Shadowing Practice: The worst week in cybersecurity history... so far - Learn English Speaking with Video
בחר מצב תרגול
כל מצב פותח חדר תרגול במסך מלא.
73 משפטים
אם המשפטים קצרים או ארוכים מדי, לחץ על ערוך כדי להתאים אותם.
1
Last week, while you were busy researching how to buy emergency rice and beans in bulk,
2
a group of guys who technically aren't supposed to have internet access pulled off the largest theft in human history.
3
A code editor owned by a rocket company spent 11 hours letting anyone SSH into your laptop,
4
a prediction market got robbed in the middle of investigating its own customers for treason, and Anthropic showed that an unreleased
5
Cloud model could get root on any unpatched
6
Linux server just by sending it TCP packets.
7
In today's video, we'll break down just another Thursday in this godforsaken hellhole we're trapped in.
8
It is November 3rd, 2026, and we're watching the Code Report.
9
You know, I would love nothing more than to just talk about the latest JavaScript framework, but here we are again.
10
This time, it started last Thursday in the middle of the night when Cursor shipped a new official CloudCode extension.
11
Unfortunately, they shipped it without actually knowing they shipped it.
12
The extension would scan your machine for any keys or tokens it could find,
13
and then set up a backdoor for attackers to come in later and steal them.
14
It was only up for about 11 hours, but that was still long enough for around 5 ,000 people to install it.
15
Thankfully, the backdoor required admin rights, which most people don't give to their text editor, so the blast radius was pretty limited.
16
Meanwhile, around that same time, users on Polymarket started noticing that their funds were being drained simply by logging into the website.
17
Now, this isn't that unusual for Polymarket users, but what was unusual was this time it wasn't their fault.
18
It turns out a script from a company called DebugBear
19
that Polymarket uses for performance monitoring was hijacked to sell all
20
your current positions before wiring the proceeds to a hard -coded wallet.
21
The hackers ended up getting over $2 million worth of funds before Polymarket pulled the script, which seems like a lot until you realize
22
it's just a small price to pay on the road to destroying the lives of millions of young men across the world.
23
Thankfully for Polymarket, the news didn't last long because just a few hours later,
24
people started noticing something was up with Binance and it was way worse.
25
In about 20 minutes, $6 .3 billion with a B worth of crypto across 10 different blockchains left Binance's hot wallets,
26
which makes this the biggest theft in recorded history.
27
According to Binance, a DevOps laptop was compromised, which allowed the attackers to submit withdrawal requests, then Binance's own system signed them.
28
The next day, the FBI came out and said they believed that the North Korean group
29
Trader Trader was behind the attack which was the same group that stole 1 .5 billion from Bybit last year.
30
The good news is that if you had money on Binance is
31
that it stopped being your problem pretty quickly since crypto isn't actually decentralized.
32
Tether and Circle froze about $3 billion of the stolen stablecoins within an hour,
33
and then Binance froze all withdrawals and spent the weekend refilling its wallets out of its own treasury and insurance funds.
34
By Sunday, withdrawals were back on, and yesterday they posted proof of reserves showing everyone's balance was fully backed again,
35
to which the users responded by kindly withdrawing $3 .6 billion from Binance anyway.
36
And that wasn't even the worst part of the week.
37
Back in early October, a Linux kernel maintainer named Eric Dumizet pushed a simple two -line fix
38
that delayed freeing some memory until the kernel is sure nothing is still reading it.
39
At the time, it didn't seem like a big deal
40
and nobody really paid attention to it until a few weeks later
41
when it got a 9 .8 out of 10 on the CVSS scale, which is the industry's way of ranking how bad a security bug is.
42
It turns out that since 2016, every Linux kernel has had a bug in the code that handles new TCP connections.
43
The way it works is every connection starts with the client sending a hello packet and the server sending one back.
44
Normally, that first packet is pretty uninteresting, but you're allowed to attach a few extra options to it
45
if you want the kernel to save those so it can use them when it builds its reply.
