シャドーイング練習: The worst week in cybersecurity history... so far - 動画で英語スピーキングを学ぶ

練習モードを選ぶ

各モードは全画面の練習ルームで開きます。

73 文

文が短すぎたり長すぎる場合は、Editをタップして調整してください。

Last week, while you were busy researching how to buy emergency rice and beans in bulk,

a group of guys who technically aren't supposed to have internet access pulled off the largest theft in human history.

A code editor owned by a rocket company spent 11 hours letting anyone SSH into your laptop,

a prediction market got robbed in the middle of investigating its own customers for treason, and Anthropic showed that an unreleased

Cloud model could get root on any unpatched

Linux server just by sending it TCP packets.

In today's video, we'll break down just another Thursday in this godforsaken hellhole we're trapped in.

It is November 3rd, 2026, and we're watching the Code Report.

You know, I would love nothing more than to just talk about the latest JavaScript framework, but here we are again.

This time, it started last Thursday in the middle of the night when Cursor shipped a new official CloudCode extension.

Unfortunately, they shipped it without actually knowing they shipped it.

The extension would scan your machine for any keys or tokens it could find,

and then set up a backdoor for attackers to come in later and steal them.

It was only up for about 11 hours, but that was still long enough for around 5 ,000 people to install it.

Thankfully, the backdoor required admin rights, which most people don't give to their text editor, so the blast radius was pretty limited.

Meanwhile, around that same time, users on Polymarket started noticing that their funds were being drained simply by logging into the website.

Now, this isn't that unusual for Polymarket users, but what was unusual was this time it wasn't their fault.

It turns out a script from a company called DebugBear

that Polymarket uses for performance monitoring was hijacked to sell all

your current positions before wiring the proceeds to a hard -coded wallet.

The hackers ended up getting over $2 million worth of funds before Polymarket pulled the script, which seems like a lot until you realize

it's just a small price to pay on the road to destroying the lives of millions of young men across the world.

Thankfully for Polymarket, the news didn't last long because just a few hours later,

people started noticing something was up with Binance and it was way worse.

In about 20 minutes, $6 .3 billion with a B worth of crypto across 10 different blockchains left Binance's hot wallets,

which makes this the biggest theft in recorded history.

According to Binance, a DevOps laptop was compromised, which allowed the attackers to submit withdrawal requests, then Binance's own system signed them.

The next day, the FBI came out and said they believed that the North Korean group

Trader Trader was behind the attack which was the same group that stole 1 .5 billion from Bybit last year.

The good news is that if you had money on Binance is

that it stopped being your problem pretty quickly since crypto isn't actually decentralized.

Tether and Circle froze about $3 billion of the stolen stablecoins within an hour,

and then Binance froze all withdrawals and spent the weekend refilling its wallets out of its own treasury and insurance funds.

By Sunday, withdrawals were back on, and yesterday they posted proof of reserves showing everyone's balance was fully backed again,

to which the users responded by kindly withdrawing $3 .6 billion from Binance anyway.

And that wasn't even the worst part of the week.

Back in early October, a Linux kernel maintainer named Eric Dumizet pushed a simple two -line fix

that delayed freeing some memory until the kernel is sure nothing is still reading it.

At the time, it didn't seem like a big deal

and nobody really paid attention to it until a few weeks later

when it got a 9 .8 out of 10 on the CVSS scale, which is the industry's way of ranking how bad a security bug is.

It turns out that since 2016, every Linux kernel has had a bug in the code that handles new TCP connections.

The way it works is every connection starts with the client sending a hello packet and the server sending one back.

Normally, that first packet is pretty uninteresting, but you're allowed to attach a few extra options to it

if you want the kernel to save those so it can use them when it builds its reply.

The problem is that if the client sends the same hello twice at just the right moment,

the two parts of the kernel end up working on the same connection at once,

and one of them can free that saved memory while the other one is still reading it.

So the server ends up building its reply out of memory that's already been freed,

which means whatever else got written there in the meantime ends up in the reply, and if an attacker controls what that is,

they can control what the kernel does next.

Now getting that timing right is pretty tricky, which is why

Red Hat initially rated it as a moderate 5 .9, and figured the worst case scenario was that the kernel would just crash,

because if the exploit only works in one in a million tries,

it's basically safe as long as the person trying it gets bored and runs out of money.

