former security engineer @energy ✧ technomancer ✧ industrialist
𝙼𝚘𝚞𝚗𝚝𝚊𝚒𝚗𝚜, 𝚄𝚂𝙰
Joined February 2025
- Tweets5.1K
- Following595
- Followers1.9K
- Likes30.1K
Async retweeted
Former DOE security engineer @asynchronous_x explains how a miscommunication turned a planned PHP2Shell fix into a race against hackers:
"It should have been the best-case scenario. Security researchers identified these vulnerabilities, developed proof of concept exploits in advance, and were informing the PHP core team for fixes. That whole part was working fine."
"The reason this one’s unique is there was basically a leak of the vulnerability before the disclosure. That was supposed to be released on October 22nd, today. Unfortunately, there was a miscommunication, and they released some of the details early. So there was this panic race where the problem is out in the wild, but we don’t have a fix prepared yet."
"The thing it’s taught the security realm is that we probably can’t rely on coordinated disclosure anymore. If the speed at which people can develop exploits is now so fast that we can’t possibly rely on things not getting leaked, then it’s not something we can lean on as much as we used to."
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
Wiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…
Async retweeted
Former DOE security engineer @asynchronous_x explains why America's critical infrastructure hasn't been attacked more often despite its networks being riddled with security holes:
"The work I used to do for the Department of Energy was around critical infrastructure. They’ve relied on obscurity, you don’t know that they’re there, so why would anyone attack us. As soon as you took any sort of magnifying glass to their networks, they were usually riddled with holes."
"The reason they haven’t gotten attacked so much is because the repercussion is so much higher. If you compromise a water treatment facility and you accidentally end up killing people, that’s gonna have extreme repercussions versus if you steal some cryptocurrency."
"We’ve been relying on political and other methods for keeping them safe rather than actually making them secure."
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.
Async retweeted
Former DOE security engineer @asynchronous_x warns AI is narrowing the gap between junior hackers and agencies like the NSA:
"We used to have this thing in industry where we would say, this is pretty secure, unless your threat actor is the NSA."
"Now with AI tools you can take more junior people with less expertise, and they can make more sophisticated attacks. Somebody that would’ve been a less high-level threat actor before could potentially become a much more dangerous threat actor."
"There’s plenty in the industry that think we should limit access to these tools because it can make smaller threat actors much more dangerous."
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Async retweeted
The next "Quality Learing Center" will be found & exposed using America.gov/fraud
See fraud? It's time to expose it.
Report fraud, waste, and abuse to the federal government 📲 America.gov/fraud
Async retweeted
Made an agentic ladder logic IDE this weekend to fix a buggy PLC for a customer
- bugs (plural) identified within seconds
- 6 hour task in seconds ("conservative estimate" from end user)
- "Even I could program a PLC" (someone whose never touched PLCs)
anyone want to try it?
Async retweeted
If you want to make album covers in front of paint lines, get deployed across Detroit, Ohio, Alabama, and SF within your 2 weeks of onboarding....
Join @deployconduit anon 🫡
Async retweeted
3 months I kinda stopped tweeting and went heads down. Since then @deployconduit has:
• Signed a defense prime and multiple Tier-1 auto co's
• Brought on new teammates from ATOMS, Space-X, Hadrian, Rivian, etc
• Sold more hardware in August than in company history
and yet, we still don't have a sales or marketing org. If you're looking to join one of the fastest growing startups helping Reindustrialize America, DM or email me [email protected]
Async retweeted
i hooked up @typesafeai 's JEV to play co-op with me
he a lil weird but he chill