
Senior Software Engineer at Microsoft. @Arsenal fan Tweets, or Xeets are mine
Melbourne, Victoria
Joined October 2010
- Tweets15.2K
- Following702
- Followers1.4K
- Likes19.6K
Will Velida 🇺🇦 retweeted
I can't wait to be at BsidesPerth again! I'm talking on Friday morning at 10.10am!
🤖 Made with AI
George Coldham built his own tiny passkey authenticator… then had to explain why you shouldn't trust it 😅 BSides Perth, 13–14 Nov #BSidesPerth
Will Velida 🇺🇦 retweeted
Your AI agent is only as safe as the tools, data, identities, and permissions around it. @WillVelida joins RunAs Radio to discuss observability, governance, red teaming, and why every agent action needs a chain of custody. runasradio.com/Shows/Show/10…
Will Velida 🇺🇦 retweeted
⚠️ LiteLLM’s release pipeline was hijacked.
Malicious v1.107.0 packages shipped a credential stealer and backdoor. Attackers later tested stolen AWS credentials.
LiteLLM suspects GitHub OAuth tokens were taken from logs on its exposed internal deployment.
Read ↓ thehackernews.com/2026/10/li…
Will Velida 🇺🇦 retweeted
How do you _guarantee_ your agent's code is correct? You prove it.
Introducing Proof Driven Development Kit (PDD Kit) from @MSFTResearch.
PDD Kit helps turn your plan into a formal spec, then proves the agent's code meets that spec for every input. No vibe verification. PDD Kit is integrated with @GitHubNext's Chopin, so you can plan as a team.
PDD Kit takes an app's login flow from intent to a verified pull request:
It discusses your code, infers your intent as it goes, and proposes a formal spec in Verus, a proof language for Rust.
Once you approve the spec, the Verus verifier automatically proves the code meets it.
Where proof isn't possible, it falls back to empirical verification with tests and computer-use agents (CUAs).
It works on Rust today. No new language, no change in how you produce the underlying code, making formal methods more accessible.
The goal is a verified software factory, where engineers review specifications instead of code.
Come see it in action at GitHub Universe, Oct 28–29. Swing by the Speakeasy and ask for GitHub Next!
In all seriousness, absolute HugOps to all dealing with the fallout from this week. Very lucky that I don't have to do too much of that in my current job.
Absolute scenes.
Will Velida 🇺🇦 retweeted
🚨 JFrog Security Research has identified a supply-chain attack involving malicious code in the LiteLLM 1.107.0 PyPI release. Avoid this version and investigate environments where it was installed or executed. More details will be shared soon in our blog post.
Will Velida 🇺🇦 retweeted
More proof that OpenAI cannot be trusted. If the researchers had given maintainers time to release patches before disclosures, a lot of stress would have been avoided.
This isn't the flex that OpenAI thinks it is.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
Will Velida 🇺🇦 retweeted
What happens when an AI agent follows the wrong goal? @WillVelida joins RunAs Radio to unpack the OWASP Top 10 for Agentic Applications, from goal hijacking and prompt injection to cascading failures. runasradio.com/Shows/Show/10…
The programming course I ever did was in PHP. The teacher was such an asshole I never touched the language again.
Thank god for that douchebag! 😂
The patch is dropping 1AM Melbourne time for local folks: news-web.php.net/php.announc…
Will Velida 🇺🇦 retweeted
‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online.
Researchers report potential RCE.
CVE-2026-109618 and CVE-2026-109619.
Fixes scheduled for October 21, 14:00 UTC.
Details - thehackernews.com/2026/10/ph…
Will Velida 🇺🇦 retweeted
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:
php.net/index.php#2026-10-20…
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow
The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.
PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
Will Velida 🇺🇦 retweeted
🚨 BREAKING: PHP is warning admins to prepare for emergency security updates tomorrow to fix two critical vulnerabilities rated CVSS 9.2.
However, security researchers at @watchtowrcyber rate the flaws CVSS 10.0 and say they are RCE vulnerabilities affecting PHP 5 through 8.
Information about the vulnerabilities has reportedly leaked ahead of disclosure.
No known exploitation in the wild.
🔗 bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Will Velida 🇺🇦 retweeted
Introducing the Raspberry Pi Guide to Retro Gaming!
With so many ways to play retro games on a Raspberry Pi, getting started might seem daunting, so we decided to make this book to demystify it all.
It begins with an easy quick-start guide to get you gaming as fast as possible and includes:
🕹️ DIY handheld build
🕹️ Advanced emulation
🕹️ Using old hardware and CRTs
🕹️ Programming a BASIC game
Get your copy: magazine.raspberrypi.com/boo…
Will Velida 🇺🇦 retweeted
Damn, this is really bad.
Mainstream browsers will probably be fine, but there is a long tail of other stuff that will be affected by this:
scotthelme.co.uk/eight-bits-…
Last week in Agent Security! CERT-In issues advisory of rouge agents at play, Langflow MCP exploited, Aoki infostealer targeting AI coding agent credentials, and OpenCode Console breach exposes LLM API keys: willvelida.com/posts/last-we…
Will Velida 🇺🇦 retweeted
‼️ OpenCode confirms a security breach that may have exposed users' OpenAI, Anthropic, and Google API keys.
1.4% of Console users affected. Some report unauthorized AI usage charges.
OpenCode urges affected users to revoke their keys.
Read - thehackernews.com/2026/10/op…


























