• developer relations @twilio • core-maintainer @learntocloud
United States
Joined November 2012
- Tweets9.1K
- Following602
- Followers21.7K
- Likes38.1K
Pinned Tweet
Learning Linux in 2025!
Get your hands dirty with the Linux Command Line CTF Challenges on @learntocloud
It literally takes 15-20 second to deploy the provided lab environment in your choice of cloud.
More challenges coming soon.
This week has been rough to run anything in production!
Secrets:
> Railway: decrypted env vars exposed, all deploys paused
> Zeabur: attacker read the platform database, env vars included
> OpenCode: Console breach exposed OpenAI, Anthropic and Google API keys
> TeamUpdraft: UpdraftCentral keys abused to backdoor WordPress sites
> ConnectWise: cloud backup identities compromised
Supply chain:
> LiteLLM 1.107.0: malicious PyPI and Docker release
> OVHcloud CLI: official binaries backdoored
> Rank Math PRO: malware shipped in an official update
> Tensorlake and SubQuery: npm packages infected
> GhostAction: around 1,900 GitHub accounts hit with malicious workflows
Patch these now:
> PHP2Shell: pre-auth RCE in PHP core, every version back to 5.4
> Node.js: RCE and TLS validation bypass fixed
> GitLab: CVSS 10 unauthenticated RCE
> Plex2Shell: actively exploited to drop crypto miners
Trust layer:
> eMudhra: CA keys compromised, rogue TLS certs possible
> Tailscale: caught up in the eMudhra incident
Most of this isn't bad code. It's secrets and dependencies we trusted.
What I'd do today: patch PHP and Node, rotate any key stored on a third-party platform, pin your dependencies, and update your trust store.
Rishab Kumar retweeted
Today we are in a security nightmare:
- Railway may have exposed customer environment variables and API keys
- SBI confirmed that customer records ended up on the dark web
- eMudhra's certificate keys were extremely weak (one was literally just the number 4)
- LiteLLM shipped a compromised version that steals credentials and includes a backdoor
- PHP released two critical remote code execution vulnerabilities (PHP2Shell)
- Node.js issued urgent security patches for a Brotli decoder remote code execution flaw, plus TLS and DNS issues and blocked the compromised eMudhra certificates
- Rajasthan gov systems were allegedly linked to the exposure of a large set of identity records
- OpenCode confirmed a breach that exposed AI provider API keys (OpenAI, Anthropic, Google) for a portion of Console users
- Plex Media Server vulnerabilities (Plex2Shell) are being actively exploited in the wild to install malware on unpatched servers
- GitLab fixed a critical CVSS 10.0 unauthenticated remote code execution flaw in its CI/CD regex compiler
played this, so much nostalgia!
thank you, may your pillow always be cold
cricket 07 with an online multiplayer mode. play with your friends
all you need is a web browser
link: cricket07.dhaiwat.com
AI-102 is retired. Its replacement, AI-103, is a very different exam.
I just passed the Microsoft AI-103 (Azure AI Apps and Agents Developer Associate), and made a video on how I prepared.
The biggest shift: it's no longer "which Cognitive Service do I pick?" It's agents, tools, RAG, and Microsoft Foundry.
A few things that helped me:
- Start with the official study guide. AI-103 is new, so a lot of third-party content is still recycled AI-102 material.
- Spend most of your time on 2 domains. Planning/securing Foundry + building gen AI apps and agents make up 55-65% of the exam.
- Know which agent tool fits which scenario: File Search vs Azure AI Search, Bing grounding, Code Interpreter, function calling, OpenAPI, MCP.
- Managed identity beats API keys. Every time.
- Go hands-on. Build one agent in Foundry and the whole object model clicks.
If you're coming from AWS like me, I also mapped the Azure services to their AWS equivalents in my notes.
Video - youtu.be/3Ew7kLkv8gk
time to try Gemini 4 Argon in the @github copilot!
ALT Gemini 4 Argon in GitHub Copilot App