Natalino Picone

Computer enthusiast focused on security, digital legacy, crypto, and blockchain. Spend time between family and keyboards; everything else is noise.

[Arpit Bhayani @arpit_bhayani]

Google open-sourced AX, their agentic orchestrator. first impression: it feels like kubernetes for agent executions.

check it out - https://t.co/xVDC0X4B9r

[Officer's Notes @officer_secret]

Urgent security advisory for iOS users!

Install the latest iOS update immediately. Security researchers report that financially motivated attackers are now using a complete, in-the-wild exploit chain that can quietly steal cryptocurrency private keys and mnemonic seed phrases from iPhones.

The reported attack begins when a target is socially engineered into opening a malicious page in Safari. That page is said to abuse a memory-corruption flaw in WebKit / JavaScriptCore to gain arbitrary read/write access from JavaScript, then bypass Pointer Authentication Codes (PAC) to run native code, break out of the WebContent sandbox, and escalate to kernel/root privileges.

With that access, attackers can pull data from the device Keychain and from local crypto wallet apps.

The claimed impact range is iOS 13 through iOS 26.5; that range has not been independently confirmed in full. Until more is known, treat any unpatched device as potentially exposed and update as soon as a newer build is available. Also avoid untrusted links in Safari, especially if you keep wallet keys or seed phrases on the phone.

[bakigul @bakigulai]

Bunu görmeyen var mı?
Dünyanın sonu geldiğinde kullanabileceğimiz bir repo çıkarmışlar.

Survival computer
İnternetsiz çalışan, içinde AI + Wikipedia + haritalar olan tam bağımsız bir bilgisayar sistemi.
- Her şey lokalde çalışıyor (cloud yok, veri gönderme yok)
- Tek komutla kuruluyor
- Tarayıcıdan yönetiliyor
- Aynı ağdaki tüm cihazlardan erişilebiliyor

👉 https://t.co/WiE66Dtha7
Umarım kullanmak zorunda kalmayız....

-----------------
Yapay zeka hakkında güncel kalmak için
👉 https://t.co/igLD9mmWgw

[Elon Musk @elonmusk]

This is the future we shall bring into being

[空言 @__soragoto__]

面试官：既然来面运维岗了，什么 k8s 啥的八股先放一放，让我看看你基础，你 Bash 熟吗?
我：天天用，应该还算熟？
面试官：从最基础的问起吧，讲一下 [] 的语法吧。
我：咦，为什么给这个叫语法？
面试官：不然叫啥？
我：非要说语法好像也没问题，不过 [ 是个命令， ] 是这个命令要求的最后一个参数。
面试官：？？？？？

[Mike McQuaid @MikeMcQuaid]

Today, I’m proud to announce Homebrew 7.0.0.
The most significant changes since 6.0.0 are faster installations, stronger sandboxing, native macOS app, vulnerability checks, advisory database, end of macOS 10.15 support and Intel Macs to Tier 3.

https://t.co/LGnA62Bqd0

[H4x0r.DZ @h4x0r_dz]

CVE-2026-85706 Gitlab Path Traversal
CVSS 10.0 👀👀

[Carmine Paolino @paolino]

I built a Spotify client that's native and fast, no Electron.

Available for Linux, MacOS and Windows.

`yay -S fastpotify` on Arch/Omarchy

I seriously can't stop building.

https://t.co/lUPfRKndom

[Domenico 🐺 @dom_gag_96]

Abbiamo appena pubblicato l'MCP: https://t.co/mOPoGWq6Wi

Ora potete fare domande tipo "quanto ha speso il Comune di Milano nel 2024" o "qual è lo stato di un'opera pubblica dato il suo CUP" interrogando direttamente questi dati, con fonte e metodologia sempre indicate

[jack @jack]

we're launching BUZZ!

a new groupchat platform for teams of people and agents of all sizes, built to reduce our dependency on slack and github. model-agnostic, decentralized, self-sovereign, and open source. 🐝

https://t.co/8IaMVeTQNo

[Rami McCarthy @ramimacisabird]

Here's what AI has to say on the second stage axios payloads:

🧵

[Joe Desimone @dez_]

Analysis of the macho malware used in the Axios supply chain compromise
https://t.co/d0OouEFtUL

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Joe Masilotti @joemasilotti]

Ruby Native is now FREE until you ship to the App Store.

