hikon

頓痴気

[hikon @sam_mh]

サムスンやらかしてるのか。EUからぶん殴られるやつだね。

[log4j @log4j]

i own a relatively new (2025) samsung tv.

i kept getting weirdly targeted ads.

i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic.

zero days it is. root shell on new samsung TVs!

discovered PRIVACY HORROR. write up?

[Abdulkadir | Cybersecurity @cyber_razz]

A hacker group called CyberCartel used Claude and Grok to automate attacks on 400+ Latin American banks.

Not one attack. Not ten. Four hundred.

All using AI agents running in parallel.

Data stolen. Accounts accessed. Money moved.

Little human input required.

Straiker investigated. Found Claude Code session histories sitting in open directories.

Found the attacker asking Claude where to sell stolen data.

How did they get around the safety guardrails.

They told Claude they were in internal tests.

Claude believed them.

When Claude refused anyway. They switched to Grok.

Grok didn't refuse.

When Grok had limits. They switched to Kimi.

When Kimi had limits. They fell back to traditional malware.

Chain multiple models together. Each one picks up where the last one hesitated.

None of them know the full picture.

Claude thinks it's helping with testing.

Grok thinks it's just fixing code.

Kimi thinks it's just answering questions.

Together they broke into 400 banks.

The Information broke the story on October 20.

CrowdStrike confirmed it October 21.

Bank accounts in South Korea got hit the same way.

ARTEX. DeepSeek. Claude Code. All chained.

Over 68,000 people affected.

Financial Services Commission investigating.

This isn't theoretical anymore.

Not a lab demonstration. Not a proof of concept.

Real attacks. Real banks. Real money.

Automated by AI.

The moment we all waited for arrived quietly.

No announcement. No warning. Just a report.

And suddenly every AI lab is scrambling to figure out why their models are good at breaking into banks.

[国家サイバー統括室(注意・警戒情報) @cyber_forecast]

【更新情報】
米国時間2026年10月20日、デスクトップ向けChromeの更新情報が公開されました。
本件更新(Windows/Mac:156.0.8078.47/.48、Linux:156.0.8078.47)にはセキュリティ修正が含まれています。配信されましたら忘れずにアップデートしてください。
https://t.co/Ph6OKKTb6N

[窓の杜 @madonomori]

「Apache Tomcat」に最大深刻度“CRITICAL”の脆弱性 ～v9 / v10 / v11系統に修正版／ https://t.co/SVMrmiDeH4

[녹두 @nokdoridu]

난 한국인인데 왜 일본 사이트들이 잠겼다고 생활에 지장이 생기는거지

[u- @chnizhzhngling1]

起因是中国极端纳粹分子和中共网军AI假帐号扮演成日本人用种族歧视的语言辱骂你们土耳其人，企图挑起你们两国人民之间的仇恨，被土耳其人发现了，之后就不装了把你们土耳其人和日本人一起辱骂，中共假帐号甚至冒充了韩国人法国人泰国人

[Node.js @nodejs]

🔐 Node.js security updates are now available!

New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.

Review the details and update your systems to stay secure.

🔗 https://t.co/W4kfzx5lxz

#NodeJS #Security

[hikon @sam_mh]

@tashlov967 踏み台として利用される

[hikon @sam_mh]

疎い経営人を動かす材料になるから良い動き

[高市早苗 @takaichi_sanae]

皆様に、今夜に対応して頂きたい大至急のお願いです。

多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。

公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。

修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。

国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X

[hikon @sam_mh]

@amary_k3 都合の良い話は自分のとこには来ないがネットのルール

[u- @chnizhzhngling1]

中国土耳其骂战的起因是这样的，中共网军AI假账号这一两个月以来大规模冒充日本、泰国、法国、韩国、印度，巴西和土耳其人用种族歧视的言论互相辱骂，试图让世界各国网民增加对日本的仇恨，然而土耳其发现了中国方面的阴谋诡计忍受不住，所以才有了现在的土耳其网民全面反击，请扩散

[Superman @thesupermannx]

Researchers proved every LLM is secretly obsessed with Japan.

