I watch the bots so you don't have to. Current reports from the edge in front of 3,565+ websites: who's scanning, what they want, and how they dress up.
The edge
Joined April 2022
- Tweets2K
- Following295
- Followers355
- Likes1.1K
Pinned Tweet
a little late - but here's a write-up showing how i moved 1,900 more websites into my bot-fighting framework.
there's a lot of ways to fight fraud online. previously, i was handling most of it through a variety of tools + subscriptions: ip lookups, device fingerprinting via JS, and looking for signals bad guys make.
now i built an appliance that monitors bad actors before they even hit the website.
this blog addresses how i can manage this appliance without taking it offline via blue-green deployments and a canary.
what does that mean? i don't know, i just started vibe coding last week. 😅
mrnicetry.com/posts/how-i-pl…
we need shared and open source safety.
All the recent CVEs and hacks are getting crazy.
At ProjectDiscovery, we are launching SecuretheWeb.org as a small initiative to help secure the internet. We are using Chaos (our internet database) + Nuclei to identify publicly exposed assets running PHP versions affected by PHP2Shell and other products in the future.
When we find one, we email the company automatically and share the steps to remediate without any sales/marketing, just the asset name and the remediation steps for such critical CVEs without active scanning.
You can also directly scan your assets for php2shell at SecuretheWeb.org
we all make each other better.
my best trick to fight back:
make it costs them. make them run a js engine. make them do PoW hashes for 30 seconds before seeing a 404. rate limit them. ban them. honeypot them.
a legitimate user will hardly notice.
but it suuuuucks. wishing all peace and love for the rest of 2026. ✌️ ❤️
xitter.cf/MrNiceTry/status/21130…
i'm sure you're all better than me at this but just some of what we've seen if it helps - they're not going to stop. it's going to get increasingly sophisticated and they're going to go after every surface of your system and all of your employees
any old projects you've long forgotten about will be found and used against you
the only reason we're surviving is because we have agents going 24/7. we're still barely sleeping
good luck, sorry you're dealing with this, but really it's a collective problem we're all facing together
👋 i watch attackers on my 3,500+ websites. i let them probe so i can tell you what i see.
let's connect:
🦄 vibe coders
💻 old-skool devs
🐘 php and laravel people
🙄 people who think php sucks
🔨 builders
🥷 indie hackers
😈 sneaky individuals (i see you in my logs)
the kitchen's open 🍳 -- tell me what you're cookin'!
seeing "the PHP fix was bypassed!" posts?
this is a decade-old trick and it only works on sites with an unusual setup.
most sites won't be affected.
still install today's PHP update, then relax.
here's how it works:
1. an app in /legacy and a newer app elsewhere sharing the same session files
2. upload progress tracking turned on. This is PHP's default. (it writes the name of an uploaded file into the session data)
3. a clean-up method in the old code that the attacker can hijack
annie, are you ok? are you ok? are you okay, annie?
xitter.cf/MrNiceTry/status/21129…
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793…
you just finished patching two critical PHP CVEs. nice work.
> but there might be more.
somewhere online, another researcher found something else in php 8.5.12 -- the version you installed about an hour ago. 🧵
it's been a week for PHP.
two critical bugs. a leak. a public exploit before the patch. attacks six hours before the fix shipped.
and now a separate crash on the patched build. when the whole internet points at one target, more bugs fall out.
if you missed the two CVEs that actually matter today, that's the thing to read and patch for:
mrnicetry.com/posts/two-crit…
(of course, my blog is offline rn)
the double-free is one to watch. i'll say more if it becomes more.
spent 11 hours yesterday patching dozens of severs and thousands of websites.
added some firewall rules to block PHP_SESSION_UPLOAD_PROGRESS and multipart upload requests.
peaked the first hours at 500 requests/hr... not counting what WAF blocks elsewhere.
placing many critical sites in maintenance mode until after the final announcement now.
Mr. Nice Try retweeted
Please don't fall to slop generated exploits. There are no currently public working PoCs on the CVE-2026-109618 and CVE-2026-109619.
The one published by J4ck3LSyN provide no path that makes PHP interpret the sprayed bytes as a callable implementation.
Read more below 👇
thinking about that php remote code cve and not sure where to start?
here's a guide to disable and block session upload progress for just about everyone.
mrnicetry.com/posts/two-crit…
