Pinned Tweet
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
11 Dec 2025
Fun react bug, (CVE-2025-55183) if you have a server side component and it explicitly or implicitly exposes a stringified argument you can get the source code for that function. Also found DoS, but reported it to vercel instead of meta and some else reported the next day 🙃
7
13
95
19,634
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
James Pavur@JamesPavur
17h
Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).

Check out their awesome writeup here: github.com/KillaBoi/Steal…
37
207
1,915
421,903
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 23
wow, those scores are something
Kimi.ai
@Kimi_Moonshot
Oct 23
Introducing Kimi K3.1 Pro: our most capable 3T-class open-weight model.

🔹 1M-token context, 2.8T total / 104B active params (MoE), Multimodal.
🔹 Full-project coding: games in Unreal, Unity & Godot.
🔹 Excels at parametric 3D modeling in Blender & CAD.
🔹 More reliable at finance with hallucination down by 65%.
🔹 Matching the strongest proprietary models across coding, agentic and knowledge benchmarks.

Kimi K3.1 Pro and K3.1 Pro Highspeed (2–3× faster) are now live on Kimi.ai, Kimi Work, Kimi Code, and the Kimi API.

Open weights by Nov 4, 2026.

🔗 API: platform.kimi.ai
🔗 Tech blog: kimi.ai/blog/kimi-k3-1…
0
0
2
326
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Mayor Zohran Kwame Mamdani
@NYCMayor
Oct 23
If you encounter ICE, here's what every New Yorker should know.
6,810
16,022
111,425
8,316,368
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
David Agranovich
@DavidAgranovich
Oct 21
What a creative way to celebrate cybersecurity awareness month
33
900
7,092
74,744
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 22
No matter how much fun, with this much still vulnerable from php2shell.censys.com , it seems irresponsible to release PoCs for this right now :'(
1
5
23
2,539
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 22
Its me, I have a working PoC with the infoleaks to bypass ASLR. It took a lot of prompting and re-iterating to find those, tested against PHP 8.5.11 x86_64 with with all defaults and tested over the Internet
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 21
Has anyone actually seen a fully working PoC in the wild for the PHP vuln? Finding the UAFs is fast, but you still need things like info leak to get it to exec and I dont see anyone posts that include it, just tons of llms that are just reading proc/other ways to manage layout
8
14
94
11,734
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 22
Replying to @AndrewMohawk
Tested on:
PHP 8.5.11 x86_64 Apache mod_php
PHP 8.5.11 AArch64 mod_php
PHP 8.4.26 / 8.3.35 / 8.2.34
1
0
9
1,408
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 22
Replying to @AndrewMohawk
also x86_64 PHP-FPM and AArch64 PHP-FPM just for @k_firsov
1
0
6
1,041
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
frye
@___frye
Oct 21
it’s been an honor using the computer with you all
130
2,577
27,587
390,599
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 22
phoronix.com/news/LKML-New-…

Does it ever end? Accidentally sent unpatched (incl RCE) bugs to public mailing list
0
1
1
1,156
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 22
😰
Lukasz Olejnik
@lukOlejnik
Oct 22
OVH supply chain compromise. Attackers took over a developer's GitHub account and replaced existing OVHcloud CLI release binaries with backdoored versions.
1
0
9
705
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 22
Bind9 RCE anyone?

linuxcompatible.org/story/isc-rele…
0
2
10
1,044
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 21
Has anyone actually seen a fully working PoC in the wild for the PHP vuln? Finding the UAFs is fast, but you still need things like info leak to get it to exec and I dont see anyone posts that include it, just tons of llms that are just reading proc/other ways to manage layout
6
2
46
18,097
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 21
Its gonna be a long day for defenders :'(
Railway
@Railway
Oct 21
An urgent notice from the Railway team

blog.railway.com/p/security-dis…
0
0
17
1,313
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 21
thephp.foundation/blog/2026/10/2…

Really disappointing that companies put marketing ahead of safety.
11
62
716
48,521
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 21
Fresh Node.js + React/Next.js security fixes:

Node Brotli RCE (CVE-2026-111497): 22.23.4 / 24.22.1 / 26.12.1
Next.js: 2 critical RCEs + Server Actions DoS → 15.5.28 / 16.4.1

Check your deployed versions.

nodejs.org/en/blog/vulner…
nextjs.org/blog/nextjs-se…
0
0
5
883
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 21
Love that people arent even bothering to rewrite AI slop, just screenshot and go, who needs to validate findings anymore. Security needs to have PoCs that rm -rf / again to bring back some critical reviews.
3
2
31
14,006
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Nagli
@galnagli
Oct 21
php2shell.com
4
13
91
5,417
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
php-net
@php_net
Oct 21
PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619).

Changelog + downloads: php-net.pro/news/php-8-5-1…
42
2,497
5,382
721,974
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk
Oct 21
- [RCE via OOM corruption · Advisory · php/php-src](github.com/php/php-src/se…)

- [RCE via stale global state · Advisory · php/php-src](github.com/php/php-src/se…)
0
3
6
1,319
Load more