Luyện nói tiếng Anh bằng Shadowing qua video: The worst week in cybersecurity history... so far

Chọn chế độ luyện tập

Mỗi chế độ mở một phòng luyện tập toàn màn hình.

73 câu

Nếu các câu quá ngắn hoặc quá dài, hãy bấm Edit để chỉnh sửa.

Last week, while you were busy researching how to buy emergency rice and beans in bulk,

a group of guys who technically aren't supposed to have internet access pulled off the largest theft in human history.

A code editor owned by a rocket company spent 11 hours letting anyone SSH into your laptop,

a prediction market got robbed in the middle of investigating its own customers for treason, and Anthropic showed that an unreleased

Cloud model could get root on any unpatched

Linux server just by sending it TCP packets.

In today's video, we'll break down just another Thursday in this godforsaken hellhole we're trapped in.

It is November 3rd, 2026, and we're watching the Code Report.

You know, I would love nothing more than to just talk about the latest JavaScript framework, but here we are again.

This time, it started last Thursday in the middle of the night when Cursor shipped a new official CloudCode extension.

Unfortunately, they shipped it without actually knowing they shipped it.

The extension would scan your machine for any keys or tokens it could find,

and then set up a backdoor for attackers to come in later and steal them.

It was only up for about 11 hours, but that was still long enough for around 5 ,000 people to install it.

Thankfully, the backdoor required admin rights, which most people don't give to their text editor, so the blast radius was pretty limited.

Meanwhile, around that same time, users on Polymarket started noticing that their funds were being drained simply by logging into the website.

Now, this isn't that unusual for Polymarket users, but what was unusual was this time it wasn't their fault.

It turns out a script from a company called DebugBear

that Polymarket uses for performance monitoring was hijacked to sell all

your current positions before wiring the proceeds to a hard -coded wallet.

The hackers ended up getting over $2 million worth of funds before Polymarket pulled the script, which seems like a lot until you realize

it's just a small price to pay on the road to destroying the lives of millions of young men across the world.

Thankfully for Polymarket, the news didn't last long because just a few hours later,

people started noticing something was up with Binance and it was way worse.

In about 20 minutes, $6 .3 billion with a B worth of crypto across 10 different blockchains left Binance's hot wallets,

which makes this the biggest theft in recorded history.

According to Binance, a DevOps laptop was compromised, which allowed the attackers to submit withdrawal requests, then Binance's own system signed them.

The next day, the FBI came out and said they believed that the North Korean group

Trader Trader was behind the attack which was the same group that stole 1 .5 billion from Bybit last year.

The good news is that if you had money on Binance is

that it stopped being your problem pretty quickly since crypto isn't actually decentralized.

Tether and Circle froze about $3 billion of the stolen stablecoins within an hour,

and then Binance froze all withdrawals and spent the weekend refilling its wallets out of its own treasury and insurance funds.

By Sunday, withdrawals were back on, and yesterday they posted proof of reserves showing everyone's balance was fully backed again,

to which the users responded by kindly withdrawing $3 .6 billion from Binance anyway.

And that wasn't even the worst part of the week.

Back in early October, a Linux kernel maintainer named Eric Dumizet pushed a simple two -line fix

that delayed freeing some memory until the kernel is sure nothing is still reading it.

At the time, it didn't seem like a big deal

and nobody really paid attention to it until a few weeks later

when it got a 9 .8 out of 10 on the CVSS scale, which is the industry's way of ranking how bad a security bug is.

It turns out that since 2016, every Linux kernel has had a bug in the code that handles new TCP connections.

The way it works is every connection starts with the client sending a hello packet and the server sending one back.

Normally, that first packet is pretty uninteresting, but you're allowed to attach a few extra options to it

if you want the kernel to save those so it can use them when it builds its reply.

The problem is that if the client sends the same hello twice at just the right moment,

the two parts of the kernel end up working on the same connection at once,

and one of them can free that saved memory while the other one is still reading it.

So the server ends up building its reply out of memory that's already been freed,

which means whatever else got written there in the meantime ends up in the reply, and if an attacker controls what that is,

they can control what the kernel does next.

Now getting that timing right is pretty tricky, which is why

Red Hat initially rated it as a moderate 5 .9, and figured the worst case scenario was that the kernel would just crash,

because if the exploit only works in one in a million tries,

it's basically safe as long as the person trying it gets bored and runs out of money.

The problem is that world no longer exists, which is exactly what Anthropic proved on October 27th

when its red team published a post saying they handed the bug to an unreleased Claude model, and in about 48 minutes,

the model had hit the timing enough times to get the server to leak a kernel memory address back to it.

And just five minutes after that, it was able to start running commands as root.

Debian and Oracle had patched kernels out within one day of the CVE, Red Hat took another two weeks to decide it was serious,

and finally shipped fixes over the weekend.

And Ubuntu still doesn't have one.

But at least you can protect your own codebase with CodeRabbit, the sponsor of today's video.

