data + ai + infosec engineering. @squirrelscan_ @opennem. at https://xitter.cf/t.co/yOGtW7uHIA and https://xitter.cf/t.co/kvkcg5TrG9

Australia
Joined March 2007
I'm very smart. Ask me anything.
4
1
22
7,503
Filmmaking marked safe from AI
Watch Episode 1 of our Odyssey series made with Grok Imagine. Let us know in the comments if you'd like a full breakdown of how it was done! Creative collaboration with @WonderStudiosX and director Dev Walker @glumlot_
26
Phone numbers aren’t authenticated and can be spoofed. We can’t be far away from banks and other critical apps abandoning phone support for in-app support only
My cousin had his bank account completely emptied yesterday and the nature of the fraud is breaking my brain. Somehow they are calling using the bank's actual phone number? How is this possible?
2
67
github.com/thecybergeek/php2… php2shell OOM in mod_php (CVE-2026-109618): the fake-HashTable fire only runs ~14-byte commands, too short for a shell. Poison a PHP session via upload_progress with <?php system(base64_decode())?>, then exec in 11 bytes: php /tmp/s* www-data shell. Full PoCs in my github repo! #php2shell #CVE #InfoSec #PHP #RCE
32
How do you write an entire book about teenage hackers hijacking the internet and not know what PHP is? It would be the main character ..
You gotta be kidding me.
2
52
BYO iPhone as a diplomat is a security nightmare - they all know that. It's a choice between having a secure gov device + network but having to comply with records retention + preservation, or going in raw into a hostile environment but being able to remain freelance
The GRU hacked into Jared Kushner's iPhone. Dutch military intelligence (MIVD) then recruited a GRU spy who gave them access to the hacked phone. What MIVD discovered was that Kushner had access to two bank accounts --one Azerbaijani, the other Israeli --where Saudi Crown Prince Mohammed bin Salman and Emirati ruler Mohammed bin Zayed deposited money. It sounds like a slightly far-fetched episode of "Slow Horses," but it's real. And it proves just how eye-poppingly corrupt this administration was and continues to be as its "special envoy" decides the fate of tens of millions in Europe in the Middle East. Simply incredible reporting by Matthew Cole, drawn from his new book on Kushner. vanityfair.com/story/jared-k…
26
Seemingly launched with support for every agent out there except OpenClaw and Hermes - both starting to feel a bit dead in the discourse
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉 We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly. 1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials. The agent gets the task done, but it doesn’t get your passwords.. You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault. ➡️Learn more: bit.ly/487da6J
23
long day and it feels like we're only 36 hours in
🚨 Security vulnerabilities reported in a SINGLE day: PHP — 2 CVEs Node.js — 10 CVEs NGINX — 5 CVEs Go — 1 CVE GitLab — 12 CVEs eMudhra — CA certificate compromise
30
Planetscale moved from Vercel to Cloudflare. Not the only ones.
1
94
Digger is seeing this viral / word-of-mouth awakening in its third week of release. My local theatre pulled it - I got to catch the final session on a weekday morning this week - it was half full after every prior session selling < 10 tickets.
Digger is the best movie I’ve seen in years
1
39
The previews and media tour and initial reviews didn't help - but this is starting to feel like Blade Runner, Donnie Darko, Fight Club et al where it becomes a cult hit and critics then re-evaluate.
1
1
23
it's brilliant - btw, go see it
4
Nik Cubrilovic retweeted
Your coding agent can write the fix. It still needs to find the website problem. squirrelscan is an open-source CLI website QA tool for builders using coding agents. It helps you audit a site and give your agent specific fixes by crawling it against 300+ rules across SEO, performance, security, accessibility, and agent experience. Key features: • Broad audit coverage – 300+ rules across 21 categories cover website QA in one CLI • Agent experience checks – tests whether agents can discover, read, and act on your site • MCP and skills support – connect the tool to coding agents and run audit-and-fix workflows • Incremental crawling – uses ETag, Last-Modified, and content hashing, with checkpoints for resuming • Flexible reports – export findings to console, JSON, HTML, Markdown, text, LLM, or XML formats It’s open-source (MIT license). Link in the reply 👇
8
7
1
33
1,856
Great way to publish benchmarks :)
Replying to @CompleteSkeptic
Evals?!?!?! As you all know, I dislike public benchmarks, but we do have to measure intelligence somehow. We are trying an experiment in communicating our internal measure of intelligence. See the blog for more details, but don’t treat it like it’s absolutely gospel, and you don’t even have to believe it fully, and it’s likely biased to our models so feel free to only pay attention to the relative ranking of open models. Shout outs to the Kev guy! (We did not include hosted models because of what they do with their data and we want to keep our validation set very secure…)
22
Good enough for 80-90% of coding tasks
DeepSeek V4.1 Flash is now free in OpenCode
2
118
Nik Cubrilovic retweeted
Late in 2025 I observed a curious phenomenon: whenever the Brent forward curve slipped into prompt contango (a sign the market was over-supplied and prices were trending down), the US would do something escalatory. -permitting Ukrainian strikes against Russian export facilities -sanctioning major Russian oil companies -beginning strikes on Venezuelan oil tankers -kidnapping Nicolas Maduro Each time, Brent's curve was in, or close to, contango. It was like someone in the WH was watching the curve and then giving the thumbs up for whatever the US had planned. A soft oil market created space for risky actions. Ultimately, there was confidence that prices wouldn't rise too high. I expect similar thinking persisted in late February 2026. Prices were already edging up, on the back of clear signs the US and Israel were preparing to attack Iran. But as the WH reportedly believed the war would be over quickly, there was likely little concern that the impact to oil (which remained in a state of oversupply, with ample inventories) would be contained. The thinking was paradoxical: a soft market created less cost to risky action, but the risk of action that produced a catastrophic market shock simultaneously rose. Trump faces high energy prices today because, when his term began, energy prices were structurally heading toward near-term lows.
Trump says that he was driving through Iowa early in his term and saw that gas was $1.85/gallon at one station and $1.95 at another. He says the next day he called a meeting of his team and said we need to go to war on Iran. I do not know why he would say this.
6
46
4
260
54,468
Nik Cubrilovic retweeted
Incredible: Not only is Google working to block AI crawlers, but @nozzleio uncovered evidence that Google is deliberately serving FAKE search results to scrapers The "poisoned" search results look real, but w/ garbage data. This influences AI crawlers, scrapers, & rank trackers.
125
241
93
1,780
149,554
Odds of a diplomatic deal here just increased. If Saudis can exfil their citizens for simple DUI's they're definitely going to be getting this guy out
The man arrested for planting a secret recording device at OpenAI's headquarters is a Venture Partner of a VC firm alongside the son of a senior Saudi intelligence official:
99