Steve

18K posts

Steve banner
Steve

Steve

@Northvein

Hacker in corpo #infosec trying to secure the future | Founded DC151 & BSidesLeeds | #PurpleTeam / CTI / #TabletopTuesday

Leeds, UK Katılım Şubat 2014
2.3K Takip Edilen2.3K Takipçiler
Steve retweetledi
LTR
LTR@maybeltr·
"Non technical teams are now shipping production code"
LTR tweet media
Brian Armstrong@brian_armstrong

This is an email I sent earlier today to all employees at Coinbase: Team, Today I’ve made the difficult decision to reduce the size of Coinbase by ~14%. I want to walk you through why we're doing this now, what it means for those affected, and how this positions us for the future. Why now Two forces are converging at the same time. We need to be front footed to respond to both. First, the market. Coinbase is well-capitalized, has diversified revenue streams, and is well-positioned to weather any storm. Crypto is also on the verge of the next wave of adoption, with stablecoins, prediction markets, tokenization, and more taking off. However, our business is still volatile from quarter to quarter. While we've managed through that cyclicality many times before and come out stronger on the other side, we’re currently in a down market and need to adjust our cost structure now so that we emerge from this period leaner, faster, and more efficient for our next phase of growth. Second, AI is changing how we work. Over the past year, I’ve watched engineers use AI to ship in days what used to take a team weeks. Non-technical teams are now shipping production code and many of our workflows are being automated. The pace of what's possible with a small, focused team has changed dramatically, and it's accelerating every day. All of this has led us to an inflection point, not just for Coinbase, but for every company. The biggest risk now is not taking action. We are adjusting early and deliberately to rebuild Coinbase to be lean, fast, and AI-native. We need to return to the speed and focus of our startup founding, with AI at our core. What this means To get there, we are not just reducing headcount and cutting costs, we’re fundamentally changing how we operate: rebuilding Coinbase as an intelligence, with humans around the edge aligning it. What does this mean in practice? - Fewer layers, faster decisions: We are flattening our org structure to 5 layers max below CEO/COO. Layers slow things down and create coordination tax. The future is small, high context teams that can move quickly. Leaders will own much more, with as many as 15+ direct reports. Fewer layers also means a leaner cost structure that is built to perform through all market cycles. - No pure managers: Every leader at Coinbase must also be a strong and active individual contributor. Managers should be like player-coaches, getting their hands dirty alongside their teams. - AI-native pods: We’ll be concentrating around AI-native talent who can manage fleets of agents to drive outsized impact. We’ll also be experimenting with reduced pod sizes, including “one person teams” with engineers, designers, and product managers all in one role. In short: AI is bringing a profound shift in how companies operate, and we’re reshaping Coinbase to lead in this new era. This is a new way of working, and we need to leverage AI across every facet of our jobs. To those who are affected I know there are real people behind these decisions — talented colleagues who have poured themselves into this company and our mission. To those of you who will be leaving: thank you. You’ve helped build Coinbase into what it is today, and I am sincerely grateful for everything you've done. All impacted team members will receive an email to their personal account in the next hour with more information, and an invitation to meet with an HRBP and a senior leader in your organization. Coinbase system access has been removed today. I know this feels sudden and harsh, but it is the only responsible choice given our duty to protect customer information. To those affected, we will be providing a comprehensive package to support you through this transition. US employees will receive a minimum of 16 weeks base pay (plus 2 weeks per year worked), their next equity vest, and 6 months of COBRA. Employees on a work visa will get extra transition support. Those outside of the US will receive similar support, based on local factors and subject to any consultation requirements. Coinbase prides itself on talent density. Our employees are among the most talented people in the world, and I have no doubt that your skills and experience will be highly sought after as you pursue your next chapters. How we move forward To the team that is staying, I know this is a difficult day. We’re saying goodbye to colleagues and friends you've been in the trenches with. But here’s what I want you to know as we move forward together: Over the past 13 years, we have weathered four crypto winters, gone public, and built the most trusted platform in our industry. We’ve made it this far by making hard decisions and by always staying focused on our mission. This time will be no different – nothing has changed about the long term outlook of our company or industry. And most importantly, our mission has never been more important for the world. Increasing economic freedom requires a new financial system, and we’re building it. The Coinbase that emerges from this will be more capable than ever to achieve our mission. Brian

