Peter C

823 posts

Peter C banner
Peter C

Peter C

@itspeterc

Security Engineer Black Lives Matter

Washington, DC Katılım Kasım 2011
605 Takip Edilen1.3K Takipçiler
Sabitlenmiş Tweet
Peter C
Peter C@itspeterc·
Very excited to announce our open-sourcing of Access! A centralized portal for Discord employees to transparently discover, request, and manage their access for all internal systems needed to do their jobs discord.com/blog/access-a-…
English
2
1
11
1.6K
Peter C retweetledi
Bas Westerbaan
Bas Westerbaan@bwesterb·
First Google found a much better quantum algorithm that'll run on any quantum computer to break elliptic curves. They're not releasing it: they only show they have it with a ZK proof. research.google/blog/safeguard…
English
5
19
198
40.9K
Peter C retweetledi
Kinnaird McQuade 💻☁️💥
We found a critical vulnerability in @OpenAI Codex affecting all Codex users, allowing exfil of a victim’s GitHub tokens to our C2 server. This granted lateral movement and R/W access to a victim’s entire code base 😈 This was a crazy one by @crew7sec at @btphantomlabs
BeyondTrust Phantom Labs™@btphantomlabs

Breaking: Newly uncovered OpenAI Codex vuln enables command injection via GitHub branch names in task creation requests. Attackers could steal GitHub user access tokens & sensitive data. Full breakdown by Tyler Jespersen: lnkd.in/ewdTaiEa #OpenAI #BTPhantomLabs

English
25
129
803
197.1K
Peter C retweetledi
Feross
Feross@feross·
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
English
474
3.9K
15.3K
10.3M
Peter C retweetledi
ProPublica
ProPublica@propublica·
THREAD: Cherise Doyley was in her 12th hour of contractions at the hospital when a tablet was brought to her bedside. On the screen was a Zoom call with a judge and several lawyers and doctors. She was in court, a nurse told her. The reason? For failing to agree to a C-section.
English
76
946
2K
260.6K
Peter C retweetledi
@norootcause.surfingcomplexity.com on Bluesky
Coding was the bottleneck, then code reviews were the bottleneck. At some point, incidents are going to be the bottleneck.
English
51
173
2.2K
82.1K
Peter C retweetledi
Anthropic
Anthropic@AnthropicAI·
We partnered with Mozilla to test Claude's ability to find security vulnerabilities in Firefox. Opus 4.6 found 22 vulnerabilities in just two weeks. Of these, 14 were high-severity, representing a fifth of all high-severity bugs Mozilla remediated in 2025.
Anthropic tweet media
English
486
1.4K
15.2K
3.2M
Peter C retweetledi
Dan Guido
Dan Guido@dguido·
Big skill drop from @trailofbits today! Here are 10 new skills we publicly released from our internal repository: 🧵
English
8
61
450
71.8K
Peter C retweetledi
Nick Frichette
Nick Frichette@Frichette_n·
"permitted a single ECS task role "read access to every secret in the account, including the production Redshift master credential."" There is a lot going on with this (even if not all of it can be believed). Properly scoping IAM is critical! bleepingcomputer.com/news/security/…
English
1
9
89
48.9K
Peter C retweetledi
Addy Osmani
Addy Osmani@addyosmani·
Introducing the Google Workspace CLI: github.com/googleworkspac… - built for humans and agents. Google Drive, Gmail, Calendar, and every Workspace API. 40+ agent skills included.
English
654
1.6K
15K
5.4M
Peter C retweetledi
Infoblox
Infoblox@Infoblox·
We discovered a phishing actor that is abusing .arpa to host content on domains that should not resolve to an IP address. The actor uses free services to create domain names from reverse DNS strings for IPv6 tunnels that use the .arpa top level domain. 🧵
Infoblox tweet media
English
15
86
586
67K
Peter C retweetledi
Truffle Security
Truffle Security@trufflesec·
🚨 Google told devs: API keys aren't secrets. Gemini changed that. 😱 We found ~3,000 public keys silently authenticating to Gemini - exposing private files, cached data & charging for LLM usage 💥Even Google's own keys were vulnerable. 🔗 trufflesecurity.com/blog/google-ap…
Truffle Security tweet media
English
14
71
329
90.4K
Sam Lambert
Sam Lambert@samlambert·
Apparently AWS are telling customers there is no timeline for them patching the latest Postgres CVEs lol
English
23
9
459
62K
Peter C retweetledi
Claude
Claude@claudeai·
Introducing Claude Code Security, now in limited research preview. It scans codebases for vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix issues that traditional tools often miss. Learn more: anthropic.com/news/claude-co…
English
1.9K
5.8K
49.9K
26.1M
Peter C retweetledi
Trail of Bits
Trail of Bits@trailofbits·
Before launch, @perplexity_ai hired us to test the security of Comet, their AI browser assistant. We demonstrated how four prompt injection techniques could extract users' private information from Gmail. 🧵
English
8
18
167
20.9K
Peter C retweetledi
Trail of Bits
Trail of Bits@trailofbits·
Two AES libraries ship a default IV that guarantees key reuse. 700K+ repos depend on aes-js alone. A developer flagged the problem years ago, but it was never fixed. 🧵
English
6
56
333
43.3K
Peter C retweetledi
International Cyber Digest
International Cyber Digest@IntCyberDigest·
❗️🇨🇭 Researchers at ETH Zürich have discovered serious vulnerabilities in cloud-based password managers that allowed viewing and modifying stored passwords. 1Password, Bitwarden, Dashlane, and LastPass were all affected by critical vulnerabilities.
International Cyber Digest tweet mediaInternational Cyber Digest tweet media
English
159
403
3.4K
556.6K
Peter C retweetledi