The problem is that world no longer exists, which is exactly what Anthropic proved on October 27th

when its red team published a post saying they handed the bug to an unreleased Claude model, and in about 48 minutes,

the model had hit the timing enough times to get the server to leak a kernel memory address back to it.

And just five minutes after that, it was able to start running commands as root.

Debian and Oracle had patched kernels out within one day of the CVE, Red Hat took another two weeks to decide it was serious,

and finally shipped fixes over the weekend.

And Ubuntu still doesn't have one.

But at least you can protect your own codebase with CodeRabbit, the sponsor of today's video.

They got tired of seeing me make videos about new exploits hitting the timeline every week like this,

so they just launched CodeRabbit Secure to provide continuous code security that's powered by actual reasoning instead of brittle regex rules.

Their security agents are designed to think like an attacker.

in order to hunt for real vulnerabilities across your entire codebase.

Then it prioritizes actual risks based on reachability, exploitability, and blast radius.

And it explains the problem to you in plain English, and suggests a fix you can approve in Merge from the diff.

The CodeRabbit Secure reviews every PR before

Merge, and you can also schedule deep scans across your full codebase to protect your backdoor 24 -7.

Start with a free 14 -day trial at the link below, no credit card required.

This has been The Code Report, thanks for watching, and I will see you in the next one.

アプリをダウンロード

流暢に話すために必要なすべて

AI発音採点文ごとに採点

IPA練習すべての音をマスター

単語学習自分の単語帳を作る

単語ゲーム遊びながら覚える

QRをスキャン

Download on theApp Store Get it onGoogle Play

同じチャンネル

FOR YOU

このレッスンの語彙とスピーキングのポイント

このスピーキングレッスンは、動画「The worst week in cybersecurity history... so far」を教材にしています。繰り返し出てくる語は次のとおりです：kernel, Binance, Polymarket, code。この動画には、シャドーイング用の文が73文、単語が1151語あります。音声の長さは5:30です。話す速さは速く、1分あたり約209語です。音のつながりや弱く発音される音が多くなります。英語の頻出3,000語に含まれる単語は79%だけなので、語彙は難しめです。

この動画の重要語彙

動画に出てくる覚えておきたい単語15語を、発音と意味つきで紹介します。

単語	発音	意味
kernel 名詞	/ˈkɝ.nəl/	核心
server 名詞	/ˈsɝvɚ/	サーバー
steal 動詞	/stiːl/	盗む
wallet 名詞	/ˈwɑl.ət/	財布, 札入れ
withdrawal 名詞	/wɪðˈdɹɔ(ə)l/	引き出し, 出金
packet 名詞	/ˈpæk.ɪt/	パケット, 小包
extension 名詞	/ɪkˈstɛnʃən/	拡張, 拡大
unusual 形容詞	/ʌnˈjuːʒ(u)əl/	珍しい
script 名詞	/skɹɪpt/	文書, 文章
blast 名詞	/blæst/	疾風, 突風
laptop 名詞	/ˈlæp.tɑp/	ノートパソコン, ラップトップ
theft 名詞	/θɛft/	盗み, 窃盗
freeze 動詞	/ˈfɹiːz/	凍る
radius 名詞	/ˈɹeɪ.di.əs/	橈骨
exploit 名詞	/ˈɛksplɔɪt/	偉業

動画に出てくる句動詞

単語	発音	意味
come out 動詞	/ˌkʌm ˈaʊt/	出る

この動画の文法

話し手がよく使っている文型を、動画の実際の表現とともに紹介します。

文型	動画での表現
受動態 be + 過去分詞 — 誰がするかより、何が起きるかに焦点を当てる	being drained · was hijacked · was compromised
関係詞節 who / which + 節 — 人や物について情報を加える	guys who technically · attack which was · scale, which is
現在完了形 have/has + 過去分詞 — 過去の出来事が今も関係している	has had · that's already been freed · has been