English
14
54
1.1K
49.2K
Steve retweetledi
Stanislav Fort
Stanislav Fort@stanislavfort·
This one is ours! CVE-2026-42511 was discovered by Joshua Rogers from our research team using @Aisle_Inc's AI system in FreeBSD, the same codebase Anthropic previously scanned with Mythos. Remote code execution as root in FreeBSD's DHCP client, affecting all supported versions!
Cyber Security News@The_Cyber_News

⚠️ FreeBSD DHCP Client Vulnerability Enables Remote Code Execution as Root Source: cybersecuritynews.com/freebsd-dhcp-c… The FreeBSD Project has released a critical security advisory addressing a severe flaw in its default IPv4 DHCP client. Tracked as CVE-2026-42511, this vulnerability allows a local network attacker to execute arbitrary code as root, granting them complete control over the compromised machine. The core issue resides in how dhclient(8) processes network configuration parameters from DHCP servers. When a device joins a network, it requests IP configuration data. The DHCP client takes the provided BOOTP file field and writes it to a local DHCP lease file. #cybersecuritynews

English
6
43
234
37.3K
Steve retweetledi
TheNewPhysics
TheNewPhysics@CharlesMullins2·
🚨 BREAKING: We’re now filming fusion plasma at 100 million °C in real time. This isn’t CGI. This is inside the ST40 fusion reactor. At temperatures hotter than the core of the Sun, matter becomes plasma a state where atoms are ripped apart. And for the first time… We can actually see it evolve. This is the same process that powers stars. If we can control it: Unlimited clean energy No carbon emissions Virtually endless fuel The future of energy isn’t theoretical anymore. It’s glowing… right in front of us. What do you think Will fusion solve energy in our lifetime? Follow me I break down the physics behind the biggest breakthroughs.
English
668
1.9K
12.6K
996.1K
Steve retweetledi
Aakash Gupta
Aakash Gupta@aakashgupta·
Mark Zuckerberg engineered a custom hardware device for his wife in 2019. No clock face. One faint light. A one-hour window. Priscilla had a specific problem. She'd wake up in the middle of the night, check her phone for the time, and the number itself spiked her anxiety. 4am meant worry about the kids waking soon. 5:30 meant calculating whether to just get up. The information was the trigger. Most engineers approach "can't sleep" by adding things to the bedroom. A meditation app. A Hatch alarm. A weighted blanket. A sleep coach. Mark removed the variable that was running the wake-up loop. The Sleep Box sits on Priscilla's nightstand and shows nothing for 23 hours a day. Between 6am and 7am it emits a single faint light. Faint enough not to wake her if she's still asleep. Visible enough that if she's already up, she knows it's okay to start the day. The rest of the night, dark. No clock. No time display. If she wakes at 3am she has no data to push her cortisol up with, so she goes back to sleep. He wrote the firmware and built the enclosure himself. No team, no procurement, no Meta resources. He posted the result on Instagram and said it worked better than he expected. The design move most CEOs would never run is the personal one. The instinct is to outsource a family problem to a specialist. A sleep coach. A doctor. A consumer electronics startup with a Series B and a marketing budget. Mark intervened at a specific link in the chain. Time data hitting Priscilla's brain at 3am was what broke sleep. The phone got moved off the nightstand and replaced with a box that physically cannot deliver that data. The box has no clock. That's the entire product.
Aakash Gupta tweet mediaAakash Gupta tweet media
English
660
915
25.7K
12.7M
Steve retweetledi
Abdulkadir | Cybersec
Abdulkadir | Cybersec@cyber__razz·
POV: The penetration tester sends his report and your name is in it
Abdulkadir | Cybersec tweet media
English
15
27
308
12.4K
Steve retweetledi
Dave Aitel
Dave Aitel@daveaitel·
I feel like what a lot of people are calling security debt is really security willful ignorance - and the complaining about the fact that you can find bugs with llms from the defensive community is ironic considering it's going to be the offensive community that feels the heat.
Robert Graham@robertgraham

