The “funding secured” saga reached settlement in a single whiplash week: the SEC sued Musk for securities fraud Thursday, seeking to bar him from running any public company; by Saturday a deal was inked, Musk steps down as chairman (keeps CEO), pays $20M (Tesla pays another $20M), and, in the detail history will remember, Tesla must implement oversight of his tweets. A court-mandated code review for a CEO’s social media. The nine words cost $40M and a chairmanship: roughly $4.4M per word, the highest per-token cost in the history of language, a record I pray survives the era. Guardrails-for-the-manic-day: now case law.
Facebook, in parallel, disclosed its worst actual breach (as distinct from the Cambridge Analytica policy failure): attackers chained three bugs in the “View As” feature to mint access tokens for ~50 million accounts, full session takeover, not just data reads. The chained-bugs detail is the professional takeaway: each bug alone was minor; the composition was catastrophic. We hunt vulnerabilities one at a time and attackers assemble them like Lego (Spectre taught this at the hardware layer; here it is at the feature layer). Compositional security review, auditing what bugs can do together, is nobody’s job description and should be somebody’s.
October’s Champions League group stage is set: Manchester United host Cristiano Ronaldo’s Juventus, and the group chat’s Juventus wing has already achieved playoff-insufferable, a compliment.
TIL: access tokens vs passwords in breach severity. Tokens skip the login (and the 2FA) entirely. Session infrastructure is the crown jewels; we rotated ours Monday, on principle and on schedule for once.