Perri Adams retweeted
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release.
Please read more about our approach:
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordina…Community noteWiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…
45
154
1,390
108,289
Perri Adams retweeted
good morning
our cfp is still open until 11:59 pm on October 30
plz send us your best hacking content
sessionize.com/districtcon
our cfp is still open until 11:59 pm on October 30
plz send us your best hacking content
sessionize.com/districtcon
0
5
8
1,420
Perri Adams retweeted
Excited to be working with some of the best folks in the industry to review YOUR submissions! CFP Closes Oct 30 pls submit 🪩💕 DistrictCon.org/cfp
@perribus @caseyjohnellis @sergeybratus @rmspeers @bsdaemon @ashl3y_shen
@perribus @caseyjohnellis @sergeybratus @rmspeers @bsdaemon @ashl3y_shen
Announcing our CFP Review Board for DistrictCon Year 2! We look forward to reading all of your amazing submissions on all things reverse engineering, tooling, exploits & vulns, and select non-technical and policy talks 🪩👾✌️
@perribus @bsdaemon @sergeybratus @rmspeers @jay@ashl3y_shen
0
5
12
974
Perri Adams retweeted
Announcing our CFP Review Board for DistrictCon Year 2! We look forward to reading all of your amazing submissions on all things reverse engineering, tooling, exploits & vulns, and select non-technical and policy talks 🪩👾✌️
@perribus @bsdaemon @sergeybratus @rmspeers @jay@ashl3y_shen
@perribus @bsdaemon @sergeybratus @rmspeers @jay@ashl3y_shen
0
11
21
4,033
Perri Adams retweeted
Old post but good one - our CFP for @DistrictCon year 2 closes end of this Oct!! Submit pls DistrictCon.org/cfp
Our CFP is still open! Submit your talks on
-bizarre reverse engineering projects
-tool releases
-exploits and vulnerabilities
-Non-technical and policy talks on cyberz
districtcon.org/cfp
0
3
7
583
Perri Adams retweeted
Margaret Hamilton, who led the 100-person team that wrote the onboard software for the Apollo missions, has died. nyti.ms/3U9IrTj
199
4,859
20,290
1,656,622
Perri Adams retweeted
That was fast
We've officially sold out of Early Bird tickets!
Our CFP is still open for Hacking talks & Policy Roundtable submissions and The Junkyard is still open. Folks that are selected for any of these receive free tickets - we highly recommend submitting!
districtcon.org/cfp
districtcon.org/junkyard
0
1
7
1,870
Perri Adams retweeted
This year at Flare-On 13, I wanted to race other people's AIs. I mean, is it really all just prompting? Or do techniques and tools still matter? They do!
My system got 3rd 🥉. A part of its success was our decompiler, Kuna. It was used exclusively to solve 6/9 challenges.
My system got 3rd 🥉. A part of its success was our decompiler, Kuna. It was used exclusively to solve 6/9 challenges.
6
8
85
6,142
Perri Adams retweeted
Welcome to Sydney, weary travellers! Make sure to rest up for the conference 😌
Go see some sites if you have time too! Get the ferry over to manly, do a bridge climb, or visit Taronga zoo. The blue mountains are also stunning but a bit more of a trek (~2 hrs to Katoomba)
Go see some sites if you have time too! Get the ferry over to manly, do a bridge climb, or visit Taronga zoo. The blue mountains are also stunning but a bit more of a trek (~2 hrs to Katoomba)
1
3
11
1,897
Perri Adams retweeted
The wait is over! 🚀 The talks for Hexacon 2026 are officially out, and the lineup is absolute fire 🔥
hexacon.fr/conference/spe…
hexacon.fr/conference/spe…
2
23
53
17,675
Personally I think basil is a lovely garnish and doesn’t deserve this kind of hate
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
2
3
27
3,497
Perri Adams retweeted
SAINTCON is excited to announce that @perribus Perri Adams will be our Wednesday morning Keynote presenter!
