Pinned Tweet
@0xIlyy WE NEED MORE CHEMISTS, BIOLOGISTS, AND MATERIAL SCIENTISTS
Trad science demand is going to skyrocket once AI starts (it already is to some extent) breaking down tough barriers in these fields.
Technologists with deep understandings of traditional science will dominate the 30s
Trad science demand is going to skyrocket once AI starts (it already is to some extent) breaking down tough barriers in these fields.
Technologists with deep understandings of traditional science will dominate the 30s
51
47
684
173,371
bc most people on X work in pure tech, there is a super inflated expectation that AI is just going to sweep through everything. the rest of the industry in the world is not like tech. demand is increasing. this is not a capability problem. this is a people problem u nerds.
20
7
165
4,062
there are 2 types of people who use agents.
@theo Tools aren’t needed anymore. Just execute LLMs responses directly. Everything is just a cli at the end of the day
4
4
109
4,022
WIF fixes this and should be the standard supported by all api providers and hosts.
your never gonna believe this but most of the real hyperscalers have had this btw
your never gonna believe this but most of the real hyperscalers have had this btw
It’s time to kill “static credentials”.
Attacks and breaches can happen. But imagine if thieves could only steal “self-destructing keys” to your data and tokens.
The industry once came together to deliver “green locks” encryption for every site (TLS). Let’s do it for OIDC! 💪
3
3
55
1,892
the talent shortage going on rn is basically infinite. anyone can point an agent a game and RE it, 10x perf of a lib/language/compiler, find some vulnerabilities, etc. the talent is in the people that have the foresight, to skate to where the puck is going, not where it is.
11
33
623
14,131
Bend2 is still incredibly underrated btw. took this concept to the limits of the extreme. people have yet to realize the security implications of such a new way to program. but they will. late as usual.
Speculative prediction: Over the next 12-24 months the need to formally verify everything will turbocharge demand for frontier AI the way the y2k bug turbocharged IT spending in the late 90s.
Then like y2k, after the bug is mostly fixed theres likely a market hangover.
10
10
253
7,294
@VictorTaelin genuinely will be looked back as the forefather of popularizing concolic testing and popularizing the paradigm for software in the future. it’s the only way
0
1
23
594
Teamwork makes the dream work.
The team and I
@J4ck3LSyN @Archknight23
🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow.
The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.
📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up.
PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act.
Here's the part the big threat-intel shops aren't shouting about:
No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling:
🔹 Present since PHP 5.4
🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live)
🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config
That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands.
✅ What to do right now:
1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade.
2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess:
session.upload_progress.enabled = Off
Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths.
3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.
4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today.
Why I'm posting this for free:
A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response.
I'll follow up once the official advisory publishes and confirm whether my root cause read was right.
Stay patched. 🔒
#PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec
0
0
3
763