Look 👀 who’s coming to the DMV Hosting in Tysons Corner One lucky 🍀 guy got a #hotdate# with both of us in PR .. could you be next ? AndiJamesxxx@gmail.com 9/1 -9/4 Bookinglanalee@gmail.com 9/2 -9/6

According to The Inquisitive Problem Solver, the only positive integer solution to: A × B × C = C × D × E = E × F × G is: 8 × 1 × 9 = 9 × 2 × 4 = 4 × 6 × 3, if we assume that each variable must be a single digit.

CHOOSE YOUR FIGHTER Warren Buffett vs Stanley Druckenmiller Buffett stepped down as Charman of Berkshire Hathaway $BRK.B today. Druckenmiller has never had a losing year in more than 30 years. Here are their full portfolios as of Q2 2026. BERKSHIRE HATHAWAY - Apple $AAPL: 22% - American Express $AXP: 17% - Google $GOOGL: about 12.6% across both share classes - Coca-Cola $KO: 11% - Bank of America $BAC: 9.2% - Chevron $CVX: 4.7% - Occidental $OXY: 4.3% - Chubb $CB: 3.9% - Moody's $MCO: 3.7% - Kraft Heinz $KHC: 2.6% - DaVita $DVA: 2.1% - Delta $DAL: 1.8% - SiriusXM $SIRI: 1.2% - VeriSign $VRSN: 0.8% - Kroger $KR: 0.7% - Liberty Live $LLYVA: about 0.6% across both share classes - Ally $ALLY: 0.4% - Lennar $LEN: 0.4% - New York Times $NYT: 0.4% - Capital One $COF: 0.2% - Louisiana-Pacific $LPX: 0.1% - Nucor $NUE: 0.1% - Macy's $M: 0.1% - NVR $NVR - Jefferies $JEF - D.R. Horton $DHI DUQUESNE FAMILY OFFICE - Natera $NTRA: 17% - Insmed $INSM: about 5.7% in shares and calls - Taiwan Semi $TSM: 5.4% - Brazil ETF $EWZ: about 5.1% in shares and calls - Amazon $AMZN: about 4.6% in shares and calls - STMicro $STM: 4.5% - S&P 500 Equal Weight $RSP: about 3.7% in calls and shares - Fox $FOXA: about 2.8% across both share classes - YPF $REPYY: 2.7% - CDW $CDW: about 2.7% in shares and calls - BBB Foods $TBBB: 2.3% - Google $GOOGL: 2.3% - Seagate blockstack:native: 2.3% - United Airlines $UAL: 2.1% - Sea $SE: 2.0% - NewAmsterdam Pharma $NAMS: 2.0% - Russell 2000 ETF $IWM: 1.9% in calls - Sandisk $SNDK: 1.5% - Revolution Medicines $RVMD: 1.4% - S&P 500 ETF: 1.3% in calls - Bitdeer: 1.2% - CRH: 1.1% - Delta: 1.1% - Tesla $TSLA: 1.0% in calls - Fluor: 1.0% - D.R. Horton: 0.9% - Coupang: 0.9% - AMD: 0.8% - Palo Alto Networks: 0.8% - Cleveland-Cliffs: 0.8% - Hut 8: 0.7% - Caris Life Sciences: 0.6% - Argentina ETF: 0.6% - Woodward: 0.5% - Meta: 0.5% in calls - Nuvation Bio: 0.5% - Protagonist Therapeutics: 0.5% - Roku: 0.5% - Cavco: 0.5% - ADMA Biologics: 0.4% - Hyperliquid Strategies: 0.4% - Rambus: 0.4% - Rhythm Pharmaceuticals: 0.4% - Champion Homes: 0.4% - Daktronics: 0.4% - PureCycle: 0.4% - Southern Copper: 0.4% - Linde: 0.4% - Entegris: 0.4% - Teva: 0.4% - Unity: 0.4% - Aeva: 0.4% - Riot Platforms: 0.4% - Qnity Electronics: 0.4% - Equinix: 0.4% - Lam Research: 0.4% - Definium Therapeutics: 0.3% - Belite Bio: 0.3% - 10x Genomics: 0.3% - Wabtec: 0.3% - Eli Lilly: 0.3% - Xenon Pharmaceuticals: 0.3% - Olema Pharmaceuticals: 0.2% - Repligen: 0.2% - Rocket Companies: 0.2% - Baidu: 0.2% - Arm: 0.2% - Carvana: 0.2% - Reddit: 0.2% - Alcoa: 0.2% - Thermo Fisher: 0.2% - Danaher: 0.2% - F5: 0.2% - Vista Energy: 0.2% - Skeena Resources: 0.2% - JBS: 0.1% - Monte Rosa Therapeutics: 0.1% - Relay Therapeutics: 0.1% - DBV Technologies: 0.1% - CCC Intelligent Solutions: 0.1% - UWM Holdings: 0.1% - Navitas Semiconductor: 0.1% - Solstice Advanced Materials: 0.1% - FTAI Aviation: 0.1% - Beam Therapeutics: 0.1% - Aurora Innovation: 0.1% - IREN: 0.1% - Grupo Financiero Galicia: 0.1% - Wave Life Sciences: under 0.1% Both own Google, Delta and D.R. Horton. Neither owns Nvidia $NVDA.

