Sony AK retweeted
Semua orang di kasih AI, token unlimited, tapi hasil nya beda karena ga semua bisa utilize ai:
Perbedaan antara:
- yang kerja seadanya
- yang kerja beneran
- yang kebanyakan kerja
Sony AK retweeted
When @jensenhuang asks for a somersault, you deliver. 🦆
See how AI agents on NVIDIA RTX Spark help bring @huggingface's Microduck from simulation to the real world.
Sony AK retweeted
Emergency WAF release 2026-10-21 adds four rules to catch anomalous execution patterns. Two block and two log matches.
developers.cloudflare.com/ch…
Sony AK retweeted
🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST.
Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using:
🟧 ActiveScan++ v2.0.13 (portswigger.net/bappstore/31…)
🟧 Bambda scan checks (github.com/PortSwigger/bambd…)
🟧 BChecks (github.com/PortSwigger/bchec…)
Start scanning for the vulnerability now → portswigger.net/bappstore/31…
Sony AK retweeted
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They're now being “broadly exploited” across the internet. buff.ly/IwN5u1E
Sony AK retweeted
Today the PHP project released security updates addressing two critical "PHP2Shell" vulnerabilities.
If your site is hosted on @wordpressdotcom, @WordPressVIP, @wpcloudofficial, @Pressable, @tumblr, or any Automattic infrastructure, you’re already protected.
Managing PHP yourself? Here’s what to do: automattic.com/2026/10/21/yo…
Sony AK retweeted
Di era spt ini aseli kalian peternak server butuh agentic swarm yg standby 24/7 buat response team.
Bisa pakai Evonic, saya pakai Evonic cukup minta Super Agent untuk rapat darurat dg agent2 sentinel (penjaga server) dan melakukan mitigasi serentak dan segera di server masing2.
PHP's security team just confirmed two critical RCE flaws after a leak. Here's what you need to know.
Security researcher Florian Roth posted that there is an RCE vulnerability in PHP core, rated CVSS 10.0. He said details were due October 20 and that only PHP 8 would get patches. The post drew 53K views. The story spread after a leak broke the embargo, which watchTowr had expected to hold until Thursday at 11am ET.
The PHP Foundation then gave official advance notice. The security release is set for Wednesday, October 21, 2026 at 14:00 UTC, which is 10 AM EDT. It fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The official rating is CVSS v4.0 9.2, not the 10.0 circulating online. The team says it may release earlier if details become public or active exploitation shows up. Some posts quoted 9 AM EDT, and watchTowr's post misprinted the CVE year as 2926.
The leak is confirmed as real. watchTowr says the embargoed zero-days are real, and Previdian says it reproduced them. No technical details are public. Reports say the flaws touch PHP 5, 6, 7 and 8, but only 8.0 and up are expected to get fixes. That is unconfirmed. Researcher Nicolas Krassas plans to publish a lab on the bugs when the embargo lifts. Security commentators expect exploitation within minutes of the details dropping.
PHP runs Wikipedia, WordPress sites, WooCommerce stores, Drupal sites and Adobe Commerce storefronts.
Key numbers:
- 2 critical RCE vulnerabilities
- CVE-2026-109618 and CVE-2026-109619
- CVSS v4.0 9.2 officially, 10.0 in leaked reports
- Patch release: Oct 21, 2026, 14:00 UTC
- Patches expected for PHP 8.0 and up
PHP admins should inventory their hosts now and update as soon as the release lands.
Sony AK retweeted
🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just because you've patched.
#php4shell #php #cybersecurity
xitter.cf/_annieversary/status/2…
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793…
Sony AK retweeted
🚨 Critical PHP vulnerability update 🚨
Patched PHP versions have officially been released!
Here is the latest status on FrankenPHP:
⚙️ Binaries: FrankenPHP 1.13.1 binaries with patched PHP 8.5 are currently building: github.com/php/frankenphp/ac…
🐳 Docker: Waiting on upstream patched Docker images before rebuilding ours
🏷️ Next Release: FrankenPHP 1.13.2 (including unrelated bug and security fixes) will be tagged as soon as 1.13.2 binaries and Docker images are ready
💙 Maintaining open-source projects takes serious effort. Consider supporting the work via GitHub Sponsors and donating to the PHP Foundation!
Sony AK retweeted
Vercel has proactively rolled out Firewall-level mitigations for today's Node.js RCE vulnerability, in advance of the official patch release.
All traffic for all deployments is automatically protected. We're actively monitoring and rolling out managed runtime upgrades.
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-…
Sony AK retweeted
Current information I have on php2Shell:
- The RCEs requires the attacker to obtain memory addresses which are typically protected by ASLR.
- I suspect the original author (lcfr_hax) likely has a reliable exploit which leads to stable code execution.
- Most of the PoCs being posted are completely non-functional AI slop.
- There is at least 1 working non-slop exploit being passed around, but it's reliant on bruteforcing for ASLR bypass, so not particularly impactful.
- Rumor of ITW exploitation are patchy. There are attempts being seen using the non-functional leaked RCE, or variants that are config / system specific.
- Some rumors point towards a known-working exploit being used by threat actors (I've personally confirmed this specific exploit works, but the ASLR bypass technique is unreliable at best and massively limits the potential impact).
- I'd expect heavy ITW exploitation in the next few weeks based on how many people are looking at this. Though, success rates will vary heavily based on the specific exploit chain.
Sony AK retweeted
It was inspiring to watch the behind-the-scenes¹ of the industry coming together, weeks in advance, to protect the world's infrastructure and mitigate php2shell.
We deployed Vercel WAF mitigations that have already successfully prevented attempts on PHP origins. Assume more vulnerabilities are on the way. Flex the patch → redeploy muscle.
¹ A Slack channel. Thank you @SlackHQ!
php2shell Security Advisory: two critical RCE flaws in the PHP engine affect PHP 5.4+. Public exploits are out.
Vercel WAF rules were shipped before disclosure and have been blocking known exploit patterns. Patch PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. vercel.com/kb/bulletin/php2s…
Sony AK retweeted
The NCSC has issued an update to the PHP alert reflecting the release of mitigations.
We encourage UK organisations to take immediate action.
For more information on the issue as well as our guidance, head to⬇️
ncsc.gov.uk/news/critical-se…
Sony AK retweeted
Here is a graph of Vercel's WAF blocking attempted exploits of the PHP vulnerabilities.
Volume is still low, but I expect it to ramp up quickly. Treat the WAF as temporary protection while you upgrade, but upgrade ASAP
php2shell Security Advisory: two critical RCE flaws in the PHP engine affect PHP 5.4+. Public exploits are out.
Vercel WAF rules were shipped before disclosure and have been blocking known exploit patterns. Patch PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. vercel.com/kb/bulletin/php2s…
Sony AK retweeted
DigitalOcean is aware of the PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and our teams are actively addressing. We’ll share more through direct customer communications and a blog post shortly.
Sony AK retweeted
Of course it'd be better to have vulnerability in PHP at all, but I'm deeply moved by today's events:
1) The absolute profesionalism of everyone involved from @ThePHPF. Thank you!
2) The number & size of sites went off-line at 2PM UTC to patch their servers. PHP totally runs the world!
3) PHP in news reports in press and TV across the world.
Sony AK retweeted
Important memory corruption flaws in PHP's request handling have been identified: CVE-2026-109618 and CVE-2026-109619. Red Hat is expediting fixes, with some updates already available. The latest updates are available here: red.ht/4icdR3k
