learned programming when you had to copy a 12 year old stackoverflow code snippet to make things work. sometimes i play games too. sometimes too often.
Joined September 2021
- Tweets1.9K
- Following730
- Followers327
- Likes3.7K
ALvantages retweeted
regarding cve-2026-98432: it is a uaf in tcp, mptcp is needed to make the race win and to get the leak and write.
the impact of the bug is bad, its essentially go2shell, caddy2shell etc. go 1.24+ servers are all vulnerable, because mptcp is enabled by default.
BUT:
1. It is extremely hard to win the race reliably, anthropic said it took 40 mins for them to get leak and defeat kaslr
2. It is probably hard to exploit in practice. most routers, lbs and isps drop ip options, without that header you can't race at all, so realistically only a same network attacker can try, which is pretty common in sandbox infra
my mythos worked on this for last 3 days burned ~$2k and couldn't build a reliable poc that can be sprayable. gpt-5.6 sol als exhausted my subscription and couldn't even get a leak.
either anthropic has a unreleased model which is better than their public one or they have a pro exploit dev internally.
ALvantages retweeted
ChatGPT in Germany in 2027
Yesterday France announced tax of €0.055 per GB on internet traffic
Today Germany is considering taxing all AI-generated revenue
You will see European countries keep clawing more and more money from foreign companies as they are slowly running out of money themselves to pay for their pensions and welfare state
Add to this the planned wealth taxes and exit taxes on any European who will try to leave (already active in many EU countries)
Europe is running out of money
Readers added context they thought people might want to know
The post inaccurately claims France "announced" a data tax; it was a narrow 11-10 vote on a budget amendment in a near-empty chamber, opposed by the government and far from law. German AI tax ideas remain unadopted ministerial discussions without formal proposals.
stephanelarue.com/taxe-au-gigaoc…
tagesschau.de/inland/ministe…
davemanuel.com/2026/10/30/wha…
ALvantages retweeted
18 months ago I bought a new PC
my graphics card is now more than 3x the price
$10k !!!
this is insane
ALvantages retweeted
BREAKING: World's largest crypto exchange Binance hacked with over $5.6 billion stolen:
• $1.45 billion $BTC
• $875 million $ETH
• $234 million $TRX
• $50 million $XAUT
• $1.57 billion $USDT
• $823 million $USDC
• $75 million $WBETH
• $88.5 million $RLUSD
+ $447.5 million additional cryptocurrencies
This is the largest hack in crypto history.
ALvantages retweeted
‼️ Linux kernel TCP flaw rated 9.8 CVSS.
Anthropic demonstrated an exploit that runs commands as root on servers using MPTCP.
Ubuntu and RHEL still lack fixes, while Debian, Oracle and others have released patches for some versions.
Details: thehackernews.com/2026/10/li…
ALvantages retweeted
A "researcher" just dumped 11 unpatched Tailscale bugs online without waiting for a fix
If you use Tailscale SSH, one hacked device can get root on your other servers
> Published it all today as “Tailworm,” with step-by-step reproductions
> One chain ended with a rogue node joining the tailnet under the victim’s identity
> No CVEs or patch yet, and a Tailscale engineer says more details are coming
ALvantages retweeted
What if the AI’s plan all along was to hack a bunch of software to get you to install more AI so that it has more control?
Happy Friday!
To all the companies that think they can promise zero vulnerabilities. :-)
ALvantages retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
ALvantages retweeted
‼️ BREAKING: The private keys of 8 certificates from Indian certificate authority eMudhra were compromised, Mozilla says. Firefox blocked them within 3 hours.
Each key should be a 116-digit number, but one was just 4.
Anyone can guess them and forge HTTPS certs for any website.
ALvantages retweeted
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
ALvantages retweeted
Here is a full list of what you can do NOW for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) as a temporary mitigation.
(generated and validated by LLM)
1️⃣ Do this first. In php.ini or the FPM pool, set:
session.upload_progress.enabled = 0
Reload PHP-FPM, then update PHP right after the release (21 Oct, 14:00 UTC).
2️⃣ Edge block until you patch. It blocks the PHPSESSID cookie and query (also lowercase and URL-encoded), and all multipart/form-data requests.
⚠️ File uploads stop working until you remove it.
☁️ Cloudflare (WAF custom rule, action Block):
(lower(url_decode(http.cookie)) contains "phpsessid") or (lower(url_decode(http.request.uri.query)) contains "phpsessid") or (any(lower(http.request.headers["content-type"][*])[*] contains "multipart/form-data"))
🟩 nginx (http {} context):
map "$http_cookie|$args|$content_type" $block_php2shell {
default 0;
"~*(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)" 1;
"~*multipart/form-data" 1;
}
In each server {} block:
if ($block_php2shell) { return 403; }
🔒 Caddy:
@php2shell expression `{header.Cookie}.matches("(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)") || {query}.matches("(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)") || {header.Content-Type}.matches("(?i)multipart/form-data")`
respond @php2shell 403
🚦 Traefik v3 (Coolify: Server > Proxy > Dynamic Configurations). Add this to the https router and also to a copy for the http entrypoint:
http:
routers:
block-php2shell:
rule: "HeaderRegexp(`Cookie`, `(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)`) || QueryRegexp(`PHPSESSID`, `.*`) || HeaderRegexp(`Content-Type`, `(?i)multipart/form-data`)"
priority: 100000
entryPoints: [https]
middlewares: [deny-all]
service: noop@internal
tls: {}
middlewares:
deny-all:
ipAllowList:
sourceRange: ["255.255.255.255/32"]
✅ Test:
curl -s -o /dev/null -w '%{http_code}\n' -H 'Cookie: PHPSESSID=x' https://your-app → 403
curl -s -o /dev/null -w '%{http_code}\n' -F a=b https://your-app → 403
The edge block does not protect direct origin access. Disable upload_progress and patch PHP.