uglybyte retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
51
265
1,925
172,524
uglybyte retweeted
There is a recurring info I hear from vendors that there is often a first discovery of a vulnerability by AI and suddenly one or two weeks later lots of collisions come in. In this case the PHP bugs were first discovered 5th August and then rediscovered 2 weeks later
6
6
76
14,038
how far is the credit taking gonna go today? is @JensenHuang gonna tweet his GPUs were the ones executing the inference?
0
0
1
35
uglybyte retweeted
there's a real risk that a single PHP server will be exploited to infiltrate a guest OS somewhere, & from there, CVE-2026-99999 could be exploited to breach the host OS, leading to all other guest servers. So even if you don't run php, if some random customer of your host does, you are still going to be affected. This is esp concerning knowing most vps/compute providers still aren't patched.
22
69
1,128
86,437
For those who wondered how the dancing anime girl came around, it's in the original music video! youtube.com/watch?v=Uw_hZf…
That said, huge respect to @lcfr_hax who found this masterpiece and doesn't even care to set the record straight. I don't think it's cool others are taking credit for it, afaik it was a bug class that was so large they invited outside help, but the original work is his.
That said, huge respect to @lcfr_hax who found this masterpiece and doesn't even care to set the record straight. I don't think it's cool others are taking credit for it, afaik it was a bug class that was so large they invited outside help, but the original work is his.
0
0
1
94
no way the japanese PM is tweeting about the vuln wow
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
0
0
0
46
uglybyte retweeted
Distillation is a valid training technique, and I will repeat this until the phrase "distillation attack" becomes wildly taboo to say
Over the last few months, we’ve made significant progress in reducing the effectiveness of distillation attacks against Claude.
In this post, we explain how: anthropic.com/research/disti…
17
43
685
13,303
Op3n just got a new meaning, interesting quest this year @Ledger. Why don’t you make a similar map for affected resellers? @MagicalTux
Students at Op3n is back. An initiative by Ledger N3XT.
Oct 15–16: 31 students from 13 university blockchain clubs at Ledger HQ, Paris.
Private hackathon on the Ledger stack, Ledger Donjon workshop, panels with industry leaders and real Parisian experiences.
2 packed days 🧵
0
0
0
48
uglybyte retweeted
In case people think I am advocating for not being cautious, or thinking that AI won't be an issue for any cryptography, that's not the case. Let me word what I think would be a balanced approach regarding AI and crypto. 1/n
9
54
286
31,855
uglybyte retweeted
Success!! Tim Becker (@tjbecker) and Yves Bieri (@yves_bieri) of Xint (@xint_official) just remotely exploited the targeting Google Pixel 10! Stay tuned for confirmation if they will secure the total of $300,000 and 30 Master of Pwn points!
10
26
294
27,339
If Lindell isn’t right here (and I’m pretty sure he is. Can’t imagine ECC crypto being broken anytime soon) we’re all doomed anyways
I wasn’t going to comment since this is a really bad take IMO, but since it’s taken off I feel the need to. To my understanding, there is no evidence whatsoever pointing to a break of decades old hardness assumptions like elliptic curve cryptography. 1/n
0
0
0
53
