Look around you. The world is an amazing place full of awesome people. – at Redmond, WA

Maybe slop drowning a working exploit is the new mitigation.

Google hedging: "We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation." ... "Nonetheless, exploitation may have already begun in a limited fashion"

The street finds its own use for things. And it didn't find much use for php2shell which is more like php2shell-in-a-lab-setting.

For comparison I checked with the Wordfence team and we saw 5 site cleanings for the UpdraftPlus infrastructure compromise 6 days ago. And that WordPress plugin has 3 million installs. BuiltWith says there are 23 million or 104 million PHP sites, depending on whether you count 'expired' or not. And not a single compromised site hit our site cleaning team. 🤔 xitter.cf/mmaunder/status/211335…

Tagging @ethicalhack3r @OliverSild @photomatt and @perezbox so you can loop in @GoDaddy if you still have contacts there. And looping in @gdb because he and @eastdakota are appearing together. Guys we haven't seen a single hacked WP site from #php2shell and we're (@wordfence is) protecting over 5 million PHP/WP sites. You know the deal. If it's exploitable, we all see site cleanings. No one in cybersecurity wants to minimize a vulnerability in case it does blow up. We're seeing reports from @Cloudflare and @eastdakota of attack attempts. We're seeing attack attempts in our telemetry. But we're not seeing a single compromised site. No one wants to say that it's not exploitable against vanilla PHP because it may turn out to be. I think we all know CVSS scores are imperfect. And the messaging here is off the charts. This has gone mainstream, but no one is talking about the fact that no one is seeing hacks. It's easy to take a bow and claim industry success, "go team cyber" and all that. But you know if these things are a legit risk you'll see compromised sites. Especially in the PHP/WP space where there are a lot of individual boxes out there with owners on vacation or MIA. And nothing. Not one. So I think the conversation that needs to happen is something like this: We're going to find scary vulnerabilities with the amazing capabilities that @OpenAI and @AnthropicAI are bringing online, but we need to calibrate the messaging to take into account how exploitable and scriptable each vuln is, or we risk alert fatigue and blowing credibility which we'll badly need when an exploitable scriptable vulnerability shows up.

We protect over 5 million PHP sites and when we find a major exploitable vulnerability, we always see site cleanings. We have seen exactly zero hacked sites from php2shell. Zero. Across a population of 5 million PHP sites that our product protects. Draw your own conclusions. #php2shell

The pareto frontier in cyber just got a third axis: time to discovery. AWS honeypot saw php2shell attacks days before the embargo expired. The race is on. aws.amazon.com/blogs/securit…

Woopsie, when you enter your tablet PIN on the NASA stream.

An old classic needed an update.

OpenAI: The smart people left, so we don't know how to make models anymore. Sam: Recycle.

lol

Given enough agents, all bugs are shallow.

If a Ferrari LLM isn’t on the cards and all we get are Camrys, we’ll have to make the most of the Camrys.

Try “No that’s wrong” to get better quality results from AI, particularly with providers like OpenAI using back-end model switching.