Instagram story viewer> @anirockshady.tech> Posts
Anirban(@anirockshady.tech)'s profile avatar HD Profile

Anirban

@anirockshady.tech

425
followers
121
following
Aerospace by training | ML/AI by trade
AI fitness app: @therox.app
Food waste tracking: @vivashelf
Claude Code and Creatine 💪🏾
Links and YouTube:
POSTS STORIES REELS
Oh Hello, Część, Namaste! Let's build and learn together by @anirockshady.tech
Since last week's PHP2SHELL, it's a wrecking ball: pip certifi, eMudhra, Linux Backdoor RCE flaw, CISCO DoS, Gitlab RCE, compromised Claude code extension and just now saw Binance losing around $6.3B due to security incident involving a DevOps Engineer's Laptop. Kudos to the Cyber security team working day and night protecting the critical infrastructure during this time of crisis when Vulnerability detection and execution is taking place in a matter of hours. Companies and bad actors are playing cat and mouse game, trying to outrun eachother's pace in exploitation and patches. My Hacker News subscription has led me into paranoia. The only recommendation here is to stay informed and up to date with latest development and not wait for weeks to update the latest patch. Cheers to the brave team of cyber professionals 🥂 #cybersecurity #ai #it by @anirockshady.tech
by @anirockshady.tech
We are in fun times to be honest, anything is possible. All the source links are listed below: https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html?m=1 https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html?m=1 by @anirockshady.tech
Things we do for our dreams. by @anirockshady.tech
Type of notification I prefer on an early Work day 😮‍💨 #anthropic #claude #news by @anirockshady.tech
Upgrade your pip certifi, if you haven't already due to eMudhra certificate blunder. Python expedited security releases of 3.15 and 3.14, and a special security release of 3.13. Check you venv, uv along eith Node.js, Firefox, Debian, Ubuntu. https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 Happy Sunday 🫣 #CyberSecurity #python #aiengineering #pip by @anirockshady.tech
A 9B-parameter AI model set up inference on 8 of the 9 hardware types Anthropic's Frontier Red Team tested, from Jetson Nanos to RTX 4090s. That finding sits inside a new paper asking whether AI could copy itself onto cheap devices with no datacenter. I turned it into a 12-slide explainer: the demos, the limits and the defences. What they showed - 15 off-brand Android TV boxes, about $55 each, ran a 26B model together at 0.39 tokens per second. - In a simplified test on emulated Android devices, GLM-5.2 spread to 8 of 8 nodes in 4 of 5 trials. - Qwen3.5-9B's inference-setup success rate rose from 45% to between 61% and 84% across generations, as each instance inherited its parent's notes. What it is not The authors say a full rogue replicator does not exist yet, and the test simplified the hacking step. What helps The central idea is to push R0, the number of new devices each infected device infects, below 1 so the replicator dies out. - Watch networks for multi-gigabyte model downloads and sustained device-to-device traffic. - Use honeypots to collect the payload once it is found. - Quarantine and notify: in a Mirai study an ISP cleared 92% of infections in 14 days, against 58 to 74% with no notice. Email alone did nothing. - Raise the baseline: the UK has banned universal default passwords since April 29, 2024. For device owners, following UK NCSC guidance: change default passwords, turn on 2-step verification, install updates, turn off UPnP and port forwarding if you do not need them, and check how long the maker promises updates. Which of these could your team or ISP act on first? Sources are in the first comment. #AISafety #CyberSecurity #iot by @anirockshady.tech
This day couldn't get any more hectic. So ⚠️ Attention if you use python, Go, Rust, Node.js and a bunch of different software listed in 2nd link. This post is to address anyone who is not aware and for vibecoding community to avoid Man in the middle (MITM) type of attack: 1. https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 2. https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html?m=1 #ai #cybersecurity #cyber #python by @anirockshady.tech
96 hours on the internet, October 19 to 23, 2026. Every major security incident, and exactly what to patch. Save this before your next deploy. 1. PHP2Shell, CVE-2026-109618 and CVE-2026-109619. Two critical flaws in PHP itself, not in your app code. An attacker can run code on your server without logging in. Wiz, Calif and OpenAI found them using AI, and attacks have already started. Amazon caught one exploit attempt four days before the bugs were even made public. Fix: update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. 2. The NSA's advice on PHP2Shell was blunt. Patch it, or take the system offline until you can. 3. GitLab CVE-2026-110264 scored CVSS 10.0, the maximum. It affects every self-managed GitLab since version 7.0 from 2014, and needs no login. Fixed in 19.5.1, with backports down to 18.11.13. 4. Node.js fixed 10 bugs in one release, including a Brotli decoder flaw that can lead to remote code execution. Update to 22.23.4, 24.22.1 or 26.12.1. 5. eMudhra, a certificate authority, had eight keys so weak that anyone could calculate them. One of them was literally the number 4. Browsers blocked them fast, but tools like pip carry their own certificate list. Python devs: install pip 26.2.2 and certifi 2026.10.19 in every virtual environment. 6. LiteLLM 1.107.0 was poisoned. Attackers hijacked the release pipeline and shipped malware that steals credentials. If you installed it, rebuild from scratch on 1.106.2 and rotate every key that machine could reach. 7. Railway says attackers may have accessed customer environment variables, and decrypted some. Rotate everything you stored there. 8. Arista VeloCloud Orchestrator has a zero-day that is already being exploited. A read-only login becomes full control. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12. 9. Microsoft says a China-aligned group, Storm-0940, used AI agents to try to break into more than 2,250 Microsoft 365 tenants, using stolen ConnectWise Cloud Backup credentials. Up to 2,900 sign-in attempts per minute. 10. CISA added six actively exploited bugs to its must-patch list, and Cisco rated an Expressway flaw 9.8 out of 10. #cybersecurity #infosec #php #gitlab #nodejs by @anirockshady.tech
PHP2Shell: two critical flaws in the PHP engine, patched on October 21. An attacker needs no login, only crafted web requests, to run code on a vulnerable server. PHP runs about 70% of websites (Wiz estimate), and affected versions go back to PHP 5.4. The part worth knowing: Wiz Research found the first flaw on August 19 by using AI models to search the PHP source. It had working exploits for Drupal and WordPress within two days. The bugs were over a decade old. What AI changed was how fast they became exploitable. Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Internet-facing servers first. @anirockshady.tech #php #cybersecurity #infosec #wordpress #webdevelopment by @anirockshady.tech
Early Access to @therox.app AI fitness app: Link in bio Claude assisted me through a big problem. Itself created an artefact to work on the graphical representation of @therox.app way points. by @anirockshady.tech

Download All

Save the photos and videos currently loaded on this page.

0Photos
0Videos
Ready to download 0 / 0

Keep this tab open until your download is ready.
back to up