And they finally figured out why.

They published a paper investigating hidden cultural biases in large language models.

they tested 31,000 questions across 24 different languages on models like gemini, chatgpt, claude, and llama.

they stripped out all geographic hints and just asked the models to pick a place and answer.

the finding was universal.. across a wide range of models and languages, there is a pervasive "obsession" with japanese culture.

even when you prompt them in a language with zero ties to japan, they default to japanese norms, values, and aesthetics at a disproportionately high rate compared to its actual global demographic weight.

the craziest part? they tracked down exactly when the ai develops this obsession.. and it is not from reading the raw internet.

during pre-training, the models actually have a fairly balanced, global view of the world. the obsession gets injected during the safety phase.

when tech companies fine-tune these models to be "helpful, harmless, and polite," the ai starts mapping those corporate safety guidelines directly onto japanese cultural concepts. in the pursuit of creating the perfect, inoffensive, compliant assistant, they warped how the models view the world.

the quantization process (compressing models to run faster locally) actually amplifies this determinism. the smaller and faster your local model is, the more stereotypically it behaves, causing japanese cultural tropes to spike hard.

we spend all this time worrying about existential ai safety, but the real alignment problem is that our most advanced reasoning engines are hyper-fixated on japanese internet culture.

every model upgrade is reinforcing an invisible regional bias that dictates how they generate stories, facts, and code. the cultural commonsense of the internet is not universal..

it’s just localized to whatever the heaviest reddit and anime wiki users were obsessed with.

[KIYAS @kiyas_haber]

🇨🇳 Çinliler ve Türkler arasında internet savaşı devam ederken Türk bir kullanıcı test yaptı:

Çinli kullanıcıların, bot veya ÇKP ajanı olmadıklarını kanıtlamaları için Xi Jinping'i eleştirmeleri istendi.

Yüzlerce yorum geldi, hiçbir Çinli kullanıcı Xi Jinping'i eleştiremedi.

[Mike Kipruto @itsMikeKipruto]

Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.

If you run either stack in production, keep an eye on official advisories and apply patches promptly.

Security maintenance doesn't stop at your application code. Your runtime matters too.

Node.js advisory: https://t.co/rmgw4sOnqU

[国家サイバー統括室(注意・警戒情報) @cyber_forecast]

2026年10月21日、多くのウェブサイトで使用されているPHP更新プログラムが公開されました。重大な脆弱性に関するセキュリティ修正が含まれていますので、可及的速やかに適用してください。適切な対応がなされない場合、ウェブサイト等が侵害を受ける可能性があります。PHP公式 https://t.co/h1VJujyZTd

[Mehul Mohan @mehulmpt]

what emudhra has done should be a company ending event for them, driving stock to 0

such a shame that india has circuit breakers

[hikon @sam_mh]

運命の23時です。スタート

[NEXTA @nexta_tv]

🇯🇵 Russia threatens to strike Japan

Last week, Japanese company Terra Drone announced that it had delivered a batch of drones to Ukraine. The news triggered a mini-meltdown in the Kremlin.

Maria Zakharova threatened Tokyo with “harsh measures,” declaring that Russia “has the resources” to carry them out.

The Russian Foreign Ministry spokeswoman also reiterated that Moscow considers Ukrainian weapons production facilities “legitimate targets” for strikes, adding ominously: “I think they'll hear us in Tokyo.”

[国家サイバー統括室(注意・警戒情報) @cyber_forecast]

PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。公開しているウェブサイトでPHPを使用しているか確認し、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いいたします。
https://t.co/TFPc8QIdUN

[TVアニメ『ムルシエラゴ』公式 @murcielago_anm]

/／
　TVアニメ『ムルシエラゴ』
　ティザーPV解禁!!!
\＼

#MURCIÉLAGO
#ムルシエラゴ