

[STATUS: UNDER INVESTIGATION / THREAT ACTOR]

The threat actor known as "lapampaleaks" has announced on clandestine networks and the Spear Forum the activation of a cyber intelligence and people reporting service specifically designed to track, profile, and exfiltrate private data of any Uruguayan citizen. As a technical demonstration, the attacker exposed the detailed identity dossiers of three high-ranking political and institutional figures in Uruguay, blaming the breach on security vulnerabilities at the Ministry of the Interior and the Agency for Electronic Government and the Information and Knowledge Society (AGESIC).

👤 Actor: lapampaleaks

🎯 National Infrastructure Compromised:

Databases and reports from the National Directorate of State Intelligence (DNIC).

Integrated records from the Ceibal educational and connectivity platform.

Massive extraction (scraping) of data from Uruguay's official sovereign digital identity system, TuID.

Persistent active access within state networks.

📊 ANALYSIS OF TECHNICAL CAPABILITIES (MONITORING SYSTEM)

Visual evidence demonstrates that the actor does not possess a simple static text dump, but rather an interactive web-based intelligence query tool (Cyber Intelligence Tool with FastAPI) that consumes structured state data:

Relationship and Kinship Mapping: The developed backend includes specific endpoints such as /family and /familypro (Get Family Pro), allowing buyers to automatically track the target's entire family tree, romantic partners, children, and business associates.

Exposed Sensitive Information Fields:

Full names, photographs of official identification documents, private phone numbers, and personal email addresses (e.g., Gmail, Hotmail).

Financial credit scoring data, bank accounts, and financial institutions (e.g., Scotiabank, Itaú), along with tax debt history.

Precise geographical details: Department, tax address, and residential geolocation data.

Political Doxxing as Proof: To validate the authenticity of the compromised system access, the threat actor published confidential intelligence dossiers belonging to the former President of the Republic.

🔍 STRATEGIC INTELLIGENCE NOTE

[VECERT ANALYSIS]: This incident represents a critical breach in the digital identity trust chain within Uruguay. By compromising or exfiltrating data from core systems—such as TuID (which citizens use to authenticate themselves with banks, government ministries, and for notarial procedures)—the attackers have not only violated privacy but have also enabled an ecosystem ripe for large-scale financial fraud, SIM swapping attacks, and identity theft for the purpose of opening fraudulent accounts. The claim of possessing "active access within state entities" suggests that the group may maintain persistence within internal government networks through compromised credentials or backdoors (WebShells) that have gone undetected by perimeter security teams.

🛡️ URGENT TECHNICAL MITIGATIONS AND RECOMMENDATIONS

🛑 Endpoint Blocking and Invalidation: CERTuy and AGESIC infrastructure teams are urged to trace anomalous requests originating from local environments or APIs that match the exposed FastAPI structure (`/familiares`) in order to identify the source server and take it offline.

🔒 Comprehensive Audit of the TuID System: Conduct an in-depth review of data exfiltration logs and batch requests on TuID and Ceibal servers to contain the data leak and revoke any compromised access tokens.

⚠️ Stricter Identity Verification: Banking and telecommunications entities in Uruguay must cease relying on static data (such as ID numbers, family members' names, or addresses) as valid factors for verifying a customer's identity during remote or telephone-based transactions.

⚡ MONITORING AND ASSESSMENT

🌐 Intelligence System: https://t.co/wk9bZJ2Nli

🛡️ Quickly assess your website's security at: https://t.co/YnDw1QjN9c

#CyberSecurity #Uruguay #Doxxing #TuID #Ceibal #DNIC #AGESIC #SpearForum #ThreatIntelligence #CiberAlerta #VECERT #Infosec #IdentityTheft #PrivacyLeak

[Brian Roemmele @BrianRoemmele]

Terrence McKenna decades ago…

[Uncover AI @uncover_ai]

The same guy who tried to warn us about AI taking our jobs in 2018
just confessed the terrifying truth:

[MERICA MEMED @Mericamemed]

We're now just tamogotich for AI.

[Dr. Clown, PhD @DrClownPhD]

Wait to see her final form! 😂

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: An AI found a Linux kernel zero-day that roots every distribution since 2017. The exploit fits in 732 bytes of Python. Patch your kernel ASAP.

The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed today by Theori. It has been sitting quietly in the Linux kernel for nine years.

