AhRZbVYwWVM1emVXeDJhV1V1Wm5scAoccUtabXB6NXVvSkg2TElPMXAzTWFuMU4ycGo9PQ==
she/her 21
Joined May 2021
- Tweets2.4K
- Following415
- Followers1.9K
- Likes7.1K
>12 hour layover at ewr
>upgrade requested weeks ago, seems likely to clear
>was 2/3 last night, is now 1/2
>no polaris lounge access until it clears
they're rly gonna make my chud ass wait all day in the united club what the hell 😭 – at Hillside, NJ
i know most of everyone’s focus is on the php bugs but this one is really important to patch quickly too!!
this same brotli vulnerability impacts a bunch of things, including express.js on node or bun with an app.use(express.json()) or the cURL client with the --compressed flag.
super proud of @k_tr4n and the rest of our team who helped find and disclose this!
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
friend told me the labs keep stealing cloudflare employees so i asked how many employees they have left and he said they just go to twitter and get a new one afterwards so i said it sounds like they're just feeding all of tpot to the labs and then dane started crying. – at Belakang Padang, Indonesia
i don't understand why but i was just overcome with a sudden and incredible urge to go to buffalo new york. it must be something about this place. – at Central Region, Singapore
they weren't lying wtf that airport straight up does have a waterfall – at Pengerang, Johor
ALT the cool part of singapore changi airport
Sylvie retweeted
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release.
Please read more about our approach:
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
Sylvie retweeted
Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative.
Sylvie retweeted
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
i bet the ual pilots get a kick out of pressing the button that makes that fuckass elevator music play every damn time – at Hillside, NJ
Sylvie retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
source tells me vendy is stable
please god – at Bochum, Germany
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work.
At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.
We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
i don't think im ever gonna get tired of getting to sit in the fancy bitch seats it's so awesome every time
ecsc here i come – at Millbrae, CA
ALT me on a b787 leaving sfo on the way to fra
someone seriously believing that glm 5.3 is at the same level of capability as mythos preview was is a sign to me that either:
- one has never used glm 5.3
- one has never used mythos preview
- one has no idea what they're talking about, generally
that being said, i do also think that glm 5.3 being public is still a net-negative for the world. – at San Francisco, CA