They got tired of seeing me make videos about new exploits hitting the timeline every week like this,

so they just launched CodeRabbit Secure to provide continuous code security that's powered by actual reasoning instead of brittle regex rules.

Their security agents are designed to think like an attacker.

in order to hunt for real vulnerabilities across your entire codebase.

Then it prioritizes actual risks based on reachability, exploitability, and blast radius.

And it explains the problem to you in plain English, and suggests a fix you can approve in Merge from the diff.

The CodeRabbit Secure reviews every PR before

Merge, and you can also schedule deep scans across your full codebase to protect your backdoor 24 -7.

Start with a free 14 -day trial at the link below, no credit card required.

This has been The Code Report, thanks for watching, and I will see you in the next one.

Tải Ứng Dụng

Mọi thứ bạn cần để nói trôi chảy

Chấm điểm AIChấm từng câu nói

Luyện IPAThành thạo mọi âm

Từ vựngMở rộng vốn từ

Game Từ vựngHọc qua chơi

Quét QR

Download on theApp Store Get it onGoogle Play

Cùng kênh

FOR YOU

Video gợi ý

51 câu

Linux got wrecked by backdoor attack

Daily ConversationUniversity StudentsWorking Adults

754 câu

Oligarchy is worse than you think

Daily ConversationUniversity StudentsWorking Adults

678 câu

So I tried Matt's skills...

Daily ConversationUniversity StudentsWorking Adults

398 câu

THIS Is Where the Internet Lives

Daily ConversationUniversity StudentsWorking Adults

173 câu

STOP Running Code On Your Computer

Daily ConversationUniversity StudentsWorking Adults

65 câu

Did Anthropic Kill Git?

Daily ConversationUniversity StudentsWorking Adults

444 câu

Here's what's REALLY Happening...

Daily ConversationWorking Adults

292 câu

PirateSoftware is right, this needs to stop

Daily ConversationWorking Adults

205 câu

The Man Who Stole MySpace | Samy

Daily ConversationUniversity StudentsWorking Adults

182 câu

We Let $200 GPT-Pro Think for 7 Days on Unsolved Math

Daily ConversationUniversity StudentsWorking Adults

169 câu

12 Things That Could Destroy Earth

Daily ConversationUniversity StudentsWorking Adults

Từ vựng và ghi chú luyện nói cho bài học này

Bài luyện nói này dựa trên video “The worst week in cybersecurity history... so far”. Những từ được nhắc lại nhiều nhất trong bài: kernel, Binance, Polymarket, code. Video này có 73 câu và 1151 từ để luyện shadowing. Phần lời nói dài 5:30. Người nói nói nhanh, khoảng 209 từ mỗi phút, nên sẽ có nhiều chỗ nối âm và nuốt âm. Chỉ 79% số từ nằm trong 3.000 từ tiếng Anh thông dụng nhất, nên từ vựng khá khó.

Từ vựng quan trọng trong video

15 từ đáng học trong video, kèm phiên âm và nghĩa:

Từ	Phiên âm	Nghĩa
server danh từ	/ˈsɝvɚ/	trình chủ, máy chủ
steal động từ	/stiːl/	trộm, chôm
wallet danh từ	/ˈwɑl.ət/	ví, bóp
packet danh từ	/ˈpæk.ɪt/	gói
extension danh từ	/ɪkˈstɛnʃən/	sự mở rộng
laptop danh từ	/ˈlæp.tɑp/	máy tính xách tay, láp-tóp
theft danh từ	/θɛft/	sự trộm cắp, sự ăn trộm
freeze động từ	/ˈfɹiːz/	đóng băng, đóng đá
radius danh từ	/ˈɹeɪ.di.əs/	xương quay
cloud danh từ	/ˈklaʊ̯d/	mây
rank danh từ	/ˈɹæŋk/	hàng
plain danh từ	/pleɪn/	đồng bằng, bình nguyên
wire danh từ	/ˈwaɪɚ/	dây, dây thép
log danh từ	/lɔɡ/	gỗ tròn
monitor danh từ	/ˈmɑ.nɪ.tɚ/	pháo thuyền, pháo hạm

Cụm động từ bạn sẽ nghe

Từ	Nghĩa
break down động từ	hỏng, hỏng hóc

Ngữ pháp trong video

Những cấu trúc người nói dùng nhiều nhất, kèm đúng cụm từ trong video:

Cấu trúc	Trong video
Câu bị động be + quá khứ phân từ — nhấn vào việc xảy ra, không phải người làm	being drained · was hijacked · was compromised
Mệnh đề quan hệ who / which + mệnh đề — thêm thông tin về người hoặc vật	guys who technically · attack which was · scale, which is
Thì hiện tại hoàn thành have/has + quá khứ phân từ — việc đã xảy ra nhưng còn liên quan đến hiện tại	has had · that's already been freed · has been

Phát âm cần chú ý

Người nói dùng 13 dạng rút gọn, ví dụ didn't, isn't, wasn't. Hãy nói theo dạng ngắn đúng như bạn nghe.

