Scouse feral academic. Quantum Hacker, ML miscreant, & mathematician. Views own. Collects useless degrees. @quantum_village (he/him) @Unprovable@mastodon.social
Joined August 2011
- Tweets77.8K
- Following6.7K
- Followers7.3K
- Likes128K
Mark C. retweeted
Ben Recht is teaching a course on Forecasting: its uses and approaches. It is super-interesting. I read a few lecture notes. They resonated. If you are vaguely interested in the subject, self-recommending.
argmin.net/p/forecasting-a-c…
Mark C. retweeted
github.com/advisories/GHSA-9…
一般是懒得发复现贴的....，但是这算圆梦了，以前java时代就有一个解析表达式的请求直接rce，一直想python没吃过刚好Brotli出了问题hhh，跑了一整天浪费无数token
Mark C. retweeted
Beautiful new result in statistical learning theory and probability: arxiv.org/abs/2610.24336
Mark C. retweeted
turns out it classifies what audio it hears, before reporting back to samsung.
sensor preferences, dog-barking and baby-crying event counters, and camera streaming duration are built into telemetry paths.
Mark C. retweeted
Update: Our PHP exploit is now production-grade.
* stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load
* ARM64 + x86-64 targets
* MediaWiki, WordPress, phpBB, Laravel
* Apache/mod_php and nginx/php-fpm -> root
xitter.cf/dguido/status/21131291…
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
eliastaylor.com/noexploit/
Mark C. retweeted
Sorry folks, we have a confirmed PHP compromise with post-exploit activity. Still not the widespread outbreak we all braced for, but it’s actively exploited in the wild. Updated threat brief:
unit42.paloaltonetworks.com/…
Mark C. retweeted
Excited to announce that I'll be keynoting at Black Hat Europe this year in London! I'll be talking about the distinction between AI Security and AI Safety, and the co-option and conflation of security and safety methodologies in AI that are leading us down a precarious path.
This quoted post is unavailable.
Mark C. retweeted
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
eliastaylor.com/noexploit/
Mark C. retweeted
Interviewed someone. I have a very structured and analytical approach to interviews. But all the technical considerations are, interestingly, constraints to be satisfied. At the end of the call I wonder “would I want to work with this quant or PM day after day after day?” and if the answer is a hell yes!, what is there to say? It beats every careful weighting and it’s very accurate. A lot (all?) of the top performers are fun, humble people.
Mark C. retweeted
I'm happy to share that Mojo and MAX are now fully open - for development, extension, and commercial use! This includes the full Mojo programming language, but also the MAX graph compiler, MLRT runtime internals, and hardware abstraction logic.
Get your agents going!👇
Mark C. retweeted
I criticize the CVE system a lot, but you shouldn’t just silently patch a bad vuln under “changes: bug fixes”. That’s dishonest to your users, who deserve transparency so they can determine the patching urgency.
Always be transparent about vulns that affect you.
And we still haven’t heard anything from them about the recent breach + api key theft. No post mortem report yet.
@thdxr this shows low security maturity, you prob need to hire more security engineers
🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.
Fixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.
What developers need to know: thehackernews.com/2026/10/op…
Mark C. retweeted
"AI writes shit code; it is inherently insecure and must be vetted carefully. Humans are irreplaceable."
Y'all shoud have written all this crap in Perl and mod-cgi not php, no one uses Perl.
(I once asked C. to write something in Perl and he wrote a wrapper in Perl to call inline Python. Fucking disrespectful.)
Mark C. retweeted
An update from Brewster Kahle on today's outage.
ALT Internet Archive ops staff were heroes last night. PHP vulnerability announced, soon saw attacks, isolated the vulnerability, used Claude to make fixes for our older php versions, used local models to run simulated attacks, deployed. reinforced WAF and other guards. Offline briefly, Back on new versions and running! Given the severity, there are heroes in many many orgs from last night. Could have been no lights, no traffic signals, real problems. Heroes. Thank you all.
Mark C. retweeted
Gauss had a personal seal(!) emblazoned with the motto “Pauca sed Matura” ("Few, but Ripe"). Worth remembering as quantity becomes cheaper.
Mark C. retweeted
How bad is this Gitlab issue? About as bad as it gets.
Anyone on the internet can take over an exposed, self-hosted GitLab server without logging in, on any version from the last 12 years.
Shodan is showing ~60K exposed servers online, which is a lot, but there are are far more internally for anyone with a foothold already.
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Mark C. retweeted
Note who this is addressed to: all organizations using PHP! I think this is the same as saying: "All organizations that use a computer."
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.