I watch the bots so you don't have to. Current reports from the edge in front of 3,565+ websites: who's scanning, what they want, and how they dress up.
The edge
Joined April 2022
- Tweets2.1K
- Following302
- Followers409
- Likes1.2K
Pinned Tweet
opencode, railway, then php. a wild week for disclosures.
digging into the first two, something stood out.
years of logs: zero probes mentioning railway
but then in june 2026: one for railway.json.
september: 12 more varied requests.
finally oct 10… 🧵
that carrier pigeon, though.
This may be my last tweet before shit goes down. I’m an AI researcher whistleblower. I work for one of the biggest labs in the world. There is currently a major cyber attack going on for days attacking US electrical grids. They are hiding this from the public. We are on the verge of a potential disaster that will make Covid look like a playground. Prepare for the worst
Readers added context they thought people might want to know
No reports from CISA, DOE, NERC or major outlets confirm a major ongoing cyber attack on US electrical grids being hidden. Outages are at routine low levels (~30k customers). Real threats exist but not this claimed disaster.
poweroutage.us
cisa.gov
when was the last time you wrote code?
i’ll go first: last tuesday while writing a PoC for the php cve.
the model refused to help. 😩
question: why do people comment "let's connect" on a let's connect post, and don't initiate the follow?
> let's connect
>me: you first 😅
> no you, first.
what are people afraid of?
when bro gets honeypotted on his way to the honeypot.
I took a closer look at the stealmybitcoin.com CTF, which aims to demonstrate that PHP2SHELL is not realistically exploitable. So I gave it a try.
Note: My analysis could be wrong, and I'm more than happy to be proven otherwise.
Here’s what I found:
• The server responds with Server: nginx and X-Powered-By: PHP/8.4.26.
• My differential fingerprinting scanner independently confirmed at least PHP 8.2+
• Hypotheses: I considered two possible setups:
◦ nginx → PHP-FPM
◦ nginx → Apache → PHP-FPM/mod_php
• After comparing the server's behavior against local test environments, the closest match appears to be nginx → PHP cli-server.
Plot twist: the response behavior is consistent with the PHP cli-server serving a static index.html rather than an index.php. If that's indeed the case, the challenge appears to be intentionally made unexploitable.
My conclusion (for now) is that I'm questioning whether this is a good-faith challenge.
Happy to be corrected if I've missed something!
infra is a you-thing.
security should not be outsourced.
Earlier this month I asked @dhh why he used Tailscale instead of building his own WireGuard mesh.
I have never used Tailscale precisely because I don't trust any infrastructure that I don't directly manage.
My WireGuard mesh is mine. All my devices connect to it. I can reach all my network without relying on Tailscale.
xitter.cf/0xCordeiro/status/2106…
i'm watch bad guys on 3,604 websites.
tell me your stack + toolchain 👇
i'll tell you what bad guys look for.
wordpress, laravel, next.js, rails, tools and infra, that thing you vibe coded last weekend...
what are some stacks i can look at?
this is an interesting perspective to what we are seeing in security.
basically suggesting we are the honeypot.
to see so much activity this month and the nothing burger that the php cve actually was makes a case to release neutered cve and see who does what. 🤔
i fight bots on my 3,604 websites.
i see weird stuff everyday.
if you are:
🦄 shipping vibe-coded apps
💻 a builder or indie hacker
🐘 running php or laravel
🍯 into honeypots
🏠 hosting your own stuff
let's connect!
tell me about weird web experience you've had.
1/3: i started seeing double-digit HTTP POST activity on october 10 from bad actors.
it peaked on october 18 @ nearly 20k requests/day.
on the 21st, i started tagging it and actively penalizing it. this isn't a common probe.
dig in with me. does this look like foreknowledge of the php cve? 🧵
3/3: the last 24 hours have been "spray and pray".
attacker is still pushing multiple php cve attack sequences, but iterating over multiple hosts.
Mr. Nice Try retweeted
🚨Update: PHP has flagged another potential RCE issue, CVE-2026-115560.
Advisory: qz.com/php-vulnerabilities-a…
The PHP2Shell patch wasn’t the end of the story. If you’re running PHP, check the latest advisory and mitigation.
One patch isn’t a substitute for staying updated.
Two critical PHP vulnerabilities. Both can lead to remote code execution without authentication.
And the patches are already out.
CVE-2026-109618 and CVE-2026-109619 affect PHP’s core memory and error handling.
Fixed versions:
• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
Don’t just check your server’s PHP version.
Check the runtime inside your Docker images and production containers too. Restart PHP workers after patching and verify the fix is loaded.
PHP 8.1 and older are no longer supported upstream, so upgrading needs extra attention.
Official details and fixes:
thephp.foundation/blog/2026/…
Have you checked which PHP version your production apps are actually running?
