🍲 meatybroth.com

‼️ New Dark Web Informer Blog Post!

Title: Citya Immobilier Dataset Claim Covers 2.2M+ Records and ~50K Digicodes

Link: https://darkwebinformer.com/citya-immobilier-dataset-claim-covers-2-2m-records-and-50k-digicodes/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

Caroline Ellison has joined Manifund

Austin: I’m happy to announce that Caroline Ellison has accepted a role at Manifund, to develop our funding platform and research how to effectively direct philanthropic dollars.

In fact, she started a work trial on July 13, which converted to a fulltime role on Aug 10. Over the past two months, she’s been publishing her work and supporting Manifund users under the pseudonym “Carol”.

How did I come to consider this at all?

• I specifically enjoyed https://worldoptimization.k55.io/ and https://forum.effectivealtruism.org/users/carolineellison, which I found thoughtful and relatable. I invited her to Manifest 2026, just because I wanted to meet her. During the festival, she came to my night market booth, and asked about joining our team, which I was interested to explore.
• I felt a keen debt to the FTX Future Fund. They provided seed funding for Manifold. They funded https://forum.effectivealtruism.org/posts/sdjcH7KAxgB328RAb/ftx-ea-fellowships which drew me into the EA community, and the https://www.futureforum.foundation/ where I met my wife. Much of Manifund’s work today is directly inspired by the https://ftxfuturefund.org.cach3.com/index.html%3Fp=21.html.
• On FTX itself, I remain conflicted. It was their money and spirit that enabled the Future Fund, and I still admire many aspects of FTX and the individuals who worked there. But also: FTX did wrong. Its collapse harmed users (myself included), and damaged the movement which I deeply care about. I may write more about this in the future, but in any case:
• I believe in redemption. Caroline has admitted her faults, worked to make creditors whole, and served her time in prison. I’d like to give her the opportunity to contribute back to the world; I hope that the world will concur.

Why did I hire Caroline for Manifund?

• Manifund needs talent. Leading AI labs warn about recursive self improvement; poverty and disease remain unsolved; billions of animals suffer hell on earth. I, my team, and many EAs I know, are often burning the midnight candle to address these wrongs. I don’t wish to sideline a pair of capable hands. (We’re https://manifund.substack.com/p/work-at-manifund-or-mox!)
• Caroline brings specific, useful expertise around finance and systems management to Manifund. I know this might seem like a joke — why would you trust someone who blew up an exchange? — but in fact she’s already been invaluable, for example building a reconciliation tool which identified several misregistered transactions in our database, in the 5-6 figures. (Obviously, she and I will be extremely motivated not to repeat FTX’s mistakes).
• Through working together, I’ve had the privilege to know Caroline as more than just an icon of FTX. I find her to be kind, humble, down to earth, hardworking, smart and witty. She cares deeply about doing right, for our users, our donors, and the world. She shares many of my sensibilities around extant problems of philanthropy; see, for example, https://manifund.substack.com/p/dont-default-to-nonprofit. She adores Ada, my 2yo daughter (and, the feeling is clearly mutual).

Manifund strives to be unusually transparent. And so, I apologize for our minor deception, in using a pseudonym over the last couple months. I still endorse having done this — I think it’s relatively common to work with people pseudonymously, when their real identity is famous. But I want to call out that we compromised on transparency here, which I do not take lightly.

I understand that some of our users, donors, and partners may now be skittish about working with Manifund, given this announcement. I appreciate any trust you are willing to extend, and ask that you judge us by our historical and future outputs. You (or your LLM) can take a look at Manifund’s https://github.com/manifund/manifund, https://manifund.org/docs, https://manifund.org/finances and https://manifund.substack.com/; if you wish, you can see Caroline’s specific https://github.com/manifund/manifund/commits?author=caroline-coding and https://manifund.org/carol on Manifund.

I’m happy to take questions, over public comments or emailed to mailto:austin@manifund.org. (I can’t promise I’ll be able to reply to every one.) In the meantime, I’d like to ask Caroline to say a few words.

Caroline: I’ve said a lot about what I did wrong at Alameda/FTX—you can read what I said at https://manifoldmarkets.notion.site/Caroline-s-plea-remarks-and-excerpts-from-trial-3d654492ea7a8016aed8dabf7349faeb. I’m deeply sorry for what I did, and I completely understand why people may not want to work with me. But I’m very grateful to Austin for giving me a second chance, and judging me on my current work performance rather than my past. I feel very lucky not only to have a job, but to be working somewhere that I think is doing great work and has a mission I believe in.

When I started my work trial, unsure if I’d get a full-time offer at the end, I didn’t want to go through a public announcement just to potentially be let go a month later. But now that I’ve accepted a full-time offer at Manifund, I want to be upfront about it.

I’m excited to continue improving our technical infrastructure, working on operations and customer support, and posting updates on our https://manifund.substack.com/.

I probably won’t reply to comments on this post—sorry.

https://www.lesswrong.com/posts/W3zn5jQa8fhmiBsPG/caroline-ellison-has-joined-manifund#comments

https://www.lesswrong.com/posts/W3zn5jQa8fhmiBsPG/caroline-ellison-has-joined-manifund

🚨 GitLab CVSS 10 vulnerability exploited just one day after disclosure

Threat actors have begun exploiting CVE-2026-85706, a critical path traversal vulnerability affecting self-hosted GitLab Community and Enterprise Edition instances. ⠀ The flaw allows an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server using a single HTTP request.

Affected versions include:

• GitLab 18.7 through versions before 19.1.8 • GitLab 19.2 through versions before 19.2.6 • GitLab 19.3 through versions before 19.3.2 ⠀ GitLab disclosed and patched the vulnerability on September 10.

Just one day later, watchTowr began observing in-the-wild exploitation attempts and warns that mass exploitation is likely to follow. ⠀ Administrators should upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or a newer supported release.

GitLab.com is already patched.

Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/

https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/253/567/686/568/981/original/27ab2c516a268803.webp