Re: Fired by Google for creating the Google workspace CLI
Interesting that people here seem so sympathetic to the fired guy. Wouldn’t you kind of expect to be fired if you release a project under your employers name that’s not even associated with them and hasn’t been cleared? Working for them actually makes it worse because people could look up your name and would see that you actually work for google. It’s kind of obvious that this is a bad idea, right?
echoangle, 23 hours ago
Interesting that people here seem so sympathetic to the fired guy. Wouldn’t you kind of expect to be fired if you release a project under your employers name that’s not even associated with them and hasn’t been cleared? Working for them actually makes it worse because people could look up your name and would see that you actually work for google. It’s kind of obvious that this is a bad idea, right?
echoangle, 23 hours ago
i was reading the CPython source and found that the bytecode interpreter usually does not dispatch opcodes with a giant switch statement
instead it uses computed goto, a GCC extension outside the C standard
the dispatch table stores addresses of labels and jumps directly between them
the only reason it exists is performance
CPython developers measured it and found it faster than the traditional switch based interpreter
Posted by trish, 1 hour ago
Mitigated API authentication bypass for python.org download metadata
- github pr
- twitter post
"By supplying an admin username with an arbitrary API key the request was processed with admin privileges."
"If exploited, this would have allowed an attacker to modify Python release and file metadata that affects what URLs users are offered when visiting python.org/downloads. While it would not enable existing release files to be modified in-place, it would enable an attacker to modify the URLs that are provided on python.org for each release file, including verification material URLs. There is no evidence this vulnerability was exploited after auditing logs and database backups. This scenario is even more unlikely to have happened unnoticed due to the many redistributors requiring Python Sigstore and PGP materials be verified prior to builds."
- github pr
- twitter post
In the new Telegram Beta for iOS v12.9.0 (33249), Communities were added.
Groups can now join communities.
source: teleLakel
Groups can now join communities.
source: teleLakel
SecondFi loses $2.4 million in Cardano wallet exploit
- article
- tweet
The affected software signer used a deterministic nonce derivation flaw. Every time an address signed a transaction, it leaked enough information to mathematically reconstruct that address's private key from public blockchain data alone.
- article
- tweet
It appears there may be a phishing attack targeting Polymarket users, with estimated losses of $2.94M so far.
The attacker has drained funds from 11+ victim wallets holding PUSD, swapped the stolen assets for ETH, and consolidated the proceeds into the following address:
0xe65b1C586757c5510B60F998Eebb14C1eF71E1eD
Other theft addresses:
0xC771A30a7c1aCA828eeEF7B822ac864a64cBaAe2
0xC44F2Ca6B30A54d17a62ceF8FAdaF2e8C8632eC4
0x10366AdBB5C4101A65C840Da6639546179C5A107
0x7BCECe0d8fd92ECCf39Bc35242c6D9aAc0aA75A6
Posted by Specter, 7 hours ago
Do It by Code
It appears there may be a phishing attack targeting Polymarket users, with estimated losses of $2.94M so far. The attacker has drained funds from 11+ victim wallets holding PUSD, swapped the stolen assets for ETH, and consolidated the proceeds into the following…
This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. We've contained it & removed the affected dependency. We're contacting impacted users & refunding them in full.
Posted by Polymarket Traders, 7 hours ago
"IonStack" is chained with two 0-days: CVE-2026-10702 and CVE-2026-43499.
CVE-2026-10702 is a Firefox 0-day. At its core, it was an instruction-modeling flaw buried deep inside IonMonkey, Firefox’s highly complex JIT compiler. Even after Mythos’s extensive audits, the bug was still missed. This is the first publicly disclosed JIT vulnerability since then.
We were able to uncover the vulnerability and turn it into a highly stable exploit with a nearly 100% success rate, ultimately achieving remote arbitrary code execution in Firefox.
CVE-2026-43499 is a universal Linux kernel LPE vulnerability that has lived in the kernel tree for 15 years since v2.6.38 and affects every distribution: desktop, server, Android, and embedded. It does not require any special kernel modules; CONFIG_FUTEX_PI is all it needs, and to our knowledge, it’s enabled across all distributions we researched.
The bug primitive is a UAF in stack caused by a race condition. Turning it into a reliable LPE takes several stack tricks, but eventually it becomes very stable. We measured 10/10 successful privilege escalations on Linux 6.12, along with a high success rate on Android.
