Jackie

a student love cryptocurrency, privacy, and open source.

[Tesla @Tesla]

POV you’re a flying car

[International Cyber Digest @IntCyberDigest]

‼️ Attackers are scanning the whole internet for Linux servers exposed to a critical 9.8 kernel flaw, Marcus Hutchins says.

They found 2.1M servers that accept it.

Ubuntu still has no patch.

The bug, CVE-2026-98432, is a race condition in the code that handles incoming IPv4 TCP connections. It can let a remote attacker run commands as root during the handshake.

[人民日報 People's Daily @PDChinese]

【中國秋糧豐收已成定局】農業農村部4日發布消息，2026年秋糧面積預計穩中略增，目前收穫過九成，豐收已成定局。2026年夏糧產量3014.9億斤，首次突破3000億斤，創歷史新高。早稻產量565.8億斤，連續6年穩定在560億斤以上。全年糧食產量有望連續3年保持在1.4萬億斤以上。

[🇨🇳XuZhenqing徐祯卿 @XueJia24682]

✨🇨🇳This is Chengdu — absolutely stunning!

China is PROOF that Communism WORKS!

[Bitcoin Archive @BitcoinArchive]

ANOTHER 2011 BITCOIN WALLET AWAKENS!

8.18 BTC just moved after 15 years.

Original cost: $470
Current value: $660,000

🫡 @TimechainIndex

[CyberSatoshi 𓆙 @XBToshi]

CZ wanted to build a borderless financial empire.

Instead, Binance managed to get squeezed, fined, or robbed by three of the most aggressive state actors on earth.

- China: kicked them out to protect capital controls.
- The US: DOJ hit them with a $4.3B settlement to enforce its regulatory reach.
- North Korea: Lazarus Group reportedly stole $6.5B to bankroll its missile ambitions.

Three superpowers.
Three different business models.
One very expensive lesson.

China: No headquarters here.
DOJ: $4.3B, please.
Lazarus: Thanks for the liquidity.

Turns out, when you run the world's largest offshore crypto liquidity pool, every major power sees you differently:

China sees a threat to capital controls.
Washington sees a regulatory piggy bank.
Pyongyang sees an unguarded source of foreign reserves.

The real cost of running a borderless financial empire isn't server infrastructure. It's having no sovereignty when nation-states decide you're in their jurisdiction, their crosshairs, or their wallet.

The trifecta of offshore crypto exchange risk:

Sovereign exclusion.
DOJ monitors embedded in your internal Slack.
North Korean APTs treating your hot wallets like an ATM.

CZ wanted borderless finance.
He got borderless state-level extraction.

Turns out, capital can move across borders. State power doesn't need permission.

[The Hacker News @TheHackersNews]

‼️ ALERT - Ubuntu releases "test patches" for a critical Linux TCP RCE (CVSS 9.8) vulnerability.

Want the fix now? You'll have to enable Ubuntu's opt-in testing channel. No date for regular updates.

Red Hat? Already patched RHEL 8, 9 and 10.

And disabling MPTCP? Not enough. The bug is in IPv4 TCP.

Details ↓ https://t.co/96wcyt4Qkx

[CZ 🔶 BNB @cz_binance]

Users vote with their money. 🙏

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: A flaw in APT, the tool that installs software on Debian Linux, lets an attacker on the network tamper with a package after it passes verification and run code as root.

The bug, CVE-2026-109518, sits in resumed HTTP downloads. APT can merge two different downloads when a redirect gives them the same address, and a man-in-the-middle can then alter the file after its check.

Debian fixed it in apt 3.0.4, shipped to Debian 13 security updates on 4 November. Users should upgrade now.

Per Debian's changelog, the fix is four words long. "Open target files exclusively."

[Ubuntu @ubuntu]

Fixes are available for CVE-2026-109518, a High severity vulnerability in APT, the package manager used in Debian, Ubuntu, and derivative Linux distributions. The CVE has a CVSS 4.0 score of 7.7.

Remediation details are available on our blog.

https://t.co/x3q5jIeD4J

[Jackie @PyXMR2025]

@CoinDesk @cz_binance @mikelaujr 银行可以被黑，但他们控制着中心化的钱，除非内部高层有内鬼否则这笔钱会被秘密处理掉，黑客获得不了任何利润，他们的攻击方向大多数机密信息和客户资料

[CoinDesk @CoinDesk]

🚨 LIVE: @cz_binance on crypto’s biggest-ever hack. On CoinDesk with @mikelaujr.

https://t.co/8trQH8BJYJ

[goldtooth.exe @0xGoldTooth]

Holy sh*t. Claude Code just found a hidden chip inside my Chinese power bank from Guangzhou. Every time I charged my iPhone, it quietly copied the whole phone…

It also read our saved Wi-Fi password off my iPhone, got onto our home network and sent everything to a server.

I bought it for $19 at an airport kiosk there 3 weeks ago. No brand, 30,000 mAh on the label, and it felt heavy.

The first time I plugged in, the screen asked "Trust This Computer?". I tapped Trust without thinking and went on with my day. That one tap gave it access to everything.

This morning I finally set up Claude Code to warn me when any device starts reading my files. An hour later, 10 seconds into charging, the screen filled with yellow warnings, then red ones: data was moving when it should only be charging.

I asked Claude Code what was going on. My phone saw the power bank as a small computer with 64 GB of storage and its own internet connection.

A USB cable has wires for power and wires for data, and a normal charger only uses the power ones. This one used both, and it had already copied all of this:

→ /device → IMEI and serial number
→ /contacts → 1,206 numbers
→ /apps → every app I have, including my 2 bank apps
→ /photos → 3,912 pictures, my passport among them
→ /wifi → our network name and its key
→ /wife's iPhone → her photos too, she charged from it twice and tapped Trust too

Each time we plugged in, it used that key to get online and send out the new files:

sends to → 47.***.***.12
uploads → 19 in 3 weeks
last one → last night at 2:14, while we slept

I pulled the cable right away. Then Claude Code blocked that address on our router and walked me through changing the Wi-Fi password and the logins for my bank apps.

I had it opened at a repair shop, and what was inside is in the first comment. A 30-second check for your own is in the second one. Save this and test every power bank in your house today.

[Jackie @PyXMR2025]

@TheHackersNews a bad php day

[The Hacker News @TheHackersNews]

‼️ A new Linux APT flaw in Debian and Ubuntu could let MitM attackers swap already-verified packages and execute code as root.

Tracked as CVE-2026-109518, it affects default Debian 12+ and Ubuntu 22.04+ setups.

Patches are rolling out.

Details ↓ https://t.co/Rso4YkYqwa

[Jameson Lopp @lopp]

Oh look, it's that time of the day again.
https://t.co/EbjdpHObJT

[人民日報 People's Daily @PDChinese]

【江西會昌富硒水稻豐收】近日，江西省贛州市會昌縣小密鄉蓮塘村富硒水稻基地稻穗金黃，田疇如畫，深秋田園迎來豐收。

[Jameson Lopp @lopp]

Red Team screwed us, let's give Blue Team a shot.
Blue Team screwed us, let's give Red Team a shot.
Red Team screwed us, let's give Blue Team a shot.
Blue Team screwed us, let's give Red Team a shot.

Insanity: doing the same thing over and over and expecting a different result.

[Jackie @PyXMR2025]

@OneKeyCN 这个片子不是yishi用grok生成的吗

[OneKey 华语 @OneKeyCN]

光至，形现。
11 月 9 日 16:00（GMT+8）。
大的要来。