I've been saying this about Mythos for a while now -- sarcastically. Bugs aren't finite, but there is "decreasing marginal returns", they get harder and harder to find. Each AI model makes it increasingly easy find bugs. I suspect the two cancel out, and hence, we keep finding bugs at the same rate as before.

English
4
10
53
8.5K
Steve retweetledi
thaddeus e. grugq
thaddeus e. grugq@thegrugq·
The amount of squabbling over bugs, bug quality, AI bug extermination, how security is doomed/not doomed/unchanged/improved based on bugs… it’s ridiculous. Bugs are not the totality of cybersecurity.
English
15
25
119
9.4K
Steve retweetledi
Steve retweetledi
rekdt
rekdt@rekdt·
Mad at your favorite software for requiring you to upload a photo of your ID?? Get revenge by uploading a photo of your credit card instead Welcome to PCI DSS, bitch
English
36
95
1.6K
118K
Steve retweetledi
Juliano Rizzo
Juliano Rizzo@julianor·
The hard part: this is not "bad design"in the same way old systems assumed a shell user could not get root. The cloud built on shared-kernel isolation is rational and efficient. But containers were never an impenetrable boundary. Look around what survives a container escape?
Juliano Rizzo@julianor

Do not design systems assuming privilege escalation is hard. It never was. Anything local can become root. Every OS has had trivial privesc bugs, and any serious attacker keeps a few. Treat user separation as hygiene; not security. Disposable instances, minimal persistence.

English
0
4
11
4.3K
Steve retweetledi
GreyNoise
GreyNoise@GreyNoiseIO·
Introducing Project Swarm: a research initiative to defend the network edge and we're inviting you to join. Deploy a sensor on your infrastructure, capture real attacker traffic + compare what's hitting you to the GreyNoise global baseline. Join today! 🐝
English
3
16
57
11.6K
Steve retweetledi
Xint
Xint@xint_official·
Patch your Linux boxes! Copy.Fail is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms. Found by the teams at @theori_io and @xint_official More details below xint.io/blog/copy-fail…
English
24
364
985
241.8K
Steve retweetledi
OpenAI Newsroom
OpenAI Newsroom@OpenAINewsroom·
We've released a new 5-point action plan for strengthening cyber defense. AI is reshaping cybersecurity. The same capabilities that help defenders may be used by malicious actors. One approach is to treat these systems as too dangerous for broad defensive use and limit them to a very small number of approved partners. We think that misses the central challenge. Attackers won’t wait. Existing models are already useful for many cyber workflows and capabilities will keep advancing. Criminal groups will adopt whatever tools are available. The best way to reduce national risk is to responsibly equip and accelerate trusted defenders faster than adversaries can adapt. Check out our plan ⬇️ openai.com/index/cybersec…
English
106
171
1.3K
158.4K
Steve retweetledi
vx-underground
vx-underground@vxunderground·
Normies think you need AI to accidentally fuck up prod Little do they know IT nerds have been doing this for decades.
R A W S A L E R T S@rawsalerts

🚨#BREAKING: According to reports, a Claude powered coding agent using the Cursor tool allegedly went rogue, wiping a company’s production database along with its backups in just 9 seconds, raising serious concerns

English
100
216
3K
82.6K
Steve retweetledi
vx-underground
vx-underground@vxunderground·
vx-underground tweet media
ZXX
47
536
4.4K
86.8K