A root certificate authority, the kind your Linux distro ships trust for, generated its 256-bit private key by picking a number between 0 and 256. It was 4. Tyler walks through what that does to a key that needed 384 bits of entropy, Chris explains why Cloudflare points cameras at lava lamps, and the cert stayed live and trusted for 17 months. Then PHP2Shell: two CVEs, CVSS 9.2, unauthenticated remote code execution on roughly two thirds of the web, Wikipedia down, and Chris offering to remote-execute into your server and hotfix it for you. Jackson's side project got poked by white hats the same week. Then the leak: three months of secret coordination before the patch, and who gets told first. Perp of Fortune 2.0: two bets on Tyler's money, an hourly Bitcoin binary and a 25× long on ETH, with a 45-second countdown nobody could read. Vitalik's paranoid mode: a five-layer private AI stack to find a vegan restaurant. The models refuse to help with cryptography. Chris rooted his Samsung TV and found out who it was talking to. Railway got popped through its build pipeline. The marquee: Jeff Yan says the future financial system runs on Hyperliquid. Is that bonkers, or BitMEX → FTX → Binance → Hyperliquid, the same trade again? Final numbers: the binary went to zero, the ETH long bled, we lost $29.

The key of 4 is at 2:30. Chapters: Cold open (0:00) · Welcome: no Cheez-Its (0:41) · A root CA used a private key of 4 (1:23) · Live for 17 months, trusted by your OS (8:17) · PHP2Shell: remote code execution on 67% of the web (12:58) · A DeepSeek swarm patching PHP for you (17:05) · White hats prodding MotivateMe.io (20:09) · The PHP leak: three months of secret coordination, and who gets told first (22:15) · Quest got hacked: is privacy already gone? (24:44) · Contrarian corner: nobody cares about privacy (26:15) · Perp of Fortune 2.0: hourly Bitcoin binary vs LONG ETH 25× (27:22) · Vitalik's paranoid mode (31:20) · Refusals: the models won't touch cryptography (36:35) · He rooted his Samsung TV (37:58) · Bitcoin UP is winning (40:40) · Railway got popped (41:13) · We have a TikTok; 45 seconds left (43:27) · Is the future of finance on Hyperliquid? (44:55) · The nodes are in his basement (47:10) · BitMEX, FTX, Binance, Hyperliquid: the same trade (49:28) · Perp final: the binary went to zero (51:46)

Recorded fully remote, three cameras, one dashboard. Our opinions are our own, not our employers'. NOT financial advice; Perp of Fortune is a small real-money account we run for entertainment. Glossary: Root CA = one of the ~150 organizations whose signing keys your OS and browser trust by default. Entropy = the unpredictability in a key, in bits; a key chosen from 0–256 has 8, 384 were needed. CVE / CVSS = a vulnerability's public ID and its 0–10 severity score. RCE = remote code execution, running attacker code on your server. IDOR = changing an ID in a URL and getting someone else's data back. Embargo = holding vulnerability details until the patch ships. Binary option = a fixed payout if a condition is true at settlement, zero if not. 25× leverage = a position 25 times your margin; a 4% move wipes it. zkAPI = paying for inference from an on-chain vault via a zero-knowledge proof so the lab can't tie the bill to you. Rooting = taking admin control of a locked-down device. CI pipeline = the servers that build and ship a company's code. Hyperliquid = an exchange that runs as its own chain with the order book on the ledger.

Subscribe for next week: Poppy 0.2 vs Claude Duet, who gets to shop for you; Liquid, the layer two that isn't one; the fake adoption numbers; Perp of Fortune 2.0 rides again.