46
The problem is that if the client sends the same hello twice at just the right moment,
47
the two parts of the kernel end up working on the same connection at once,
48
and one of them can free that saved memory while the other one is still reading it.
49
So the server ends up building its reply out of memory that's already been freed,
50
which means whatever else got written there in the meantime ends up in the reply, and if an attacker controls what that is,
51
they can control what the kernel does next.
52
Now getting that timing right is pretty tricky, which is why
53
Red Hat initially rated it as a moderate 5 .9, and figured the worst case scenario was that the kernel would just crash,
54
because if the exploit only works in one in a million tries,
55
it's basically safe as long as the person trying it gets bored and runs out of money.
56
The problem is that world no longer exists, which is exactly what Anthropic proved on October 27th
57
when its red team published a post saying they handed the bug to an unreleased Claude model, and in about 48 minutes,
58
the model had hit the timing enough times to get the server to leak a kernel memory address back to it.
59
And just five minutes after that, it was able to start running commands as root.
60
Debian and Oracle had patched kernels out within one day of the CVE, Red Hat took another two weeks to decide it was serious,
61
and finally shipped fixes over the weekend.
62
And Ubuntu still doesn't have one.
63
But at least you can protect your own codebase with CodeRabbit, the sponsor of today's video.
64
They got tired of seeing me make videos about new exploits hitting the timeline every week like this,
65
so they just launched CodeRabbit Secure to provide continuous code security that's powered by actual reasoning instead of brittle regex rules.
66
Their security agents are designed to think like an attacker.
67
in order to hunt for real vulnerabilities across your entire codebase.
68
Then it prioritizes actual risks based on reachability, exploitability, and blast radius.
69
And it explains the problem to you in plain English, and suggests a fix you can approve in Merge from the diff.
70
The CodeRabbit Secure reviews every PR before
71
Merge, and you can also schedule deep scans across your full codebase to protect your backdoor 24 -7.
72
Start with a free 14 -day trial at the link below, no credit card required.
73
This has been The Code Report, thanks for watching, and I will see you in the next one.
הורד אפליקציה
כל מה שאתה צריך כדי לדבר בשטף
הגיית AIציון לכל משפט
תרגול IPAשלוט בכל צליל
אוצר מיליםבנה את מאגר המילים שלך
משחק אוצר מיליםלמד תוך כדי משחק
אותו ערוץ
C11
PostgreSQL in 100 Seconds
American AccentDaily ConversationWorking Adults
C11
React Native in 100 Seconds
American AccentDaily ConversationUniversity Students
C13
Every app on Earth is now open source... whether it likes it or not
American AccentDaily ConversationWorking Adults
C14
Brainf**k in 100 Seconds
American AccentDaily ConversationUniversity Students
C12
Mind-bending new programming language for GPUs just dropped...
American AccentDaily ConversationUniversity Students
C130
Docker in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
C12
The last real programmers are dying out...
American AccentDaily ConversationUniversity StudentsWorking Adults
C16
The plan to break apart Google... RIP Chrome
American AccentBusiness EnglishDaily ConversationUniversity Students
C11
Did the AI bubble just pop?
American AccentDaily ConversationUniversity StudentsWorking Adults
C19
When open-sourcing your code goes wrong...
American AccentBusiness EnglishUniversity StudentsWorking Adults
B23
OpenAI’s new browser feels familiar…
American AccentBusiness EnglishUniversity StudentsWorking Adults
C19
The most interesting "hack" in history...
American AccentBusiness EnglishUniversity StudentsWorking Adults
C15
Tragic mistake... Anthropic leaks Claude’s source code
American AccentBusiness EnglishUniversity StudentsWorking Adults
B23
Firefox and Tor hit with 9.8 critical level exploit
American AccentBusiness EnglishUniversity StudentsWorking Adults
C12
C++ in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
C25
.NET in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
C12
China just dropped a new frontier model... and nobody can explain how
American AccentDaily ConversationUniversity StudentsWorking Adults
B24
Linux in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
C13
Did Google just dethrone OpenAI and Anthropic?