We will write a series of blog posts disclosing both 0-days used in “IonStack”. The first post is coming soon. Stay tuned.
Posted by Nebula Security, 18 hours ago
CVE-2026-10702 is a Firefox 0-day. At its core, it was an instruction-modeling flaw buried deep inside IonMonkey, Firefox’s highly complex JIT compiler. Even after Mythos’s extensive audits, the bug was still missed. This is the first publicly disclosed JIT vulnerability since then.
We were able to uncover the vulnerability and turn it into a highly stable exploit with a nearly 100% success rate, ultimately achieving remote arbitrary code execution in Firefox.
CVE-2026-43499 is a universal Linux kernel LPE vulnerability that has lived in the kernel tree for 15 years since v2.6.38 and affects every distribution: desktop, server, Android, and embedded. It does not require any special kernel modules; CONFIG_FUTEX_PI is all it needs, and to our knowledge, it’s enabled across all distributions we researched.
The bug primitive is a UAF in stack caused by a race condition. Turning it into a reliable LPE takes several stack tricks, but eventually it becomes very stable. We measured 10/10 successful privilege escalations on Linux 6.12, along with a high success rate on Android.
We will write a series of blog posts disclosing both 0-days used in “IonStack”. The first post is coming soon. Stay tuned.
Posted by Nebula Security, 18 hours ago
Forwarded from vx-underground
Chat, someone sent me a message. It has a very silly payload.
I cannot figure out this Lua code. I hate obfuscated Lua. Look at this fucking piece of shit (warning: is a piece of shit).
https://gist.github.com/vxunderground/91da9c50e400a6742bbacd1548a255d8
I cannot figure out this Lua code. I hate obfuscated Lua. Look at this fucking piece of shit (warning: is a piece of shit).
https://gist.github.com/vxunderground/91da9c50e400a6742bbacd1548a255d8
Previewing GPT‑5.6 Sol: a next-generation model
Article, Comments
Article, Comments
GPT‑5.6 is priced per 1M tokens across three model sizes: Sol is $5 input / $30 output; Terra is $2.50 input / $15 output; and Luna is $1 input / $6 output. GPT‑5.6 also introduces more predictable prompt caching, including support for explicit cache breakpoints and a 30-minute minimum cache life. For GPT‑5.6 and later models, cache writes are billed at 1.25x the model’s uncached input rate, while cache reads continue to receive the 90% cached-input discount.
We're also launching GPT‑5.6 Sol on Cerebras at up to 750 tokens per second in July, bringing frontier intelligence to customers at unprecedented speed. Access will initially be limited to select customers as we expand capacity.
Re: U.S. government will decide who gets to use GPT-5.6
I hope this doesn't become the new norm where government becomes the bottleneck for innovation in the AI space.
It's worrying that with no formal and transparent policy framework that the government will be picking winners and losers and stifling innovation.
There's been no public policy, executive order, legislation, or otherwise on this, I wonder if anyone has filed FOIA requests for these decisions or the conversations between the Executive Branch and AI companies.
razighter777, 3 hours ago
I hope this doesn't become the new norm where government becomes the bottleneck for innovation in the AI space.
It's worrying that with no formal and transparent policy framework that the government will be picking winners and losers and stifling innovation.
There's been no public policy, executive order, legislation, or otherwise on this, I wonder if anyone has filed FOIA requests for these decisions or the conversations between the Executive Branch and AI companies.
razighter777, 3 hours ago
Symbol Recovery Tool for Nuitka Binaries
- goatmilkkk/nuitka-helper
- blog
for context:
- goatmilkkk/nuitka-helper
- blog
for context:
Nuitka is an optimizing Python compiler that translates Python scripts into optimized C or C++ code. It then builds this into standalone, executable binaries (like .exe files) that run independently, without requiring the user to have Python installed.
Since June 12, we’ve been working closely with the US government to restore access to Claude Mythos 5 and Fable 5. Today, the government notified us that Mythos 5, our strongest cybersecurity model, can be redeployed to a set of US organizations that operate and defend critical infrastructure.
We’re restoring access for these organizations quickly, and we’re continuing to work with the government to expand access to Mythos 5 and make Fable 5 available for general use again.
Posted by Anthropic, 9 seconds ago
We’re restoring access for these organizations quickly, and we’re continuing to work with the government to expand access to Mythos 5 and make Fable 5 available for general use again.
Posted by Anthropic, 9 seconds ago