쉐도잉 연습: The worst week in cybersecurity history... so far - 영상으로 영어 말하기 배우기

연습 모드 선택

각 모드는 전체 화면 연습실로 열립니다.

73 문장

문장이 너무 짧거나 길면 Edit를 눌러 조정하세요.

Last week, while you were busy researching how to buy emergency rice and beans in bulk,

a group of guys who technically aren't supposed to have internet access pulled off the largest theft in human history.

A code editor owned by a rocket company spent 11 hours letting anyone SSH into your laptop,

a prediction market got robbed in the middle of investigating its own customers for treason, and Anthropic showed that an unreleased

Cloud model could get root on any unpatched

Linux server just by sending it TCP packets.

In today's video, we'll break down just another Thursday in this godforsaken hellhole we're trapped in.

It is November 3rd, 2026, and we're watching the Code Report.

You know, I would love nothing more than to just talk about the latest JavaScript framework, but here we are again.

This time, it started last Thursday in the middle of the night when Cursor shipped a new official CloudCode extension.

Unfortunately, they shipped it without actually knowing they shipped it.

The extension would scan your machine for any keys or tokens it could find,

and then set up a backdoor for attackers to come in later and steal them.

It was only up for about 11 hours, but that was still long enough for around 5 ,000 people to install it.

Thankfully, the backdoor required admin rights, which most people don't give to their text editor, so the blast radius was pretty limited.

Meanwhile, around that same time, users on Polymarket started noticing that their funds were being drained simply by logging into the website.

Now, this isn't that unusual for Polymarket users, but what was unusual was this time it wasn't their fault.

It turns out a script from a company called DebugBear

that Polymarket uses for performance monitoring was hijacked to sell all

your current positions before wiring the proceeds to a hard -coded wallet.

The hackers ended up getting over $2 million worth of funds before Polymarket pulled the script, which seems like a lot until you realize

it's just a small price to pay on the road to destroying the lives of millions of young men across the world.

Thankfully for Polymarket, the news didn't last long because just a few hours later,

people started noticing something was up with Binance and it was way worse.

In about 20 minutes, $6 .3 billion with a B worth of crypto across 10 different blockchains left Binance's hot wallets,

which makes this the biggest theft in recorded history.

According to Binance, a DevOps laptop was compromised, which allowed the attackers to submit withdrawal requests, then Binance's own system signed them.

The next day, the FBI came out and said they believed that the North Korean group

Trader Trader was behind the attack which was the same group that stole 1 .5 billion from Bybit last year.

The good news is that if you had money on Binance is

that it stopped being your problem pretty quickly since crypto isn't actually decentralized.

Tether and Circle froze about $3 billion of the stolen stablecoins within an hour,

and then Binance froze all withdrawals and spent the weekend refilling its wallets out of its own treasury and insurance funds.

By Sunday, withdrawals were back on, and yesterday they posted proof of reserves showing everyone's balance was fully backed again,

to which the users responded by kindly withdrawing $3 .6 billion from Binance anyway.

And that wasn't even the worst part of the week.

Back in early October, a Linux kernel maintainer named Eric Dumizet pushed a simple two -line fix

that delayed freeing some memory until the kernel is sure nothing is still reading it.

At the time, it didn't seem like a big deal

and nobody really paid attention to it until a few weeks later

when it got a 9 .8 out of 10 on the CVSS scale, which is the industry's way of ranking how bad a security bug is.

It turns out that since 2016, every Linux kernel has had a bug in the code that handles new TCP connections.

The way it works is every connection starts with the client sending a hello packet and the server sending one back.

Normally, that first packet is pretty uninteresting, but you're allowed to attach a few extra options to it

if you want the kernel to save those so it can use them when it builds its reply.

The problem is that if the client sends the same hello twice at just the right moment,

the two parts of the kernel end up working on the same connection at once,

and one of them can free that saved memory while the other one is still reading it.

So the server ends up building its reply out of memory that's already been freed,

which means whatever else got written there in the meantime ends up in the reply, and if an attacker controls what that is,

they can control what the kernel does next.

Now getting that timing right is pretty tricky, which is why

Red Hat initially rated it as a moderate 5 .9, and figured the worst case scenario was that the kernel would just crash,

because if the exploit only works in one in a million tries,

it's basically safe as long as the person trying it gets bored and runs out of money.

