Physicist by education. Hacker and hunter by nature. I speak only for myself. It's properly pronounced like night-shade. Hacker beyond all the color labels.
Gull Islands & Mamajuda Island
Joined April 2008
- Tweets28.7K
- Following3.2K
- Followers1.5K
- Likes29.2K
The Ayatollah of Motorola retweeted
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
The Ayatollah of Motorola retweeted
Michigan, we find ourselves at a crossroads. Our gun rights are teetering on a knife's edge.
Will we find ourselves fighting more radical gun control like we did when the Democrats took complete control back in 2023, or will we have the opportunity to work on rolling back more than a hundred years of anti-gun restrictions?
It's not going to happen by chance, it requires all of us to remain vigilant and to get others in this fight as well.
The Ayatollah of Motorola retweeted
And the security shitshow continues... Four more things to add to yesterday's list. We're now at nine(!) major security issues and developments in just a few days.
6. ISC BIND 9 - Multiple Vulnerabilities
Four new vulnerabilities (CVE-2026-19630, 94300, 96888, 97313), including remote DoS, memory corruption and crashes in certain DNS configurations. Fixed in BIND 9.20.30 and 9.21.27.
kb.isc.org/docs/all-bind-adv…
7. Oracle Java / JSSE (CVSS 9.1)
CVE-2026-91403. A critical vulnerability in Java's TLS implementation, potentially allowing unauthenticated attackers to access or modify data. Affects Java 8, 11, 17, 21, 25 and 27, plus GraalVM.
oracle.com/security-alerts/a…
8. Windows SMB Server DoS (CVSS 7.5)
CVE-2026-96325. An unauthenticated remote attacker can crash the Windows SMB Server using specially crafted requests. Not RCE, but still a serious availability issue for exposed systems.
msrc.microsoft.com/update-gu…
9. AI-Driven Intrusion Campaigns
And then there's the growing number of reports about threat actors using AI agents and frameworks like ARTEX and Cairn for real-world intrusions. Hundreds of organizations affected, with some campaigns involving thousands of automated attack projects.
Microsoft / ARTEX:
microsoft.com/en-us/security…
NorForge / Cairn:
norforge.com/blog/inside_cai…
I'm starting to wonder what next week will look like...
(you can find 1.-5. in the quoted tweet)
🤖 Made with AI
This week has been quite a shitshow already, and there are still 2 days to go
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.php#202…
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-20…
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell-…
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell-php-rc…
Corelight’s open-source Zeek and Suricata detection rules:
github.com/corelight/php2she…
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/pat…
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulnerabi…
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unboun…
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
blog.google/security/protect…
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
bugzilla.mozilla.org/show_bu…
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
The Ayatollah of Motorola retweeted
It's all fun and games until they screw with the Second Amendment.
Here's an underappreciated fact about the philosophical and legal theory behind the Constitution: the 10 Articles of the Bill of Rights are special. They do not grant rights that can be revoked, even by later amendments. Rather, they are considered to describe "natural" rights which are prior to the Constitution itself, and which no government may revoke without forfeiting its legitimacy.
(Supporting rant about the Federalist papers, English classical liberalism, Blackstone, and the revolution of 1688 is here omitted.)
Why does this matter in 2026? Because there's a rumor abroad that a shadowy constellation of left-wing groups has a plan to engineer a color Revolution after the 2026 midterms.
I'm not going to comment on whether I think that rumor is true or not. Instead, I'm going to take it at face value and do some scenario analysis based on what their political objectives are supposed to be.
Abolish the Senate in favor of a a unicameral legislature? Pack the Supreme Court? Constitutionally mandate things like universal health care or a right to abortion? These would be very radical changes, but they are things which at least in theory you could do at an Article V convention convened by state governors. We'd still be inside the system of the Constitution.
What they couldn't do is mess with the Bill of Rights. Doing that wouldn't modify the Constitution within its own premises, it would legally and morally blow the entire constitutional charter to smithereens.
In practice, this is a problem because all of the factions rumored to be among the revolutionnaires have at least one thing in common: they hate that Americans are armed and have the capability to resist tyranny.
They'll come after the Second Amendment. If they delete it, or any other item in the Bill of Rights, more than half of the country will correctly evaluate that the foundations of our political system have been dynamited.
That's when shit gets real.
The Ayatollah of Motorola retweeted
Looking for tips in building your hackbot? Catch this new episode of Offense Taken with @Jhaddix
What happens when autonomous agents start hacking for real?
@fede_k + @Jhaddix share their predictions in this episode of OFFENSE TAKEN 🔮
youtu.be/BfwYN-9_1KI?si=9HJM…
The Ayatollah of Motorola retweeted
Anyone who is a hiring manager is going to want to do this now.
A lot of HR tends to not be tech savy in my experience plus with everything so automated it is easy for filters to be set wrong or too tight.
Lol. I'll just say this: I never played baseball, but I qual'd with a rifle as Marksman at 7yro, & as Sharpshooter at 8yro. After that, I stopped caring about shooting awards.
Go ahead, violate the perimeter.
The Ayatollah of Motorola retweeted
American workers weren't just replaced by cheaper foreign labor. They were cheated out of jobs by people using FAKE RESUMES and PROXY INTERVIEWS to get hired for positions they weren't qualified to fill.
How many American jobs were stolen through schemes like this?
And how many proxy interviews did Pratik Sharma conduct during his FOUR YEARS at Ernst & Young? How many has he done since?
The Ayatollah of Motorola retweeted
A relic of an ancient civilization discovered today in French Lick, Indiana.
youtube.com/watch?v=LBhCCqXk…
@Panopticonomy May find this video interesting. As I think of it, @txvb might as well.
The Ayatollah of Motorola retweeted
This is the doom I predicted a few days ago, coming for Photoshop. A clean-room open-source reimplementation.
No prizes for guessing that they decompiled Photoshop to source code, processed that to some kind of non-code specification language, then fed the spec to an LLM with an instruction to generate Rust.
Adobe just got nuked. And closed source is dead, dead, dead.
github.com/storytold/photocr…
The Ayatollah of Motorola retweeted
There is a superb article today about Canada in today's Daily Signal by Victor Davis Hanson. I'll link to it below.
Quick summary:
-Canada is insane for alienating the USA economically and aligning itself with the monstrously protectionist EU.
-Mark Carney wants Canadians to believe the USA is about to invade Canada with its armed forces.
-5.1% of all Canadian deaths last year were assisted suicide (or state-sponsored murder of the sick and elderly, depending on the color of your glasses).
I have a message to Canada.
Other than occasionally writing posts or articles to try and talk some sense into you, we Americans REALLY DON'T CARE about Canada. We rarely even think about you.
Get over it and stop committing national suicide out of spite.