🇮🇳 Total fertility rate in India since 1950 2026: 1.9 2020: 2.05 2015: 2.29 2010: 2.60 2005: 2.96 2000: 3.35 1995: 3.65 1990: 4.05 1985: 4.43 1980: 4.78 1975: 5.20 1970: 5.62 1965: 5.94 1960: 5.92 1955: 5.91 1950: 5.73

🚨 node-ipc is compromised again. Three new malicious versions just dropped: 9.1.6, 9.2.3, and 12.0.1. Socket’s AI scanner flagged them as malware within three minutes of publication. The attack vector: a dormant maintainer account (atiertant) was likely taken over via an expired email domain. The attacker registered the lapsed domain, triggered an npm password reset, and gained publish rights to a package with millions of historical downloads. The payload is a credential stealer embedded in the CommonJS entrypoint (node-ipc.cjs). It activates on require(“node-ipc”), not through a postinstall script. Here’s what it does: •Fingerprints the host (OS, arch, hostname, uname) •Harvests 113-127 credential file patterns depending on platform (AWS, GCP, Azure, SSH keys, Kubernetes configs, npm tokens, .env files, shell histories, macOS Keychain databases, and more) •Dumps the entire process.env, capturing every CI secret and cloud credential in memory •Builds a gzip archive in a temp directory •Exfiltrates everything over DNS TXT queries to bt[.]node[.]js, using a bootstrap resolver at sh[.]azurestaticprovider[.]net:443 (a deliberate lookalike of Microsoft’s Azure Static Web Apps domain) The DNS exfiltration is chunked. A 500 KB archive generates roughly 29,400 TXT queries. The body is XOR-encrypted with a SHA-256 keystream, base64-encoded, alphabet-substituted, and split into 31-character chunks before hex-encoding into DNS labels. Header, data, and footer queries use xh, xd, and xf prefixes respectively. The malware forks a detached child process (env var __ntw=1) so credential theft runs silently in the background. It also exposes a __ntRun export, meaning any downstream code that calls require(“node-ipc”).__ntRun() can trigger a second collection/exfiltration cycle. ESM-only consumers using the import path are not affected by the reviewed package metadata. CommonJS consumers are. This is the same package involved in the 2022 protestware incident. It has a history. If you use node-ipc: •Do not install 9.1.6, 9.2.3, or 12.0.1 •Audit your lockfiles for these versions •If you loaded the CommonJS entrypoint, treat all environment variables, SSH keys, cloud credentials, npm tokens, and local secrets as compromised. Rotate immediately. •Hunt for DNS TXT queries to bt[.]node[.]js and sh[.]azurestaticprovider[.]net in your network logs •Check for temp files matching /nt-/.tar.gz Credit to Ian Ahl (@TekDefense) for first publicly identifying the expired-domain account takeover vector. Developing story. Full technical breakdown and IOCs on the Socket blog: