Twitxy Saved

Web3 Security News

@web3sec_news

The world's largest web3 security newsletter.

Learn from the latest hacks, team up for bug bounties or secure your next 6-figure job to remain world-class.
London, England web3sec.news Joined June 2023
91 Following 1.6K Followers 1.5K Posts

Latest posts 5

Pinned post

Web3 Security News @web3sec_news
๐Ÿ.๐Ÿ“๐Ÿ—๐Ÿ• ๐„๐“๐‡. ๐Ÿ๐Ÿ• ๐ฌ๐ฎ๐ฉ๐ฉ๐จ๐ซ๐ญ๐ž๐ซ๐ฌ. ๐Ÿ ๐ฌ๐ก๐š๐ซ๐ž๐ ๐ฆ๐ข๐ฌ๐ฌ๐ข๐จ๐ง: ๐ฆ๐š๐ค๐ข๐ง๐  ๐–๐ž๐›๐Ÿ‘ ๐ฌ๐š๐Ÿ๐ž๐ซ ๐Ÿ๐จ๐ซ ๐ž๐ฏ๐ž๐ซ๐ฒ๐จ๐ง๐ž. ๐Ÿ’™

During @OctantAppโ€™s Epoch 9, 27 incredible people believed in our work at @web3sec_news and donated a total of 2.597 ETH, helping us continue building open, accessible security education for the Ethereum community.

But this story started long before that.

Between 2022โ€“2023, we personally wrote over 80+ hack analyses and realized there was no single place where researchers or writers could find reliable Web3 security intel, audits, or investigations.

So, we built one.
- What began as a small Twitter automation scraping security intel grew into Web3Sec, a full-fledged platform tracking hacks, audits, jobs, tools, blogs & podcasts.

- The community shaped everything.
People started asking for more audit reports, tools, newsletters, and podcasts, and thatโ€™s when projects like @cyfrin, @GuardianAudits, @audit_wizard, and @guardrailai came forward to support us.

That early support helped turn Web3Sec from a small idea into a public good.
Then came DigiBastion.com, built to solve one of the biggest ongoing issues: phishing, social engineering & private key compromises.
Itโ€™s a practical checklist-driven guide helping users harden their setups, stay cautious, and interact safely.

Because real security starts with awareness.

The 2.597 ETH raised in Epoch 9 will help us:
๐Ÿ”น Create more beginner-friendly security content
๐Ÿ”น Expand open-source guides & toolkits
๐Ÿ”น Host online learning sessions & job opportunities
๐Ÿ”น Onboard more people into Ethereum securely
Huge thanks to @OctantApp and @ethereumfndn for empowering small, mission-driven teams to make a real impact.

And to our 27 supporters, every single contribution tells us one thing loud and clear: security education matters.

Weโ€™re now looking for more collaborators & public goods believers to lock $GLM for the next epoch and keep building this mission forward.
Together, we can create a safer, smarter Web3 for everyone.
2 replies 2 reposts 14 likes 4.7K views View on X
Web3 Security News @web3sec_news
๐Ÿšจ AI coding agent browses the web, its browser is out of date and running without a sandbox. One bad page can reach your files, SSH keys and anything else on that machine.

Two minute fix below.
Raiders Verified account @__Raiders 5d
If your AI agent browses the web on the same machine as your keys or your wallet, do these four things today.

- Check what you're running: ls ~/.cache/ms-playwright (macOS: ~/Library/Caches/ms-playwright). chromium-1248 means you're on the stale build.
- Point it at your real Chrome instead: channel: 'chrome' and chromiumSandbox: true
- Pin your MCP version. Stop using @latest.
- Container anything that visits sites you don't control. Keep hot keys off that machine entirely.

Why:

Playwright 1.64.1 bundles Chromium 156.0.8078.4. Chrome stable has been on 156.0.8078.79 since Oct 29. There is no 1.65 stable, so there is nowhere to upgrade to right now.

And Playwright launches Chromium with the sandbox off by default. Their own docs: chromiumSandbox defaults to false. The sandbox is what stops a bad page from reaching the rest of your machine.

Stale browser, no sandbox, and an exploit runs as your user. Files, SSH keys, .env, live sessions, signing material if it's on the box.

The bugs, all triggered by loading a page:

- CVE-2026-118306 (9.6), memory corruption in FileSystem, escapes the sandbox on its own
- Three more at 8.8: CVE-2026-118331, CVE-2026-118348, CVE-2026-118344. A sandbox would normally contain these.

Not known exploited in the wild, and the realistic path is your agent getting steered to a hostile page.

Fix it anyway, it takes two minutes.

h/t @nisten
View quoted post on X
Web3 Security News @web3sec_news
this is closed, we've shared the 2 web3sec reserved community tickets with @ishannaik7 & @sidnaiks have a good one guys!
Web3 Security News @web3sec_news Nov 1
gm folks - we have a few DevCon tickets to share for FREE.

if you would like us to share them with you, please comment with the reason why you need one & confirm that you have plans to visit the venue tomorrow so ticket doesn't get misused
View quoted post on X
Web3 Security News @web3sec_news
Every audit starts before you open the repo now. If your opsec stops at 2FA and a hardware wallet, you're missing the part where the compromise actually happens. Check out Coldclone!
Dacian Verified account @DevDacian Jul 3
Introducing Coldclone - neutralize a wide range of auto-execution & prompt-injection attacks before opening an unknown repo. Don't ever quote an audit without it!

Shout out @__Raiders who contributed some code & ideas.

github.com/devdacian/coldโ€ฆ
View quoted post on X