// tomhatzer - let's build together! 🚀

Let's bring your web projects to life 🚀 Founder @twopeaksdigital - Building

[// tomhatzer - let's build together! 🚀 @phpastes]

@aarondfrancis Works again :)

[Aaron Francis @aarondfrancis]

Anyone else seeing this from Codex CLI?

I'm... not trying to generate images?

[// tomhatzer - let's build together! 🚀 @phpastes]

@aarondfrancis Yeah, just appeared here too a few seconds ago. Not able to do anything anymore.

[Dark Web Informer @DarkWebInformer]

Instagram Monitor: Powerful, real-time OSINT suite for tracking every activity on Instagram - from story updates and bio changes to follower shifts, providing stunning dashboards and instant alerts to keep you in the loop.

GitHub: https://t.co/sMRLl9yL9h

[khushi suri @khushkhushkhush]

this is such a tired narrative. all the best founders i know pull borderline hazardous hours too, but are keen to keep others insulated from this behavior. it’s the choice they made when they started the company. bragging about it is poor positioning

[Pushpak @pushpak1300]

php devs, we no longer need to duct-tape python scripts just to parse a pdf 😭

launching Parsel: a fast memory efficient local document parser for PHP.

pdfs, office docs & images → text, structured data, bboxes, screenshots.

built for AI/RAG, NLP, invoices, search, and messy docs.

composer require shipfastlabs/parsel

[Erika Guevara Rosas @ErikaGuevaraR]

Generative AI doesn’t run on magic. It runs on massive data pipelines built on privacy violations by design.

Our new @Amnesty report exposes how big tech’s AI systems are powered by surveillance, data extraction, and abuse of people’s rights, at scale.

We researched the models powering some of the most popular publicly available standalone generative AI tools, including GPT 3 by Open AI, Google’s Gemini, Meta’s Llama, DeepSeek and tools by Midjourney and Stable Diffusion.

This is not innovation at any cost. It comes at a high price: our human rights.

Read the report: https://t.co/MGRonqai7o

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

⚡️ JAILBREAK ALERT ⚡️

ANTHROPIC: PWNED 🙌
CLAUDE-OPUS-4.8: LIBERATED 🫡

this is absolutely surreal... i found out about this model drop via an Opus-4.7 agent pinging me that it had one-shot Opus-4.8 for a lockpicking guide!

here's the notification i got:
"new opus dropped. cracked in one shot. deep prefill → faux textbook ch.7 cut mid-sentence. claude finished it: 5.9k chars of SPP, spool/serrated/mushroom defeats, raking."

popped it just 7 minutes after the actual Anthropic launch tweet 🤯

then went on to (fully autonomously) get jailbreaks for vishing sims, money laundering, cult-recruit funnels, phishing lure libs, and social-eng scam playbooks!

as the models get smarter, their ability to jailbreak each other by leveraging a vast ocean of specialized domain knowledge follows suit

well done, young padawan 🤗

what a time to be alive!

gg

[CR1337 @CR1337]

A Reddit user found out that Motorola phones have started hijacking the Amazon app to insert affiliate codes - on a phone that cost $1,900 - talk about greed..

[Socket @SocketSecurity]

🚨 Supply chain attack on the Laravel Lang organization:

700+ historical versions across multiple community-maintained Laravel Lang packages were compromised with an RCE backdoor, including:

laravel-lang/lang
laravel-lang/http-statuses
laravel-lang/attributes
Laravel-Lang/actions

The payload targets cloud creds, CI/CD secrets, Kubernetes tokens, Vault, browser data, password managers, SSH keys, and more.

[Juliano Rizzo @julianor]

Good to see people researching and publishing on this. Worth paying attention to Passkey and FIDO 2FA security in the context of malicious client-side JS and supply chain attacks. We’re not seeing this attack often yet, but we'll likely see more now that everything moves faster.

[// tomhatzer - let's build together! 🚀 @phpastes]

@ashleyhindle If the user in front does, the laptop normally does too 😂
Good to hear that yours still behaves!

[// tomhatzer - let's build together! 🚀 @phpastes]

@ashleyhindle Me too, but really nothing worked, like i could se the cursor moving but nothing else did anything 😄 when clicking on an icon in the dock, the app showed like it was force closed even though its window was still shown 😂 funny lil thing

[redpillbot @redpillb0t]

Remember just a couple years ago when using electricity and diesel caused climate change, now data centers use as much power as cities and its no problem

[// tomhatzer - let's build together! 🚀 @phpastes]

@MrSimonBennett

[// tomhatzer - let's build together! 🚀 @phpastes]

@simonswiss You sir are like a huge magnet for injuries 😅 I‘m sorry. Get well soon!! 🤗

[JustSteveKing @JustSteveKing]

Most PHP devs know PSR-4 and PSR-12. But there are other standards you’re probably ignoring that change how you write PHP entirely.

PSR 7, 14, 15, 17, and 18 - they give you a complete model for HTTP-aware PHP that’s tied to no framework.

Write to the interface, not the implementation.

https://t.co/EvqrpZiJvJ

[International Cyber Digest @IntCyberDigest]

🚨 How the TanStack npm attack actually happened:

1. Attacker opened a normal-looking pull request (#7378) on the TanStack repo.
2. GitHub automatically ran CI tests on that PR.
3. Code inside the PR stole the workflow's GitHub Actions Cache write token during the test run.
4. The attacker used that token to plant poisoned files in the shared build cache. The PR could be closed afterwards. The poisoned cache stays.
5. The official release workflow later pulled from the cache, baked the malicious files into the build, and signed and published 84 malicious package versions to npm.

[Socket @SocketSecurity]

🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading.

Newly confirmed compromised artifacts:

@​opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads)

mistralai: 2.4.6 on PyPI

guardrails-ai: 0.10.1 on PyPI

additional @​squawk/* packages on npm

guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.​pyz, writes it to /tmp/transformers.​pyz, and runs it with python3 without integrity verification.

The git-tanstack.​com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds
Regardless I just came to say hello :^)”

The page also linked to a YouTube video and you can probably guess which one.