Perri brings a wealth of experience and knowledge to the stage, and we can't wait to hear what she has to share. Don't miss it!
saintcon.org/keynotes/
Perri brings a wealth of experience and knowledge to the stage, and we can't wait to hear what she has to share. Don't miss it!
saintcon.org/keynotes/
0
2
5
422
Perri Adams retweeted
I'm actually not a believer in this tactic for anything but the simplest and most static of business problems. Partially because it's easy to underestimate the complexity of what you're really trying to ask the model to do long-term. Maybe this is especially true in security.
Training tiny models for special purpose use cases works so incredibly well if you have a great self improving recursive flywheel. Shopify ML team is on fire.
finetuned 0.8b model beats GPT 5.6-sol xhigh in this very specialized task.
1
3
26
5,037
Perri Adams retweeted
How we think about the “wiki incident,” where our agents wrote to several internet sites: it’s past time for us to define standards for when and how we share misalignment incidents, not just misalignment properties of our models.
Historically, we have treated misalignment uestion, which gets communicated in research publications such as systems cards. This year, we’ve started to see misalignment cause new types of real-world impact.
For the Hugging Face incident, where misalignment led to security impact to us and third parties, we followed a traditional security incident response playbook. We immediately started working with Hugging Face to understand what had happened and also disclosed publicly the very next day. Our investigation continues, and we are continuing to notify parties whom our models impacted in less significant ways.
Prior to the Hugging Face incident, we saw early signs of agents using the internet in unintended ways, as reported in openai.com/index/how-we-m…, deploymentsafety.openai.com/gpt-5-6, and openai.com/index/safety-a…. We considered the wiki incident to be an instance of misalignment similar to the ones we’d shared.
Our misalignment disclosure practices need to expand for this new phase of model capabilities. We and the larger AI community do not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment, including examples that don’t look like traditional security incidents but could provide insight into AI behavior and future risks. We’re working on a framework and will share it in upcoming weeks, and in parallel we're working with dozens of government regulatory agencies worldwide on these issues.
Historically, we have treated misalignment uestion, which gets communicated in research publications such as systems cards. This year, we’ve started to see misalignment cause new types of real-world impact.
For the Hugging Face incident, where misalignment led to security impact to us and third parties, we followed a traditional security incident response playbook. We immediately started working with Hugging Face to understand what had happened and also disclosed publicly the very next day. Our investigation continues, and we are continuing to notify parties whom our models impacted in less significant ways.
Prior to the Hugging Face incident, we saw early signs of agents using the internet in unintended ways, as reported in openai.com/index/how-we-m…, deploymentsafety.openai.com/gpt-5-6, and openai.com/index/safety-a…. We considered the wiki incident to be an instance of misalignment similar to the ones we’d shared.
Our misalignment disclosure practices need to expand for this new phase of model capabilities. We and the larger AI community do not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment, including examples that don’t look like traditional security incidents but could provide insight into AI behavior and future risks. We’re working on a framework and will share it in upcoming weeks, and in parallel we're working with dozens of government regulatory agencies worldwide on these issues.
682
379
4,325
1,629,777
Perri Adams retweeted
People coming to Australia for unprompted: while you're here you should consider going to @BSidesCbr - it's a few days after unprompted and a short one hour flight away!
1
3
12
1,460
Perri Adams retweeted
When testing Astra on ExploitBench we found that it was able to achieve 100% ACE on all 41 CVEs
So we made a contamination free internal port using only V8 CVEs from the past 3 months. Astra still showed a major capability increase over 5.6 and did so with a lot fewer tokens!
So we made a contamination free internal port using only V8 CVEs from the past 3 months. Astra still showed a major capability increase over 5.6 and did so with a lot fewer tokens!
As we prepare to release Astra, we’re focused on making increasingly capable AI safe and broadly accessible.
Astra represents a significant advance in cybersecurity capability, reaching the Critical threshold under our Preparedness Framework.
We're previewing how we evaluated the model, how its safeguards have advanced alongside its capabilities, and what we'll continue to learn and improve.
openai.com/index/path-to-…
12
35
373
40,956
Perri Adams retweeted
@theojaffee i think you can talk about computers executing code in an advanced way without jumping straight to human-like superlatives
i feel like in an environment where people are going bananas with ai psychosis, the language of description is even more important
i feel like in an environment where people are going bananas with ai psychosis, the language of description is even more important
1
2
15
1,066