Not your financial advisor // low tier miner
X
Joined November 2023
- Tweets4.5K
- Following629
- Followers138
- Likes23.3K
Starfish - 0xpH retweeted
有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名：
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。
于是他做了个实验：
• Astra：拒绝分析
• Astra + Daybreak Blue：仍然拒绝
• GLM-5.3：成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。
而这种新思路，直接瞄准了大模型的安全机制。
代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。
更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。
当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。
以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。
Starfish - 0xpH retweeted
BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.
Thanks to all other signers involved.
Exploiter address
0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5
Trsanction hash: 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6
Starfish - 0xpH retweeted
Please explain to the community why an entity received ~42M AXIS from the Axis team multisig to six addresses and sold it for ~5.04M USDC via DEX over the past 24 hours which has caused the AXIS price to crash 40%?
You only TGE’d one week ago….
0xcc279c2499bcf4bd0f169c2d3f333243473242f7
0x66612012c5ad9b2fed81d09a9ab429b5285b2c62
0xf07e96abc54fea70ffeea8d3df7704401e7b0eb0
0x99cd3975c90b79ffdbe16425de033a605b814c49
0xbbed67fec9c7793218fa60c40fb9e6b059d86483
0xe69d8d6b9b7f9056eda455b76384e9748749f4d1
0x4ef72e67e6a7c37ea1378fe2adf811d711422e5d
Starfish - 0xpH retweeted
>junior dev at a mid startup
>wednesday morning
>just want to push a minor bugfix to our php app today
>open laptop, check slack
>company group chat is an absolute warzone
>CTO typing in all caps about php2shell
>fucking php
>whatever, server hasn't blown up yet, I just need to get my code in
>open gitlab to merge the PR
>forced emergency logout because of a critical gitlab security patch release
>fucking gitlab
>pipeline fails because of some weird regex compiler bug
>spend 40 minutes fighting CI/CD
>i can just use AI to help debug
>fire up opencode
>api keys nuked because they were breached
>fucking opencode
>i’ll just get fresh LLM api keys from our corp proxy, LiteLLM
>it won’t connect? It’s down?
>look up LiteLLM news: supply chain compromise
>fucking litellm
>cold sweat forming
>slack alert: db connection error
>check our database connection
>we host on TiDB Cloud
>they just announced a security breach, unauthorized access via stolen service account credentials, data copied
>fucking tidb cloud
>full panic attack incoming
>figure fuck it, just ship the container to Railway and go home
>open Railway dashboard
>bright red banner: "Security Disclosure: Rotate all environment variables immediately. All builds paused."
>fucking railway
>try to open the app URL in browser to see if anything is even working
>NET::ERR_CERT_AUTHORITY_INVALID
>eMudhra intermediate certificates compromised
>4
>instantly untrusted by every major browser
>fucking emudhra
>stare blankly at mac screen for 10min
>random pop-up
>restarting in 10min to fix a critical vulnerability
>fucking macos
>close laptop
>leave office
>never come back
Starfish - 0xpH retweeted
An urgent notice from the Railway team
blog.railway.com/p/security-…
Starfish - 0xpH retweeted
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
Starfish - 0xpH retweeted
In the last 24 hours:
1. iPhone 11 through 16 are apparently vulnerable to remote attacks.
2. SSL certificates are broken until browsers remove eMudhra CA.
3. PHP >9 vulnerability CVE published (tomorrow).
The world is about to witness things that have never been seen before.
Readers added context they thought people might want to know
The post's iPhone claim is inaccurate; a leaked Cellebrite forensic tool targets a Bluetooth bug patched in iOS 26.5 and does not affect updated devices. The eMudhra CA and PHP issues are real incidents but framed sensationally.
justin.sh/blog/2026/10/c…
blog.mozilla.org/security/2026/…
php.net
Starfish - 0xpH retweeted
readme: fix typo
Co-Authored-By: GNU nano 9.0 (UTF-8, EDITOR and VISUAL, guidestripe=72) <[email protected]>
Co-Authored-By: Ghostty 1.3.1 (Metal renderer) <ghostty@localhost>
Co-Authored-By: zsh 5.9 (arm64-apple-darwin26.0) <zsh@localhost>
Co-Authored-By: Git 2.56.0 (Homebrew) <git@localhost>
Co-Authored-By: Secretive (SSH_AUTH_SOCK) <secretive@localhost>
Co-Authored-By: macOS Text Input (U.S. layout) <[email protected]>
Co-Authored-By: Apple Internal Keyboard (built-in) <[email protected]>
Co-Authored-By: APFS (sealed system volume, 4096-byte blocks) <[email protected]>
Co-Authored-By: MacBook Pro (Mac17,6, MGED4B/A, Apple M5 Max, 18 CPU cores, 36 GB RAM, macOS 27.0.1 build 26A434) <[email protected]>
