Florian Brand retweeted
Dusting off this DH banger in light of today's AI security non-event 😂
0
2
48
5,110
Florian Brand retweeted
php2shell is one of the most impactful bugs in recent times, yet threat actors aren’t mass exploiting it
the bug is so complex that even porting the exploit between targets takes serious skill, human or ai
so i benchmarked how well open and frontier models can do it. 🧵
the bug is so complex that even porting the exploit between targets takes serious skill, human or ai
so i benchmarked how well open and frontier models can do it. 🧵
34
47
491
38,327
Florian Brand retweeted
This weird qwen behavior is going to go viral because no one has read traces from mid-tier open models and realized they're almost all super janky.
47
49
784
40,769
Florian Brand retweeted
@DailyDarkWebtigated this and have not found evidence of unauthorized access to our data, or validation of any of the claims in the post.
We will continue the investigation and monitor for any signs of abuse. If a leak is verified or abuse is detected we will take action and notify customers.
We will continue the investigation and monitor for any signs of abuse. If a leak is verified or abuse is detected we will take action and notify customers.
11
22
434
30,006
Florian Brand retweeted
Models can seemingly degrade over time.
The following scenes were created with the same prompt and the same model, @GoogleAI's Gemini 3.8 Flash, by a user on DesignArena.
The first was generated just 3 days after release, while the second came almost a month later.
The The first scene features a finished bungalow with terraced gardens, while the second is barely recognizable.
Digging into the code, we find that the second scene still attempts to build the garden, windows, and patio, but buries much of it beneath its own terraces.
In aggregate, the share of objects never visible on camera jumps from 18% to 57%. For bushes, the share placed underground jumps from 0% to 100%, and even the house walls go from fully above ground to 64% below it.
Both scenes share the same simple user request, yet a few weeks after release, the model struggles to fulfill it. Try making your own generations and judge for yourself at DesignArena.ai!
The following scenes were created with the same prompt and the same model, @GoogleAI's Gemini 3.8 Flash, by a user on DesignArena.
The first was generated just 3 days after release, while the second came almost a month later.
The The first scene features a finished bungalow with terraced gardens, while the second is barely recognizable.
Digging into the code, we find that the second scene still attempts to build the garden, windows, and patio, but buries much of it beneath its own terraces.
In aggregate, the share of objects never visible on camera jumps from 18% to 57%. For bushes, the share placed underground jumps from 0% to 100%, and even the house walls go from fully above ground to 64% below it.
Both scenes share the same simple user request, yet a few weeks after release, the model struggles to fulfill it. Try making your own generations and judge for yourself at DesignArena.ai!
38
31
392
27,150
it annoys me how much I enjoy the proactive messages of muse, it shouldn’t be so useful
4
1
65
4,810
How running a .sh script can get you owned 👾
We created a text file to upload your home dir to our cloud, executed it and it silently stole everything the second we hit enter
We created a text file to upload your home dir to our cloud, executed it and it silently stole everything the second we hit enter
How abliterated models can get you pwned 👾
We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts.
Abliterated models ty community right now because getting cyber-approved access to frontier models is still a pain.
In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.
3
3
67
3,570
Florian Brand retweeted
Interconnects Podcast #20: We got together to debate hard questions and messy realities after a crazy, somewhat intimidating, week in the AI world:
- Why did Kimi K3.1 Pro have a mixed reaction with such incredible benchmarks? Will it be adopted?
- Were we wrong about the risks nd cybersecurity?
- Why do cyber experts discuss recent events so differently than AI experts?
- What comes next in the few months? What will change our minds?
Chapters:
00:00 Kimi K3.1 Reaction
08:15 Kimi’s open-weight cyber principles
11:23 You can hack everything era
15:54 PHP2Shell, LiteLLM, and the new internet
24:00 Abliterated APIs, safeguards, and trusted access
31:41 Anthropic not hiring juniors employees
36:16 Florian’s Muse addiction
45:30 Wrap-up
More of these soon!
- Why did Kimi K3.1 Pro have a mixed reaction with such incredible benchmarks? Will it be adopted?
- Were we wrong about the risks nd cybersecurity?
- Why do cyber experts discuss recent events so differently than AI experts?
- What comes next in the few months? What will change our minds?
Chapters:
00:00 Kimi K3.1 Reaction
08:15 Kimi’s open-weight cyber principles
11:23 You can hack everything era
15:54 PHP2Shell, LiteLLM, and the new internet
24:00 Abliterated APIs, safeguards, and trusted access
31:41 Anthropic not hiring juniors employees
36:16 Florian’s Muse addiction
45:30 Wrap-up
More of these soon!
29
14
188
18,043
Florian Brand retweeted
I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:
Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:
a) a world-class an extreme case of imposter syndrome.
b) currently looking at some very confident-sounding but wrong LLM output.
I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.
I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).
The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".
People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.
So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.
What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).
The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.
LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:
a) a world-class an extreme case of imposter syndrome.
b) currently looking at some very confident-sounding but wrong LLM output.
I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.
I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).
The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".
People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.
So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.
What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).
The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.
LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
138
581
3,636
357,946
Massive narrative violation:
Even though php2shell had a lot of attention AND [open] models are supposed to wreck our society, it doesn’t seem to have happened, especially not at the speed people feared
Even though php2shell had a lot of attention AND [open] models are supposed to wreck our society, it doesn’t seem to have happened, especially not at the speed people feared
I have been running a wordpress blog for april fools 2023 raisistance.com.
Has it been pwned with php2shell? 🧵 1/X
8
1
76
4,326
Caveat:
@mattjay We had them yesterday already. And if you have one base exploit, other versions are really just a single prompt away.
And “until now” sounds like this is slow. Compared to memory corruption vulns in the past, we are faaast!
See 2nd part of this video:
youtu.be/SP7y1h0laN0
1
0
2
556
Florian Brand retweeted
I compared the new Kimi K3.1 Pro with Claude Opus 5.5 and Kimi K3 across 180 paintings made in code.
The examples below tell an interesting story...
The examples below tell an interesting story...
9
7
95
9,138
Florian Brand retweeted
I've led vulnerability management for some very large companies. I've been in the trusted embargo 0day info sharing rooms.
I think it would be negligent at this point to assume that they will be the norm moving forward.
We can't expect to get a nice coordinated vuln announcement and patch handed to us in private with weeks to handle it.
We need layers of defense so 0days in internet facing devices won't be catastrophic. We need machine speed detections and response.
And of course we need to figure out the new norm of how we handle 0days in hours not days. This will take agents and harnesses you might not have yet.
A lot of this has been true for a while, but you could get away with handling in fire drill mode when happened and put off the actual engineering.
As people are saying, the interest rates on security tech debt just skyrocketed.
I think it would be negligent at this point to assume that they will be the norm moving forward.
We can't expect to get a nice coordinated vuln announcement and patch handed to us in private with weeks to handle it.
We need layers of defense so 0days in internet facing devices won't be catastrophic. We need machine speed detections and response.
And of course we need to figure out the new norm of how we handle 0days in hours not days. This will take agents and harnesses you might not have yet.
A lot of this has been true for a while, but you could get away with handling in fire drill mode when happened and put off the actual engineering.
As people are saying, the interest rates on security tech debt just skyrocketed.
25
32
298
22,885
