Apparent Order retweeted
StealMyBitcoin is solved! This is the absolute best explanation you’ll see on how hard #php2shell is to exploit. The author had to trigger a precise memory corruption condition, leak internal memory addresses, bypass aslr, reverse engineer php’s internal memory structures, forge structures to hijack execution, and account for php build differences, worker behavior and timing to get RCE. 20 http requests with a 7 out of 10 success rate. What an amazingly successful CTF. Impressive the creator was able to keep the server up during all the attempts. With all the BS around it’s nice to see something concrete that moves the art forward.
github.com/KillaBoi/StealMyB…
Love this. The💰is still in the wallet. Finally we get some ground truth around how hard php2shell is to exploit. The amount of bullshit flying around from vendors capitalizing on the moment is staggering, And the alert fatigue they’re creating is really going to hurt when a mass exploitable RCE emerges. We still haven’t seen a production site hacked via #php2shell at Wordfence.
Apparent Order retweeted
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
Apparent Order retweeted
I'm going to plant a flag here: 2026 is going to go down in computer security history as the year of a million CVEs. (Maybe literally, but definitely figuratively.)
LLMs are producing lots of slop, but they're also finding a heck of a lot of real vulnerabilities.
Apparent Order retweeted
PHP folks, please don't rely on the ini config change to protect your apps. It won't help when the full details are out - it only protects against a single vector, if that. You need to apply the patches as soon as they drop.
phpc.social/@joepferguson/11…
Apparent Order retweeted
Can we now do away with the whole CA nonsense and use DANE/RFC6698 in browsers? Yes, yes, it was great that the CIA/NSA could MITM every website, but it's time to move on.
Apparent Order retweeted
If you use @OVHcloud look at this urgently
Si vous avez téléchargé aujourd'hui la dernière version de CLI d'OVHcloud, merci de la mettre à jour à nouveau très rapidement. Sinon effacer. Il s'agit de repo:
github.com/ovh/ovhcloud-cli
La version CLI de 14h47 a été compromise par un hacker. Nous l'avons détecté et bloqué à 16h21. Merci au client qui nous a remonté le souci. La version compromise est v0.11.0 v0.12.0 v0.13.0 v0.14.0 v0.15.0.
La version v0.10.0 et la future 0.16.0 est clean.
On vient de finit les premières vérifications et aucun autre repo n'est affecté. Nous avons aussi retracé l'incident. Le hacker a utilisé le compte github d'un des développeurs et a ajouté un binaire dont le job est récupérer les secrets sur le disque. La qualité du binaire est médiocre mais il peut aller jusqu'au bout. Si vous êtes concernés, merci de changer tous les secrets sur votre disque.
On continue les recherches sur le binaire et on va publier les détails additionnels sous peu.
Apparent Order retweeted
Lambda Web Functions were released today. I got carried away and wrote three blog posts about them.
1: A collection of technical tidbits.
2: They're not actually Node.js-only, you can run Go/Rust.
3: They're cheaper than Event Functions at processing events.
1/4
Apparent Order retweeted
Having long been aware of those tech bros who read my work as utopian porn, where they’ve taken that doesn’t exactly surprise me.
Apparent Order retweeted
🚀 Meet Strands Decider 2B, a small open source decision model built for fast experimentation and local development: strandsagents.com/blog/intro…
It's part of a new class of decision models. Unlike reasoning models that generate open-ended text, Strands Decider 2B picks between options and assigns confidence scores. Decision models are faster and more capable at a given size, always produce an answer from the selected options, and can run with very low latency.
Strands Decider 2B is a 2 billion parameter model that runs on a local CPU or GPU and can return answers to meaningful questions in tens of milliseconds. On accuracy and calibration, it ranks second among public models in its ~2 billion parameter class, and first among those that share their full training recipe.
We're already seeing early success with model routing, tool selection, guardrails, evals, and hybrid agents that pair LLMs for the hard calls with decider models for the rote ones. Grab the code on GitHub and the latest snapshots on HuggingFace, and tell us what you build.
This space is super early and we are experimenting with different variants of these models, so give it a spin and give us feedback!
Apparent Order retweeted
Amazon EMR 7.14 on EKS now supports IPv6 Amazon EKS clusters
aws.amazon.com/about-aws/wha…
Apparent Order retweeted
AWS coverage of IPv6 is sort of sufficient in 2026 . It used to be really really bad. But most core offerings now have it. Though it will require some tweaking of your aws SDK config for some services because aws hates you .
Apparent Order retweeted
AWS has a new sign up experience, which puts new accounts into a sort of a sandbox, but not exactly in the way you might think. This post explores what it does and how it works. wiz.io/blog/exploring-the-ne…
Apparent Order retweeted
I rented some of the biggest network-optimized EC2 instances AWS has, including the 600 Gbps c8gn.48xlarge, and pointed a DPDK packet generator at them. Then did the same for the rest of the c8gn family.
Some interesting findings 🤓 learnings and link in the thread 🧵
Apparent Order retweeted
I'm glad we did this too!
Quick thread about supporting FK constraints in Aurora DSQL.
DSQL adds foreign keys! Glad they did it, sad they had to. docs.aws.amazon.com/aurora-d… It will enable people to make far less optimal decisions and then blame DSQL for their pains.
Apparent Order retweeted
Launching Route 53 Files: daemonology.net/blog/2026-08…
Apparent Order retweeted
Replying to @W3Techs
@W3Techs now shows that 60% of the top 1000 sites use IPv6.
w3techs.com/technologies/bre…
The more popular a site is, the more likely it is to use IPv6.


























