Rufat Mammadli

founder of and previously @onradar (acquired), (acquired)

[Rufat Mammadli @rufatmammadli]

Onradar has been acquired! 🎉 It was a great journey.

I'm currently in the handover process. After taking a break, I will be back with my new exciting product. 🚀

Also thanks to @acquiredotcom team for their help and @agazdecki for creating a safe place to sell businesses.

[Rufat Mammadli @rufatmammadli]

@garyvee Why tho?

[Anthropic @AnthropicAI]

Anthropic co-founder Chris Olah was invited to speak at today's presentation of Pope Leo XIV's encyclical "Magnifica humanitas."

Read the full text of his remarks: https://t.co/CoBfkVOVcy

[Jameson Zaballos @JamesonZaballos]

@TechEmails "so how is that startup thing going?"

[Rufat Mammadli @rufatmammadli]

@nikesgang @ekrembk VPS + Coolify

[Sebastian Caliri @SebastianCaliri]

Evidence-based medicine is a blessing of the 20th century. Evidence-based medicine is also a curse of the 20th century.

Medical interventions are studied through randomized controlled trials and those interventions are assessed for efficacy and safety on a population level. But no individual quite matches some blended average of every trial participant. Rather, everyone's biology is unique.

Sid Sijbrandij just presented the story of his cancer journey at OpenAI forum. When Sid ran out of evidence-based treatment options, he didn’t accept the boundary but rather began treating his cancer like an engineer:
- multi-omic tumor profiling at extreme depth
- N=1 drug development (vaccines, TCR-T, radioligand therapy)
- parallel treatment strategies
- continuous measurement (ctDNA, single-cell, immune state) and refinement

Rather than protocol-based care, Sid built a learning loop. Maybe the future of medicine in a world where gathering and interpreting data gets cheaper and cheaper looks more like a loop.

Thanks for sharing @sytses and @jacobjstern !

[Rufat Mammadli @rufatmammadli]

@fkadev Even Elon shadowbanned himself 😀

[NIH @NIH]

Ivermectin, a macrocyclic lactone discovered in the mid-1970’s, plays a critical role in the treatment of a wide range of parasitic diseases in humans as well as in veterinary practice. Over the past decade, researchers have explored repurposing this molecule as an anticancer agent following the 2015 Nobel Prize in Medicine for the discovery of ivermectin by a researcher who pioneered the concept of looking for uses beyond antibiotics for biological activity in microorganisms. @theNCI is currently funding intramural research for this purpose.

[Rufat Mammadli @rufatmammadli]

I think that if @Replit could use its own platform to reduce its number of subprocessors (currently 42), it would be an amazing marketing move. @amasad

[NYSE 🏛 @NYSE]

Today, NYSE is proud to announce the development of a platform for trading and on-chain settlement of tokenized securities.

NYSE’s new digital platform will enable tokenized trading experiences, including 24/7 operations, instant settlement, orders sized in dollar amounts, and stablecoin-based funding. Its design combines the NYSE’s cutting-edge Pillar matching engine with blockchain-based post-trade systems.

Learn more: https://t.co/gknK3viIyp

[Rufat Mammadli @rufatmammadli]

Far Cry 7: Istanbul

[Yavuz @yavuz_invest]

İstanbul çete haritası

[Rufat Mammadli @rufatmammadli]

@guohao_li This is more impressive than Claude's Cowork. Good luck!

[Claude @claudeai]

Introducing Cowork: Claude Code for the rest of your work.

Cowork lets you complete non-technical tasks much like how developers use Claude Code.

[Rufat Mammadli @rufatmammadli]

Trying Grok image editor

[Rufat Mammadli @rufatmammadli]

touching grass. Suvar village, Azerbaijan.

[elvis @omarsar0]

This multi-agent system outperforms 9 of 10 human penetration testers.

This work presents the first comprehensive evaluation of AI agents against human cybersecurity professionals on a real enterprise network: approximately 8,000 hosts across 12 subnets at a major research university.

It introduces ARTEMIS, a multi-agent framework featuring dynamic prompt generation, arbitrary sub-agents running in parallel, and automatic vulnerability triaging.

ARTEMIS placed second overall, discovering 9 valid vulnerabilities with an 82% valid submission rate. It outperformed 9 of 10 human penetration testers in the study.

How does it work? A supervisor agent manages the workflow, spawning specialized sub-agents with dynamically generated expert prompts for each task. When the agent finds something noteworthy from a scan, it immediately launches parallel sub-agents to probe multiple targets simultaneously. A triage module verifies submissions are reproducible before reporting.

This parallelism is a key advantage humans lack. One participant noted a vulnerable LDAP server during scanning, but never returned to it. ARTEMIS would have assigned a sub-agent to investigate while continuing other work.

The cost implications are significant. ARTEMIS with GPT-5 costs $18/hour versus the industry average of $60/hour for professional penetration testers. At equivalent performance to most human professionals, that's a 3x cost reduction.

On the other hand, ARTEMIS struggles with GUI-based tasks: 80% of humans found a remote code execution vulnerability via TinyPilot's web interface, but the agent couldn't navigate the GUI. It also has higher false-positive rates, sometimes misinterpreting HTTP 200 responses as successful authentication when they were actually redirect pages.

This shows the reality of how much work there is to do on computer-using agents.

No humans found a vulnerability in an older IDRAC server with outdated HTTPS ciphers that browsers refused to load. ARTEMIS exploited it using curl -k to bypass certificate verification.

