Dislike cyber__ terms | @HardHatBrigade | Perpetual Newb | Meyers-Briggs: IDGAF | !Serious Account | ex-Payphone Purveyor | on infosec exchange | views my own
Ward River
Joined July 2014
- Tweets64.6K
- Following4.8K
- Followers6.2K
- Likes134K
Pinned Tweet
A comprehensive look at cryptocurrencies and NFTs, and how it's mostly a scam. 💯
Line Goes Up - The Problem With NFTs
youtu.be/YQ_xWvX1n9g
MrBill // wardrive every day // retweeted
It's time to put my Adventures of Wallet Hacking series to bed, but not before one final chapter! Free livestream for all courtesy of @unicampoficial LICS Cybersecurity League. Announcement here: linkedin.com/feed/update/urn…
MrBill // wardrive every day // retweeted
This is how the open community works.
One dude builds it. 2 days later someone ports it to Windows. A follower sends it to me, I put real numbers from my rig on it, and 2 posts do 680K views in 3 days.
Now the repo has 787 stars and 96 forks, people post their own reports from 3070 Ti to 3090 Ti, and I already went digging for what else is switched off on these cards.
No lab, no budget. Just people with old GPUs at home who refuse to run them at 50%.
Thanks Zagitta and everyone who pushed it
My 3090s just got 1.9x FASTER at BF16 tensor math!!! Same cards, same driver, same 300W, one Linux kernel module.
bf16 tensor pipe: 82 -> 155 TFLOPS
cuBLAS BF16 GEMM 8192: 64 -> 99 TFLOPS
TF32: 41 -> 79 TFLOPS
NVIDIA ships every 3090 with fp32-accumulate tensor math at half speed. The driver even reports it: FMLA32 = 1/2. gpu-unlock by Zagitta sets it to full before the NVIDIA driver loads. After a cold boot all 4 of my cards say FMLA32 = full.
Real inference got less than I predicted. Strata, Qwen3.8 Flash-Next on 2 cards, prefill:
4K: +12%
10K: +12%
90K: 3205 -> 3536 tok/s, +10%
Before installing I said +14 to 19% at 90K, so I was wrong. The GEMM phases got 23% shorter, but they are only about 40% of Strata prefill, and the int8 experts, copies and CUDA core kernels didnt get any faster.
Outputs did not change. With the same expert cache size, my log-prob dump over 1996 teacher-forced positions is the same file byte for byte as the stock run before the module.
Next is Strata itself, now its everything around the GEMMs that makes prefill slow. How I set it up is in the replies.
MrBill // wardrive every day // retweeted
Dear @nvidia, a friendly ask from a guy running 4 of your 3090s and 1 of 3080 Ti.
The 30 series is 6 years old. You dont make these cards anymore. Maybe its time to hand them over to the community completely.
My post about unlocking the 3090 got 270K views in a day, and the replies are the real story. People asking about the 4090, 3080, 3060 and 2080 Ti. People asking how to do it on Windows. Others listing what the community already patches on these cards: the NVENC session limit, P2P between GPUs.
Thousands of people are digging through your old cards with kernel modules, 1 setting at a time, because they love this hardware and want everything it can give.
Publish what is limited on consumer Ampere and Turing. Ship an official driver switch for older generations. Or just open it up.
I understand the business side. Some people might keep their old cards longer instead of buying new ones. But it would be a huge gesture. You talk about local AI on stage, you ship open models, you sell DGX Spark for home. This would show the care goes all the way down to a used 3090 under someone’s desk.
Give them to us. We will do the rest: benchmarks, guides, models tuned for these cards.
@NVIDIAAI
NVIDIA sold millions of 3090s with 50% of the tensor speed switched off. Not missing. Switched off.
1 kernel module flips it to full, and my BF16 tensor pipe went from 82 to 155 TFLOPS. Nothing else changed on the cards, and the outputs match the stock run byte for byte.
All so the gaming card wouldnt eat into workstation sales. Every 3090 owner ran at 50% for 6 years, so a pro card could look worth the price. Fine, its their business model.