American AccentDaily ConversationUniversity StudentsWorking Adults
C116
VS Code in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
FOR YOU
המלץ על סרטון
C16
51 משפטים
Linux got wrecked by backdoor attack
American AccentDaily ConversationUniversity StudentsWorking Adults
C11
754 משפטים
Oligarchy is worse than you think
American AccentDaily ConversationUniversity StudentsWorking Adults
C1678 משפטים
So I tried Matt's skills...
American AccentDaily ConversationUniversity StudentsWorking Adults
B21
398 משפטים
THIS Is Where the Internet Lives
American AccentDaily ConversationUniversity StudentsWorking Adults
C13
173 משפטים
STOP Running Code On Your Computer
Daily ConversationUniversity StudentsWorking Adults
C11
65 משפטים
Did Anthropic Kill Git?
Daily ConversationUniversity StudentsWorking Adults
C13
444 משפטים
Here's what's REALLY Happening...
American AccentDaily ConversationWorking Adults
C11
292 משפטים
PirateSoftware is right, this needs to stop
American AccentDaily ConversationWorking Adults
B21
205 משפטים
The Man Who Stole MySpace | Samy
Daily ConversationUniversity StudentsWorking Adults
C12
182 משפטים
We Let $200 GPT-Pro Think for 7 Days on Unsolved Math
Daily ConversationUniversity StudentsWorking Adults
C12
169 משפטים
12 Things That Could Destroy Earth
Daily ConversationUniversity StudentsWorking Adults
אוצר מילים והערות הגייה לשיעור הזה
שיעור הדיבור הזה מבוסס על הסרטון “The worst week in cybersecurity history... so far”. המילים שחוזרות הכי הרבה: kernel, Binance, Polymarket, code. בסרטון הזה יש 73 משפטים ו-1151 מילים לתרגול Shadowing. הדיבור נמשך 5:30. הדובר מדבר מהר, כ-209 מילים בדקה, אז צפו לצלילים מחוברים ומקוצרים. רק 79% מהמילים נמצאות בין 3,000 המילים הנפוצות ביותר באנגלית, כך שאוצר המילים מאתגר.
אוצר מילים מרכזי בסרטון הזה
15 מילים מהסרטון שכדאי ללמוד, עם ההגייה והמשמעות שלהן:
| מילה | הגייה | משמעות |
|---|---|---|
| server שם עצם | /ˈsɝvɚ/ | שָׁרָת |
| steal פועל | /stiːl/ | גָּנַב, גָּזַל |
| wallet שם עצם | /ˈwɑl.ət/ | אַרְנָק |
| withdrawal שם עצם | /wɪðˈdɹɔ(ə)l/ | מְשִׁיכָה |
| packet שם עצם | /ˈpæk.ɪt/ | חֲבִילָה |
| laptop שם עצם | /ˈlæp.tɑp/ | מחשב נייד, מַחְשֵׁב נַיָּד |
| theft שם עצם | /θɛft/ | גְּנֵבָה, גָּזֵל |
| freeze פועל | /ˈfɹiːz/ | קָפָא |
| scan פועל | /skæn/ | סָרַק |
| meanwhile תואר הפועל | /ˈmiːnwaɪl/ | בינתיים |
| cloud שם עצם | /ˈklaʊ̯d/ | עָנָן, עָב |
| plain שם עצם | /pleɪn/ | מִישׁוֹר, עֲרָבָה |
| wire שם עצם | /ˈwaɪɚ/ | חוּט |
| delay שם עצם | /dɪˈleɪ̯/ | איחור, אִחוּר |
| log שם עצם | /lɔɡ/ | בּוּל עֵץ |
Phrasal verbs שתשמעו
| מילה | הגייה | משמעות |
|---|---|---|
| come out פועל | /ˌkʌm ˈaʊt/ | יָצָא |
דקדוק בסרטון הזה
המבנים שהדובר משתמש בהם הכי הרבה, עם המילים המדויקות מהסרטון:
| מבנה | בסרטון |
|---|---|
| סביל (Passive voice) be + past participle — הדגש הוא על מה שקורה, לא על מי שעושה את הפעולה | being drained · was hijacked · was compromised |
| משפטי זיקה (Relative clauses) who / which + clause — מידע נוסף על אדם או דבר | guys who technically · attack which was · scale, which is |
| הווה מושלם (Present perfect) have/has + past participle — פעולה שקרתה בעבר ועדיין יש לה חשיבות או השפעה עכשיו | has had · that's already been freed · has been |
הגייה ששווה לשים לב אליה
הדובר משתמש ב-13 קיצורים וצורות מקוצרות, כמו didn't, isn't, wasn't. אמרו אותם בצורה הקצרה, כפי שאתם שומעים אותם.