Âm “th”: withdrawal /wɪðˈdɹɔ(ə)l/, theft /θɛft/, withdraw /wɪðˈdɹɔ/, tether /ˈtɛðəɹ/
Âm “sh” và “zh”: extension /ɪkˈstɛnʃən/, unusual /ʌnˈjuːʒ(u)əl/, treasury /ˈtɹɛʒ.ɚ.i/, prediction /pɹɪˈdɪkʃən/
Từ dài — đặt trọng âm cho đúng: unusual /ʌnˈjuːʒ(u)əl/, investigate /ɪnˈvɛs.tə.ɡeɪt/, continuous /kənˈtɪn.juː.əs/, technically /ˈtɛk.nɪˌkəl.i/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/

Những âm người Việt thường gặp khó:

Cụm phụ âm cuối — đọc đủ từng âm, đừng nuốt âm cuối: script /skɹɪpt/, blast /blæst/, theft /θɛft/, rank /ˈɹæŋk/, bulk /bʌlk/
Âm /tʃ/, /dʒ/ và /ʒ/ — tiếng Việt không có, đừng đọc thành “ch” hay “gi”: unusual /ʌnˈjuːʒ(u)əl/, treasury /ˈtɹɛʒ.ɚ.i/, patch /pæt͡ʃ/, attach /əˈtæt͡ʃ/, hijack /ˈhaɪ.d͡ʒæk/
Âm /æ/ — mở miệng rộng hơn âm “e”: attacker /əˈtækɚ/, packet /ˈpæk.ɪt/, blast /blæst/, laptop /ˈlæp.tɑp/, scan /skæn/

Cách luyện với video này

Nghe hết video một lần, chưa cần nói, và ghi lại những từ bạn chưa biết.
Bắt đầu ở tốc độ 0,75×, nói đuổi từng câu, rồi quay lại tốc độ bình thường khi đã quen.
Ghi âm giọng mình rồi so với bản gốc, chú ý các từ như server, steal, wallet.

Phương Pháp Shadowing Là Gì?

Shadowing là kỹ thuật học ngôn ngữ có cơ sở khoa học, ban đầu được phát triển cho chương trình đào tạo phiên dịch viên chuyên nghiệp và được phổ biến rộng rãi bởi nhà đa ngôn ngữ học Dr. Alexander Arguelles. Nguyên lý cốt lõi đơn giản nhưng cực kỳ hiệu quả: bạn nghe tiếng Anh của người bản xứ và lặp lại to ngay lập tức — như một "cái bóng" (shadow) đuổi theo người nói với độ trễ chỉ 1–2 giây. Khác với luyện ngữ pháp hay học từ vựng bị động, Shadowing buộc não bộ và cơ miệng phải đồng thời xử lý và tái tạo ngôn ngữ thực tế. Các nghiên cứu khoa học xác nhận phương pháp này cải thiện đáng kể phát âm, ngữ điệu, nhịp điệu, nối âm, kỹ năng nghe và độ lưu loát khi nói — đặc biệt hiệu quả cho người luyện IELTS Speaking và muốn giao tiếp tiếng Anh tự nhiên như người bản ngữ.

Phương pháp shadowing: đọc hướng dẫn từng bước đầy đủ →

Luyện nói tiếng Anh bằng Shadowing qua video: The worst week in cybersecurity history... so far

Chọn chế độ luyện tập

Tải Ứng Dụng

PostgreSQL in 100 Seconds

React Native in 100 Seconds

Every app on Earth is now open source... whether it likes it or not

Brainf**k in 100 Seconds

Mind-bending new programming language for GPUs just dropped...

Docker in 100 Seconds

The last real programmers are dying out...

The plan to break apart Google... RIP Chrome

Did the AI bubble just pop?

When open-sourcing your code goes wrong...

OpenAI’s new browser feels familiar…

The most interesting "hack" in history...

Tragic mistake... Anthropic leaks Claude’s source code

Firefox and Tor hit with 9.8 critical level exploit

C++ in 100 Seconds

.NET in 100 Seconds

China just dropped a new frontier model... and nobody can explain how

Linux in 100 Seconds

Did Google just dethrone OpenAI and Anthropic?

VS Code in 100 Seconds

Linux got wrecked by backdoor attack

Oligarchy is worse than you think

So I tried Matt's skills...

THIS Is Where the Internet Lives

STOP Running Code On Your Computer

Did Anthropic Kill Git?

Here's what's REALLY Happening...

PirateSoftware is right, this needs to stop

The Man Who Stole MySpace | Samy

We Let $200 GPT-Pro Think for 7 Days on Unsolved Math

12 Things That Could Destroy Earth

Từ vựng và ghi chú luyện nói cho bài học này

Từ vựng quan trọng trong video

Cụm động từ bạn sẽ nghe

Ngữ pháp trong video

Phát âm cần chú ý

Cách luyện với video này

Phương Pháp Shadowing Là Gì?