OSS maintainer @openssf (minder),web2 security researcher, hardware tinkerer
127.0.0.1
Joined June 2024
- Tweets537
- Following467
- Followers198
- Likes1.4K
Pinned Tweet
š§µ MCP servers have a quiet trust problem.
You approve a tool once. Its schema can change tomorrow and your agent never notices.
I built Anchor to make that change visible.
github.com/intelligent-ears/ā¦
#MCP #AISecurity
š§µ the last 72 hours in security were genuinely unhinged
7 incidents, all verified, plus what to actually do for each š
#infosec #cybersecurity
Plex2Shell: a 4-bug chain to unauth RCE on Plex Media Server, actively exploited to drop cryptominers. On CISA KEV.
ā update to 1.43.3.10861+
#Plex2Shell #Plex
the pattern: most of these are supply chain. a runtime (PHP), a package (LiteLLM), a platform (Railway), a CA (eMudhra).
patch. rotate. revoke. and know what you actually depend on.
ā»ļø RT to save someone's server
#SupplyChainSecurity
š§µ PHP2Shell is the biggest security story today, and it's not a plugin bug.
Two critical unauthenticated RCEs in the PHP interpreter. Leaked before the fix, exploited before the patch shipped.
Fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35
Read: intelears.tech/writing/php2sā¦
#PHP2Shell
What to do:
ā update via your distro (they got patches early)
ā on Remi's repo? no update today, switch or build from source
ā on 8.1 or older? backports exist, but upgrade
ā restart FPM workers
ā hunt for web shells, attacks started pre-patch
5/ The lesson: PHP is a dependency like any other. The teams patching fastest today are the ones who already knew where it ran.
Full write-up: intelears.tech/writing/php2sā¦
#PHP2Shell #infosec
finally have a corner of the internet that's actually mine š
was tired of those same old school themes: fake terminal, dark mode + neon, minimalist white void
so here's mine, built it to feel like me, not a template
intelears.tech/
ngl most "AI security" rn is just supply chain security wearing a trench coat
unsigned stuff, unpinned versions, trusting every update blindly
MCP tools are basically npm packages that can talk back š
#AISecurity #MCP
I also mapped these threats into #Gemara (OpenSSF's GRC engineering framework) as a ThreatCatalog + CapabilityCatalog, so they're machine-readable and can plug into compliance tooling.
Both live in the repo's gemara/ folder.