Deploy your Rails business as a native iOS app and share it with up to 100 testers via TestFlight. 100% free.

- Native tabs, buttons, & OAuth
- Push notifications
- No Swift, Xcode, or Mac required

rubynative [dot] com

[Rob Zolkos @robzolkos]

Claude Code can use a .worktreeinclude file in your project root to automatically copy gitignored files (e.g. .env, .env.local, config/secrets.json) when Claude creates a worktree.

[Nav Toor @heynavtoor]

🚨Someone just open sourced a computer that works when the entire internet goes down.

It's called Project N.O.M.A.D.

A self-contained offline survival server with AI, Wikipedia, maps, medical references, and full education courses.

No internet. No cloud. No subscription. It just works.

Here's what's packed inside:

→ A local AI assistant powered by Ollama (works fully offline)
→ All of Wikipedia, downloadable and searchable
→ Offline maps of any region you choose
→ Medical references and survival guides
→ Full Khan Academy courses with progress tracking
→ Encryption and data analysis tools via CyberChef
→ Document upload with semantic search (local RAG)

Here's the wildest part:

A solar panel, a battery, a mini PC, and a WiFi access point. That's it. That's your entire off-grid knowledge station. 15 to 65 watts of power. Works from a cabin, an RV, a sailboat, or a bunker.

Companies sell "prepper drives" with static PDFs for $185. This gives you a full AI brain, an entire encyclopedia, and real courses for free.

One command to install.

100% Open Source. Apache 2.0 License.

[Ryan Naraine @ryanaraine]

Two full iOS exploit kits in one month, deployed via watering holes on public websites, potentially affecting hundreds of millions of devices. Will Apple acknowledge that this no longer fits the "very small number of highly targeted individuals" narrative?

[International Cyber Digest @IntCyberDigest]

🚨‼️ CRITICAL: Ubiquiti UniFi Network Application vulnerabilities were just disclosed

CVE-2026-22557 CVSS 10.0
Remote path traversal vulnerability allowing an attacker to access and manipulate files, leading to account takeover. No authentication required.

CVE-2026-22558 — CVSS 7.7
Authenticated NoSQL Injection allowing privilege escalation.

[International Cyber Digest @IntCyberDigest]

‼️ China's biggest cybersecurity company, Qihoo 360 (461M users), just leaked their own wildcard SSL private key inside the public installer for their new AI assistant "360 Security Claw."

The private key for *.myclaw.360.cn was bundled directly in the download package under /namiclaw/components/OpenClaw/openclaw.7z/credentials. The cert is valid until April 2027.

Attackers can now impersonate their servers, intercept user traffic, and forge login pages.

Fun fact: the founder promised the product would "never leak passwords."

[Vali Neagu @AmbsdOP]

YES! Someone reverse-engineered Apple's Neural Engine and trained a neural network on it.

Apple never allowed this. ANE is inference-only. No public API, no docs.

They cracked it open anyway.

Why it matters:

• M4 ANE = 6.6 TFLOPS/W vs 0.08 for an A100 (80× more efficient)
• "38 TOPS" is a lie - real throughput is 19 TFLOPS FP16
• Your Mac mini has this chip sitting mostly idle

Translation: local AI inference that's faster AND uses almost no power.

Still early research but the door is now open.

→ https://t.co/qPwddSyV3f

#AI #MachineLearning #AppleSilicon #LocalAI #OpenSource #ANE #CoreML #AppleSilicon #NPU #KCORES