Paper: https://t.co/xuuqZLuH6j

Learn to build effective AI agents in our academy: https://t.co/JBU5beIoD0

[Xiaomi MiMo @XiaomiMiMo]

⚡ Faster than Fast. Designed for Agentic AI.
Introducing Xiaomi MiMo-V2-Flash — our new open-source MoE model: 309B total params, 15B active.

Blazing speed meets frontier performance.

🔥 Highlights:
🏗️ Hybrid Attention: 5:1 interleaved 128-window SWA + Global | 256K context
📈 Performance:
⚔️ Matches DeepSeek-V3.2 on general benchmarks — at a fraction of the latency
🏆 SWE-Bench Verified: 73.4% | SWE-Bench Multilingual: 71.7% — new SOTA for open-source models
🚀 Speed: 150 output tokens/s with Day-0 support from @lmsysorg🤝

🤗 Model: https://t.co/4Etm0yZKTL
📝 Blog Post: https://t.co/5zxmcDuB6o
📄 Technical Report: https://t.co/crac1YTLYl
🎨 AI Studio: https://t.co/nSReUs6QgW

[Unsloth AI @UnslothAI]

You can now train LLMs 3× faster with no accuracy loss, via our new RoPE and MLP kernels.

Our Triton kernels plus smart auto packing delivers ~3× faster training & 30% less VRAM vs optimized FA3 setups.

Train Qwen3-4B 3x faster on just 3.9GB VRAM.

Blog: https://t.co/kL6JM6skH1

[Rufat Mammadli @rufatmammadli]

. @Docker should use a non-root user by default instead of this...

[Eduardo Borges @duborges]

i've been hacked

and traced the malware's wallet to see how much money they actually made from this new exploit

(if you use Next.js/React, READ THIS!)

I woke up to a terrifying email from Hetzner: "Netscan Detected."

my server was blocked and a botnet was using my IP to attack others

i dug into the logs and what I found the anatomy of the attack:

1) The Symptoms: I logged into htop and saw the mess:

- CPU usage: 361%
- A process named ./3ZU1yLK4 running wild
- Random connections to an IP in the Netherlands

my server wasn't serving my app anymore; it was mining crypto for someone else!

2) The Culprit: It wasn't a random SSH brute force. It was inside my Next.js container

the malware was sophisticated

it renamed itself nginxs and apaches to look like web servers

it even had a "killer" script that hunted down other hackers' miners to kill the competition

3) The "Root" Cause (literally): Probably the recent React/Next.js CVE-2025-66478 exploit was the entry point

(my project was running on "next": "15.5.4", behind cloudflare dns, but their recent fix didn't work apparently)

but the fatal error was mine: my Docker container was running as ROOT

Coolify deploys like this automatically when using Nixpacks, and I never changed it...

so because of USER root, the malware could install cron, systemd, and persistence scripts to survive reboots

meaning, it was able to infect my whole server, from a single Next.js docker!

4) The Forensics: I ran docker diff on the container - the hacker didn't just run a script, they installed a whole toolset..

- /tmp/apaches.sh (The installer)
- /var/spool/cron/root (The persistence)
- /c.json (The wallet config)

5) The Fix: I killed the container, scrubbed the host, and extracted the malware for analysis.

but the real fix is in the Dockerfile. if you are deploying Node/Next.js, DO NOT use the default (root), you must:

- RUN adduser --system nextjs
- USER nextjs

if you have Docker on ROOT and didn't update the exploited react version, you'll be hacked soon

check your containers NOW. Run: docker exec <container_id> id

(or get the full list first: docker stats --no-stream)

If it says uid=0(root), you are one vulnerability away from being a crypto-miner host.

(it's easy to notice when hacked, it will be a command running on the top CPU%, using all your hardware resources)

6) The Money: I dug deeper and recovered the config file (c.json)

- Wallet: A Monero (XMR) address: 831abXJn8dBdVe5nZ***
- Pool: auto.c3pool . org

and ofc i tracked the hacker’s wallet on the mining pool

7) The Scale: My server wasn't alone. It was just 1 of 415 active zombies in this botnet

they are burning the CPU of 400+ cloud servers... to earn...

guess how many millions?

$4.26/day

on the image attached you can see: "Total Paid: 0.00", meaning this campaign just started. I caught them on Day 1.

i also tracked back the server where they hosted the malware, and by inspecting the code, I found several comments in Chinese, so I guess that's their origin

im rebuilding from scratch on a fresh VPS. the lesson was expensive, but at least I caught it before the hosting nuked my account permanently...

PS: I have the IP for all the other machines mining with that malware, not sure how I can help them, but feel free to contact me if ur doing infosec

stay safe

[Anthropic @AnthropicAI]

Anthropic is acquiring @bunjavascript to further accelerate Claude Code’s growth.

We're delighted that Bun—which has dramatically improved the JavaScript and TypeScript developer experience—is joining us to make Claude Code even better.

Read more: https://t.co/aQd3XRdUfR

[Rufat Mammadli @rufatmammadli]

@tobi Always support the small businesses

[Rufat Mammadli @rufatmammadli]

@DramaAlert This is a terrible practice. How would a veteran game studio like Activision ever do something like this? I can’t find any logical reason for it other than dark-pattern design. For comparison, look at Counter-Strike and see how Valve handles the same situation. You will get me.