The problem is that world no longer exists, which is exactly what Anthropic proved on October 27th

when its red team published a post saying they handed the bug to an unreleased Claude model, and in about 48 minutes,

the model had hit the timing enough times to get the server to leak a kernel memory address back to it.

And just five minutes after that, it was able to start running commands as root.

Debian and Oracle had patched kernels out within one day of the CVE, Red Hat took another two weeks to decide it was serious,

and finally shipped fixes over the weekend.

And Ubuntu still doesn't have one.

But at least you can protect your own codebase with CodeRabbit, the sponsor of today's video.

They got tired of seeing me make videos about new exploits hitting the timeline every week like this,

so they just launched CodeRabbit Secure to provide continuous code security that's powered by actual reasoning instead of brittle regex rules.

Their security agents are designed to think like an attacker.

in order to hunt for real vulnerabilities across your entire codebase.

Then it prioritizes actual risks based on reachability, exploitability, and blast radius.

And it explains the problem to you in plain English, and suggests a fix you can approve in Merge from the diff.

The CodeRabbit Secure reviews every PR before

Merge, and you can also schedule deep scans across your full codebase to protect your backdoor 24 -7.

Start with a free 14 -day trial at the link below, no credit card required.

This has been The Code Report, thanks for watching, and I will see you in the next one.

앱 다운로드

유창하게 말하는 데 필요한 모든 것

AI 발음 평가문장마다 점수 확인

IPA 발음 연습모든 소리 마스터

단어 학습나만의 단어장 만들기

단어 게임놀면서 외우기

QR 스캔

Download on theApp Store Get it onGoogle Play

같은 채널

FOR YOU

이 레슨의 어휘와 말하기 포인트

이 말하기 레슨은 영상 “The worst week in cybersecurity history... so far”을(를) 바탕으로 합니다. 가장 자주 반복되는 단어는 다음과 같습니다: kernel, Binance, Polymarket, code. 이 영상에는 섀도잉할 문장 73개와 단어 1151개가 있습니다. 말하는 구간의 길이는 5:30입니다. 화자는 분당 약 209단어로 빠르게 말하므로 연음과 약하게 발음되는 소리가 많습니다. 영어에서 가장 많이 쓰이는 3,000단어에 속하는 단어가 79%뿐이라 어휘가 어려운 편입니다.

이 영상의 핵심 어휘

영상에 나오는 익혀 둘 만한 단어 15개를 발음, 뜻과 함께 정리했습니다.

단어	발음	뜻
kernel 명사	/ˈkɝ.nəl/	핵심
server 명사	/ˈsɝvɚ/	서버, 봉사기
steal 동사	/stiːl/	훔치다
wallet 명사	/ˈwɑl.ət/	지갑
withdrawal 명사	/wɪðˈdɹɔ(ə)l/	인출, 출금
packet 명사	/ˈpæk.ɪt/	패킷, 소포
script 명사	/skɹɪpt/	문서, 문장
laptop 명사	/ˈlæp.tɑp/	노트북, 랩톱
theft 명사	/θɛft/	도둑질, 절도
freeze 동사	/ˈfɹiːz/	얼다
radius 명사	/ˈɹeɪ.di.əs/	노뼈, 요골
exploit 명사	/ˈɛksplɔɪt/	위업, 공훈
cloud 명사	/ˈklaʊ̯d/	구름
plain 명사	/pleɪn/	평지, 평야
wire 명사	/ˈwaɪɚ/	철사

영상에 나오는 구동사

단어	발음	뜻
come out 동사	/ˌkʌm ˈaʊt/	나오다
get over 동사		극복하다

이 영상의 문법

화자가 가장 많이 쓰는 문형을 영상 속 실제 표현과 함께 정리했습니다.

문형	영상 속 표현
수동태 be + 과거분사 — 누가 하는지보다 무슨 일이 일어나는지에 초점	being drained · was hijacked · was compromised
관계절 who / which + 절 — 사람이나 사물에 대한 추가 정보	guys who technically · attack which was · scale, which is
현재완료 have/has + 과거분사 — 과거의 일이 지금도 관련이 있을 때	has had · that's already been freed · has been

주의할 발음

화자는 didn't, isn't, wasn't 같은 축약형과 약화된 형태를 13번 사용합니다. 들리는 대로 짧게 발음하세요.

