Wilder's avatar
Wilder
wilder@cypherpunk.today
npub15xkp...krnh
Cryptoanarchist, voluntaryist, perpetual traveler focused on technology and society hacking.
Wilder's avatar
Wilder 1 week ago
Tesla's Flying Roadster Revealed: Everything That Happened in 10 Minutes
Wilder's avatar
Wilder 1 week ago
Snuffleupagus is a PHP7+ and PHP8+ module designed to drastically raise the cost of attacks against websites. This is achieved by killing entire bug classes and providing a powerful virtual-patching system, allowing the administrator to fix specific vulnerabilities without having to touch the PHP code.
Snuffleupagus — Snuffleupagus stable documentation
Wilder's avatar
Wilder 2 weeks ago
Zverejnil som na GitHube vlastný bridge, ktorým som pri presune Aave pôžičiek ušetril viac než 3 000 $ na poplatkoch. Bridge appky si z každého prevodu berú 0,05–0,5 %. Circle pritom za štandardný prevod USDC, EURC, cirBTC či WETH neberie nič, len na to nemá appku pre bežných ľudí. Tak som si ju nechal napísať AI agentom. Čo vie: • USDC medzi Arc, Ethereom a Avalanche • EURC z Arc na Ethereum prakticky len za gas • cirBTC a WETH medzi Ethereom a Arc • dokončiť rozpracovaný prevod podľa hashu transakcie Bezpečnosť: • beží lokálne vo vašom prehliadači a každú transakciu podpisujete v hardvérovej peňaženke • pred každým prevodom overí kontrakty Circle priamo na blockchaine • príjemca je len vaša peňaženka alebo adresa z vášho adresára (ochrana pred address poisoningom) • presné povolenia, ochrana pred dvojitým odoslaním a prísna Content-Security-Policy Používate ho na vlastné riziko a neručíme za žiadne zneužitie ani stratu prostriedkov. Najprv vyskúšajte malú sumu. 👉
GitHub
GitHub - wilderko/circle-cctp-bridge: Self-hosted Circle CCTP bridge page: USDC, EURC, cirBTC, WETH between Arc, Ethereum and Avalanche for gas only. Unaudited, use at your own risk; no liability for any loss or misuse.
Self-hosted Circle CCTP bridge page: USDC, EURC, cirBTC, WETH between Arc, Ethereum and Avalanche for gas only. Unaudited, use at your own risk; no...
 Ako som ho použil pri presune pôžičiek na Aave v4: https://blog.opportunist.global/ako-%C5%BEi%C5%A5-dlhodobo-z-krypto-p%C3%B4%C5%BEi%C4%8Dky-a-leg%C3%A1lne-neplati%C5%A5-dane-odvody-v-roku-2026-487a49e561ab#a7bb
Wilder's avatar
Wilder 2 weeks ago
If you run WordPress with UpdraftPlus and your site is connected to UpdraftCentral, please delete the UpdraftCentral key today and check the site. On the night of 19 October an attacker sent validly signed UpdraftCentral commands to three of our WordPress sites and installed a backdoor plugin on two of them. The sites were fully up to date, on UpdraftPlus 2.26.11, patched against the June vulnerability CVE-2026-10795. The attacker did not break into our servers. The commands were signed with the private dashboard keys that UpdraftCentral Cloud generates and keeps, keys that never existed on our side. The backdoor waits for a secret link, then creates an account that looks like an ordinary Editor but can change every setting and install plugins, and logs the attacker straight in, bypassing the login form and two-factor authentication. A bug in its code made it crash our sites instead of working. A fixed version would take a few characters. UpdraftPlus has more than 4 million active installations and every copy contains the UpdraftCentral client. Any site connected to UpdraftCentral is exposed, including the latest version. There is no fix yet. What to do now: • delete the key in UpdraftPlus > Advanced Tools > UpdraftCentral • check the site with our free read-only WP-CLI script • do not reconnect until TeamUpdraft explains how the keys leaked We reported it to TeamUpdraft the same day. Because the attack is active and publishing gives the attacker nothing new, we are publishing the analysis, indicators of compromise and the checker right away:
Nethemba
Critical security problem in UpdraftCentral: an attacker holding the service's keys planted a backdoor on our websites - Nethemba
An attacker used UpdraftCentral keys (UpdraftPlus, 4M+ installs) to push a backdoor to WordPress sites. Analysis, IOCs and how to check your site.
 #WordPress #infosec #UpdraftPlus #cybersecurity
Wilder's avatar
Wilder 2 weeks ago
#89 Jarvis (HackTheBox) (Medium) How To Deal With Connection Issues... SQL injection (involving a WAF bypass) allows us to write a shell in the webserver root. We then abuse a custom python application to gain more rights as another user. Finally systemctl with SUID rights grants us root access after a period of losing my mind.
↑