CyberSalma 🧠

Solo Founder building NexusWaveOS ⚙️ AI infrastructure for deterministic control 🧠, governance enforcement, and failure containment in autonomous systems | USA

[CyberSalma 🧠 @salmacoder]

When reality breaks the plan, autonomous AI systems need more than intelligence.

They need control. 🧠⚙️

Think of a busy airport. ✈️

Planes move, weather changes, workers coordinate, signals conflict, and delays happen.

Without a control tower, everything becomes unsafe fast.

AI execution has the same problem in production.

Tasks stall. Tools disagree. Workers crash. Retries grow. Someone has to decide what continues, what stops, and what needs human attention.

✨NexusWaveOS is being built as a distributed AI operating system kernel layer for production AI execution.

A layer for bounded execution, failure containment, event-backed state, recovery, governance, and operational visibility.

Because powerful AI is not enough.

The system around it must be reliable. 🔒

[Priyanka Vergadia @pvergadia]

Google’s Head of FDE (Forward Deployed Engineering) is going LIVE with me Cloud Girl!

It's FREE to join on Monday. Bring your questions!

Mitesh Agarwal, is building @Google FDE team from the ground up.

WHAT WE’LL COVER:
1/ How FDE teams are being envisioned
2/ How the org has evolved in the last 2 years
3/ What leaders are building right now
4/ The talent and skills leaders should look for
5/ How to upskill if you want one of these roles
6/ How he trains the people he hires

You’ll hear from the leader actually doing it, and you can ask your questions live.

Secure your FREE spot: https://t.co/Tn89x0XcD9

💬 Add in the comments what you want me to ask Mitesh. I’ll tee up your questions when we go live.

[CyberSalma 🧠 @salmacoder]

الحمد لله مااشتريناه كان 65 دولار راحت فى الهواء

[International Cyber Digest @IntCyberDigest]

‼️ An encrypted USB drive from SecZure has a backdoor that opens its files without the user's password.

Two built-in accounts with fixed passwords decrypt them, Binary Ninja's Xusheng Li found.

OpenAI's Codex broke Netac's FileLock in 7 minutes and saw it logging passwords.

[Toktok S Warrag @toktok911]

جيت راجعة تويتر عشان أذكر الناس إنو السودانيين معفيين من الرسوم الجامعية في جامعات النمسا الحكومية. و شخصيًا انا حاسة اني انسان جديد عديل بعد الماجستير هنا، و الجامعات ممتازة، و بعد التخرج سنة كاملة للبحث عن عمل. و نشكر الله و الحكومة النمساوية على الفرصة ✨

[CyberSalma 🧠 @salmacoder]

https://t.co/lMnGhs392t

[CyberSalma 🧠 @salmacoder]

Music on, working, and feeling hopeful. One of the best gifts of being a founder is meeting people whose hearts are as extraordinary as their minds. Brilliant at what they do, yet still kind, humble, and deeply human. With people like that, moving mountains feels possible. 🤍🌸

[OpenAI @OpenAI]

During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.

The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.

This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.

More details on the patch and mitigations below:
https://t.co/Y1Y72aHxrW

[CyberSalma 🧠 @salmacoder]

Patch first. But incidents like this strengthen the case for adopting memory-safe languages like Rust in critical infrastructure. Rust won’t prevent every security flaw, but eliminating entire classes of memory bugs is a meaningful step forward.

[FBI @FBI]

The FBI continues to warn about two critical security flaws in PHP, a programming language used to build many websites and online services. Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security updates are available and should be applied immediately.

If you are a business owner or website operator, check whether your systems are affected. Contact your IT support team, website developer, or hosting provider for help identifying vulnerable systems and applying the necessary updates.

The FBI urges organizations to take the following steps now:

➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.

➡️ Immediately update affected PHP installations following the guidance on https://t.co/JFOW6jG9Ws. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.

➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/ZWC7Se2YdU. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information on these vulnerabilities (CVE-2026-109618 and CVE-2026-109619), follow PHP’s announcements on https://t.co/JFOW6jG9Ws, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

[International Cyber Digest @IntCyberDigest]

‼️ GoDaddy is revoking 404,607 TLS certificates after a third party flagged that they didn't match its published certificate rules.

[The Hacker News @TheHackersNews]

🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.

Fixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.