“th” 소리: withdrawal /wɪðˈdɹɔ(ə)l/, theft /θɛft/, withdraw /wɪðˈdɹɔ/, tether /ˈtɛðəɹ/
“sh”와 “zh” 소리: extension /ɪkˈstɛnʃən/, unusual /ʌnˈjuːʒ(u)əl/, treasury /ˈtɹɛʒ.ɚ.i/, prediction /pɹɪˈdɪkʃən/
긴 단어 — 강세 위치에 주의: unusual /ʌnˈjuːʒ(u)əl/, investigate /ɪnˈvɛs.tə.ɡeɪt/, continuous /kənˈtɪn.juː.əs/, technically /ˈtɛk.nɪˌkəl.i/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/

한국어 화자가 어려워하는 소리:

/f/ — ㅍ(/p/)으로 바꾸지 말고 윗니를 아랫입술에 대기: theft /θɛft/, freeze /ˈfɹiːz/, framework /ˈfɹeɪm.wɜːk/, godforsaken /ˌɡɒd.fə(ɹ)ˈseɪ.kɪn/, refill /ˈɹiː.fɪl/
/v/ — ㅂ(/b/)과 구별하기: server /ˈsɝvɚ/, investigate /ɪnˈvɛs.tə.ɡeɪt/, approve /əˈpɹuːv/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/
/z/ — ㅈ이 아니라 성대를 울리는 /s/: freeze /ˈfɹiːz/, compromise /ˈkɑmpɹəˌmaɪz/, treason /ˈtɹiː.zən/, decentralize /diːˈsɛntɹəlaɪz/, prioritize /pɹaɪˈɒɹ.ə.taɪz/

이 영상으로 연습하는 방법

먼저 말하지 않고 영상을 끝까지 듣고 모르는 단어를 적어 둡니다.
0.75배속으로 한 문장씩 섀도잉을 시작하고, 익숙해지면 보통 속도로 돌아갑니다.
자신의 목소리를 녹음해 원본과 비교하고, kernel, server, steal 같은 단어에 특히 주의합니다.

쉐도잉이란? 영어 실력을 빠르게 키우는 과학적 방법

쉐도잉(Shadowing)은 원래 전문 통역사 훈련을 위해 개발된 언어 학습 기법으로, 다언어 학자인 Dr. Alexander Arguelles에 의해 대중화된 방법입니다. 핵심 원리는 간단하지만 매우 강력합니다: 원어민의 영어를 들으면서 1~2초의 짧은 지연으로 즉시 소리 내어 따라 말하는 것——마치 '그림자(shadow)'처럼 화자를 따라가는 것입니다. 문법 공부나 수동적인 청취와 달리, 쉐도잉은 뇌와 입 근육이 동시에 실시간으로 영어를 처리하고 재현하도록 훈련합니다. 연구에 따르면 이 방법은 발음 정확도, 억양, 리듬, 연음, 청취력, 말하기 유창성을 크게 향상시킵니다. IELTS 스피킹 준비와 자연스러운 영어 소통을 원하는 분들에게 특히 효과적입니다.

섀도잉 방법: 단계별 전체 가이드 읽기 →

쉐도잉 연습: The worst week in cybersecurity history... so far - 영상으로 영어 말하기 배우기

연습 모드 선택

앱 다운로드

PostgreSQL in 100 Seconds

React Native in 100 Seconds

Every app on Earth is now open source... whether it likes it or not

Brainf**k in 100 Seconds

Mind-bending new programming language for GPUs just dropped...

The plan to break apart Google... RIP Chrome

Docker in 100 Seconds

The last real programmers are dying out...

Did the AI bubble just pop?

When open-sourcing your code goes wrong...

OpenAI’s new browser feels familiar…

The most interesting "hack" in history...

Tragic mistake... Anthropic leaks Claude’s source code

Firefox and Tor hit with 9.8 critical level exploit

C++ in 100 Seconds

China just dropped a new frontier model... and nobody can explain how

Linux in 100 Seconds

Did Google just dethrone OpenAI and Anthropic?

VS Code in 100 Seconds

A $6.3 billion open-weight model just got embarrassed by the French...

Linux got wrecked by backdoor attack

Oligarchy is worse than you think

So I tried Matt's skills...

THIS Is Where the Internet Lives

STOP Running Code On Your Computer

Did Anthropic Kill Git?

Here's what's REALLY Happening...

PirateSoftware is right, this needs to stop

The Man Who Stole MySpace | Samy

We Let $200 GPT-Pro Think for 7 Days on Unsolved Math

12 Things That Could Destroy Earth