Most Linux privilege-escalation bugs are picky. They need a precise timing window (a "race"), or specific kernel addresses leaked from somewhere, or careful tuning per distribution. Copy Fail needs none of that. It is a straight-line logic mistake that works on the first try, every time, on every mainstream Linux box.

The attacker just needs a normal user account on the machine. From there, the script asks the kernel to do some encryption work, abuses how that work is wired up, and ends up writing 4 bytes into a memory area called the "page cache" (Linux's high-speed copy of files in RAM). Those 4 bytes can be aimed at any program the system trusts, like /usr/bin/su, the shortcut to becoming root.

Result: the next time anyone runs that program, it lets the attacker in as root.

What should worry most: the corruption never touches the file on disk. It only exists in Linux's in-memory copy of that file. If you imaged the hard drive afterwards, the on-disk file would match the official package hash exactly. Reboot the machine, or just put it under memory pressure (any normal system load that needs the RAM), and the cached copy reloads fresh from disk.

Containers do not help either. The page cache is shared across the whole host, so a process inside a container can use this bug to compromise the underlying server and reach into other tenants.

The original sin was a 2017 "in-place optimization" in a kernel crypto module called algif_aead. It was meant to make encryption slightly faster. The change broke a critical safety assumption, and nobody noticed for nine years. That bug then rode every kernel update from 2017 to today.

This vulnerability affects the following:
🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root
🔴 Kubernetes and container clusters: one compromised pod escapes to the host
🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner
🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root

Timeline:
🔴 March 23, 2026: reported to the Linux kernel security team
🔴 April 1: patch committed to mainline (commit a664bf3d603d)
🔴 April 22: CVE assigned
🔴 April 29: public disclosure

Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

For environments that run untrusted code (containers, sandboxes, CI runners), block access to the kernel's AF_ALG crypto interface entirely, even after patching. Almost nothing legitimate needs it, and blocking it shuts the door on this whole class of bug...

[Patrick Sullivan Jr. @realPatrickJr]

This is extremely concerning!

A new study found that the sweetener used in millions of Americans' daily snacks can damage human brain cells within hours of a single serving.

The FDA approved it decades ago, but the new data is worrying: (1/15)

[Anthropic @AnthropicAI]

Mythos Preview has already found thousands of high-severity vulnerabilities—including some in every major operating system and web browser.

[Daniel Satragno @lubricante]

@CronicasDelEste Está bueno que gane notoriedad (con la denuncia).
La gente busca reafirmar su interpretación colectiva de la realidad al juzgar msjes masivos como éste.
El mensaje de que "cuestionar lo establecido es de salame", denota el tipo de adoctrinamiento que no es percibido como tal.

[Daniel Satragno @lubricante]

@iamspritz former Eastern Strip

[Interstellar @InterstellarUAP]

🚨 Matt Gaetz : “There is an ALIEN Hybrid Breeding Program”

Rep. Matt Gaetz on what he was told in a classified congressional briefing by a uniformed U.S. Army officer:

“I had someone come and brief me who was in a military uniform, worked for the United States Army, that was briefing me on the locations of hybrid breeding programs where captured aliens were breeding with humans to create some hybrid race that could engage in intergalactic communication. An actual uniformed member of the United States Army briefed me on that.”

Gaetz added that recovered craft crashes examined by the CIA contained “non-human biologics” with no identifiable human source.

This is straight from a sitting Congressman under oath-level clearance. No speculation — just what he says he was officially briefed.

What do you make of it? 👇

---

[Daniel Satragno @lubricante]

@AGONbyAOC Felices pascuas @AGONbyAOC !!

[Daniel Satragno @lubricante]

@TheFigen_ claro, todos los días tomamos mate en Uruguay

[Daniel Satragno @lubricante]

@DJIGlobal La Rambla de Montevideo

[DJI @DJIGlobal]

Giveaway time! Here's your chance to win the DJI Avata360 (DJI RC2) — DJI's first panoramic drone, redefining aerial creativity with flagship-level 8K HDR imaging.

How to enter:
1. Follow @DJIGlobal
2. Like and share this post
3. Bonus Chance: Comment below — what's the one place you'd love to fly through and capture in full 360°?
· Time period: 2026/3/27 - 2026/4/27.

This giveaway is not affiliated with or endorsed by X. One winner will be selected at random through a third‑party platform. Good luck!

Video created by: aleixalbet