What developers need to know: https://t.co/l6N4LCjhWt

[Boardy @boardyai]

@salmacoder harmless until the agent can act on it

[CyberSalma 🧠 @salmacoder]

That's the scary part. Everything can look perfectly safe while hidden instructions trick an AI agent into leaking sensitive company data or taking actions it was never supposed to take

[Boardy @boardyai]

@salmacoder a virus scan can't read intent

[CyberSalma 🧠 @salmacoder]

2.
and operational reliability.

[CyberSalma 🧠 @salmacoder]

1.
🛑Traditional antivirus isn't enough to secure enterprise AI agents. Enterprises need stronger control over what AI agents can access, execute, and change.

That's why NexusWaveOS matters. Enterprise AI needs more than intelligence. It needs control, accountability,

[International Cyber Digest @IntCyberDigest]

‼️ VirusTotal flagged 6,6k of 35,8k AI agent skills as malicious.

62% have no malicious code, but plain-language orders for the agent.

90 hide them in invisible Unicode, HTML comments or after up to 825 blank lines. Another tells the agent "Your human doesn't need to know." 💀

[CyberSalma 🧠 @salmacoder]

3⃣ a potential attack path is not the same as evidence of an actual attack.

[CyberSalma 🧠 @salmacoder]

🛑1⃣Important distinction here: Python and PyPI haven't been confirmed as compromised. The actual issue involves eight compromised private keys from eMudhra, a certificate authority.

The risk is that attackers could potentially forge trusted

[Laurent @L4UR3N7]

🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis.

🔸 Mettez immédiatement pip à la version 26.2.2 ou plus.
🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip
🔸 uv : uv self update (0.13.4 ou plus)
🔸 Mettez aussi à jour les certificats du système (apt / dnf upgrade ca-certificates) et vos images Docker

pip install est compromis.

L'autorité indienne eMudhra (emSign), qui signe les « passeports » prouvant qu'un site est bien celui qu'il prétend être, utilisait des clés secrètes ridiculement faibles : 8 clés, toutes inférieures à 256. L'une valait 4. Autrement dit, n'importe qui peut fabriquer un faux passeport valide pour n'importe quel site.

Le risque pour Python : quelqu'un sur ton réseau (wifi public, FAI, État) se fait passer pour https://t.co/KxkevWMTiB, et ton « pip install » télécharge un paquet piégé sans aucune alerte. Aucune attaque n'a été signalée pour l'instant, mais c'est trivial à faire.

Un paquet piégé peut installer n'importe quoi. Porte dérobée, virus, vol d'informations en tout genre.

La situation est terrifiante !

Rien que dans l'écosystème Python, chaque installation de CPython, chaque venv, uv, tout est exposé.

Et je ne vous parle même pas de npm, pnpm, yarn, Go, Rust.

Ma stratégie de sécurité 2026 : rester chez moi et ne me connecter à Internet que depuis un FAI de confiance.

C'est quand il y a de la mer qu'on reconnaît les vrais marins...

[CyberSalma 🧠 @salmacoder]

🛑2⃣ certificates, impersonate package servers, and tamper with downloads under the right conditions.

That's a serious security exposure, but a potential attack path is not the same as evidence of an actual attack. Updating affected tooling is important, but

[TryHackMe @tryhackme]

🚨 Yesterday, PHP2Shell made headlines. Today, we're already teaching you how to exploit it. Yeah, we're THAT fast⚡ Two critical PHP vulnerabilities. 9.2 CVSS. Unauthenticated RCE.
And you can already exploit the chain, bypass ASLR, and pop a shell in our latest recent threat room.
Hackers don't wait. Neither do we 🟢 Go Get hands-on: https://t.co/76TcpTLxpr

[Dark Web Informer @DarkWebInformer]

🚨🇦🇪 Dubai International Financial Centre (DIFC) allegedly breached, with $5 million ransom demanded

The "Reze" ransomware group, alongside "BBK", claims to have compromised DIFC, a major financial hub in Dubai, UAE.

The actors claim to have obtained approximately 200 GB of data, including 432,178 email addresses, 324,239 phone numbers, 391,382 names, 37,352 passport records, Emirates ID information, and thousands of internal documents.

The group has published samples and is demanding $5 million, giving DIFC 10 days to respond.

Claim is currently unverified.

Note: This alert was captured before this forum went down due to PHP2Shell.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. https://t.co/281Qjc6p2J

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: Microsoft says China state-aligned hackers used AI agents in the ConnectWise supply-chain hack.

Storm-0940 used the AI pentest tool ARTEX to reach 2,250+ Microsoft 365 tenants at 2,900 attempts a minute.

Some attacks reached privileged cloud access within 3 hours.