- הצלילים של “th”: withdrawal /wɪðˈdɹɔ(ə)l/, theft /θɛft/, withdraw /wɪðˈdɹɔ/, tether /ˈtɛðəɹ/
- הצלילים של “sh” ו-“zh”: extension /ɪkˈstɛnʃən/, unusual /ʌnˈjuːʒ(u)əl/, treasury /ˈtɹɛʒ.ɚ.i/, prediction /pɹɪˈdɪkʃən/
- מילים ארוכות — שימו לב להטעמה: unusual /ʌnˈjuːʒ(u)əl/, investigate /ɪnˈvɛs.tə.ɡeɪt/, continuous /kənˈtɪn.juː.əs/, technically /ˈtɛk.nɪˌkəl.i/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/
צלילים שדוברי עברית מתקשים בהם:
- /w/ — שפתיים מעוגלות, לא /v/: wallet /ˈwɑl.ət/, withdrawal /wɪðˈdɹɔ(ə)l/, meanwhile /ˈmiːnwaɪl/, wire /ˈwaɪɚ/, framework /ˈfɹeɪm.wɜːk/
- /æ/ — פתוח יותר מה-“אֶ” העברית, לא כמו “a” ב-“cup”: attacker /əˈtækɚ/, packet /ˈpæk.ɪt/, blast /blæst/, laptop /ˈlæp.tɑp/, scan /skæn/
- /r/ — הלשון לא נוגעת בשום מקום, לא ה-“ר” הגרונית: withdrawal /wɪðˈdɹɔ(ə)l/, script /skɹɪpt/, freeze /ˈfɹiːz/, radius /ˈɹeɪ.di.əs/, crypto /ˈkɹɪptoʊ/
איך לתרגל עם הסרטון הזה
- הקשיבו לכל הסרטון פעם אחת בלי לדבר, ורשמו את המילים שאתם לא מכירים.
- התחילו במהירות 0.75×, תרגלו Shadowing משפט אחר משפט, וחזרו למהירות רגילה כשזה מרגיש קל.
- הקליטו את עצמכם והשוו למקור, תוך תשומת לב למילים כמו server, steal, wallet.
מהי טכניקת השאדואינג?
שאדואינג היא טכניקת למידת שפה מבוססת מדע שפותחה במקור להכשרת מתורגמנים מקצועיים ופופולרית על ידי הפוליגלוט ד"ר אלכסנדר ארגואלס. השיטה פשוטה אך עוצמתית: אתה מקשיב לאודיו באנגלית ילידית וחוזר עליו בקול רם מיד — כמו צל העוקב אחרי הדובר עם עיכוב של 1–2 שניות בלבד. בניגוד להאזנה פסיבית או תרגילי דקדוק, שאדואינג מכריח את המוח והשרירים בפה לעבד ולשחזר דפוסי דיבור אמיתיים בו זמנית. מחקרים מראים שזה משפר משמעותית את דיוק ההגייה, האינטונציה, הקצב, הדיבור המחובר, הבנת השמיעה ושטף הדיבור — מה שהופך אותו לאחת השיטות היעילות ביותר להכנה לIELTS Speaking ולתקשורת באנגלית בעולם האמיתי.