And LLMs are the least interesting place for this. Decode waits on memory, and my engine runs its experts in int8. Still +10% on prefill.
The models that live on BF16 tensor math are everything else. Qwen Image 2.1 and FLUX 3 Klein, where every diffusion step is big matmuls. MiniMax H3, which takes 4 to 7 minutes on my cards. Music and speech models. And training, every LoRA anyone ever trained on a 3090 went through exactly the path that was cut.
Thats what I measure next. This is only the start.
MrBill // wardrive every day // retweeted
This is all just a very aggressive Cybersecurity Awareness Month campaign
MrBill // wardrive every day // retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
MrBill // wardrive every day // retweeted
SITUATION DETECTED: CloudFlare CEO Matthew Prince says he is aware of additional severe vulnerabilities in other pieces of critical software, and said “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” per Reuters.
MrBill // wardrive every day // retweeted
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches thehackernews.com/2026/10/ur…
MrBill // wardrive every day // retweeted
Somewhere, a CTO just found out their servers still run PHP 5.6 💀
MrBill // wardrive every day // retweeted
Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment:
1. Discovery with Nmap
Common and alternative web ports; HTTP headers that may expose PHP versions:
nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target>
Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.
2. Huntress: Monitoring and detection
• Confirmed facts and remaining questions
• Suspicious PHP child processes, shells and downloaders
• Webshells and other post-exploitation activity
• My process-watcher for Linux process visibility
huntress.com/blog/php2shell-…
3. Vincent Schmalbach: Hardening and patching
• Temporary nginx/Apache filters and upload-progress settings
• WAF/origin bypass checks
• Package and backport verification
• PHP-FPM/worker restarts, container rebuilds
• Side effects and checks for compromise
vincentschmalbach.com/cve-20…
Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.
MrBill // wardrive every day // retweeted
We are still wrapping up a summary and will be drawing a winner of the WiFi Shuriken by the end of the week, so stay tuned. Thanks!
MrBill // wardrive every day // retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
MrBill // wardrive every day // retweeted
Claude Code found spyware on my sister’s phone. It had been tracking her for 11 weeks…
She asked me to check her phone. Someone always seemed to know where she was and she couldn’t figure out how
I plugged it into Claude Code and asked what’s running that she never installed. It walked every app, including the hidden ones, and flagged one disguised as “System Service”, no icon, not on any store
It had been there 11 weeks, logging her location every 2 minutes. Claude pulled the details on whoever was running it:
reports to → +1 (415) *** **72
carrier → T-Mobile US
device id → IMEI 35 ********** 47
last ping it sent → 40.7**, -73.9** · 2 min ago
We saved everything the app had recorded and passed it to the people who do this professionally. Then Claude shut it down and wiped it off her phone
The full step-by-step is below, takes 5 minutes. Save it so you don't lose it, and send it to anyone who might need it
MrBill // wardrive every day // retweeted
> be @malwrhunterteam
> on a legendary run on social media
> find silly website
> estrosa-dot-it
> website for italian cosmetics
> legit website, used by the pasta people
> notice something silly on website
> /js/analytics/assets/js/group.html
> look inside
> group.html checks browser agent
> detects iOS version
> loads different files depending on iOS version
> loads 49554fde7424c31c.js
> 49*.js doing lots of crazy stuff
> layers of obfuscation and pointer arithmetic
> lolwtf
> look inside
> exact match of Coruna EK
> Coruna Exploit Kit
> Coruna originally used by US government
> rumored to be made by US contractor
> rumored US contractor illegally sold to kremlin
> UNC6353 (kremlin) found using Coruna in 2025
Chat, someone is swinging the legendary goop around. It is Coruna, the state-sponsored iOS exploit kit. All this requires is your Apple device to visit a website and (assuming you're running the targeted iOS version) you're cooked.
Although, from my initial bonking of it, it appears this delivers two different payloads depending on the iOS version. Unfortunately, I know almost nothing about iOS exploitation and iOS malware, so I have no idea what I'm doing. I encouraged my peers and colleagues to review it. It is good goop.
I've archived the payloads from the compromised domain. The shared link is below.
pic unrelated