注意したい発音

話し手はdidn't, isn't, wasn'tなど、短縮形や弱形を13回使っています。聞こえたとおりの短い形で発音しましょう。

「th」の音: withdrawal /wɪðˈdɹɔ(ə)l/, theft /θɛft/, withdraw /wɪðˈdɹɔ/, tether /ˈtɛðəɹ/
「sh」と「zh」の音: extension /ɪkˈstɛnʃən/, unusual /ʌnˈjuːʒ(u)əl/, treasury /ˈtɹɛʒ.ɚ.i/, prediction /pɹɪˈdɪkʃən/
長い単語（アクセントの位置に注意）: unusual /ʌnˈjuːʒ(u)əl/, investigate /ɪnˈvɛs.tə.ɡeɪt/, continuous /kənˈtɪn.juː.əs/, technically /ˈtɛk.nɪˌkəl.i/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/

日本語話者が苦手な音：

/r/ と /l/ の区別 — /l/ は舌先を歯茎につけ、/r/ はどこにもつけない: withdrawal /wɪðˈdɹɔ(ə)l/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, brittle /ˈbɹɪtəl/, decentralize /diːˈsɛntɹəlaɪz/, refill /ˈɹiː.fɪl/
/v/ — /b/ にならないように、上の歯を下唇に当てる: server /ˈsɝvɚ/, investigate /ɪnˈvɛs.tə.ɡeɪt/, approve /əˈpɹuːv/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/
/f/ — 「フ」ではなく、上の歯と下唇で出す: theft /θɛft/, freeze /ˈfɹiːz/, framework /ˈfɹeɪm.wɜːk/, godforsaken /ˌɡɒd.fə(ɹ)ˈseɪ.kɪn/, refill /ˈɹiː.fɪl/

この動画での練習方法

まず声を出さずに動画を最後まで聞き、知らない単語をメモします。
まず0.75倍速で一文ずつシャドーイングし、慣れてきたら通常の速度に戻します。
自分の声を録音して元の音声と比べます。kernel, server, stealなどの単語に特に注意しましょう。

シャドーイングとは？英語上達に効果的な理由

シャドーイング（Shadowing）は、もともとプロの通訳者養成プログラムで開発された言語学習法で、多言語習得者として知られるDr. Alexander Arguelles によって広く普及されました。方法はシンプルですが非常に効果的：ネイティブスピーカーの英語を聞きながら、1〜2秒の遅延で声に出してすぐに繰り返す——まるで「影（shadow）」のように話者を追いかけます。文法ドリルや受動的なリスニングと異なり、シャドーイングは脳と口の筋肉が同時にリアルタイムで英語を処理・再現することを強制します。研究により、発音精度、抑揚、リズム、連音、リスニング力、そして会話の流暢さが大幅に向上することが確認されています。IELTSスピーキング対策や自然な英語コミュニケーションを目指す方に特におすすめです。

シャドーイングのやり方: ステップ別の完全ガイドを読む →

シャドーイング練習: The worst week in cybersecurity history... so far - 動画で英語スピーキングを学ぶ

練習モードを選ぶ

アプリをダウンロード

PostgreSQL in 100 Seconds

React Native in 100 Seconds

Every app on Earth is now open source... whether it likes it or not

Brainf**k in 100 Seconds

OpenAI’s lead engineer was secretly a spy...

Mind-bending new programming language for GPUs just dropped...

China just dropped a new frontier model... and nobody can explain how

The last real programmers are dying out...

Did the AI bubble just pop?

Docker in 100 Seconds

The plan to break apart Google... RIP Chrome

OpenAI’s new browser feels familiar…

Angular in 100 Seconds

The most interesting "hack" in history...

Tragic mistake... Anthropic leaks Claude’s source code

Firefox and Tor hit with 9.8 critical level exploit

5 open source tools that replaced my $320/mo AI stack...

C++ in 100 Seconds

Linux in 100 Seconds

Did Google just dethrone OpenAI and Anthropic?

STOP Running Code On Your Computer

They JUST Accidentally Revealed the Truth: The AI Bubble

Did Anthropic Kill Git?

Pavel Durov | Communication Technology and the Struggle for Freedom

The Anatomy of Fraud

The Man Who Stole MySpace | Samy

It’s not just you

How I deploy serverless containers for free

NotPetya Attack

I read Anthropic's 92-page risk factor document, so you don't have to | Explainer