Bold | Enginerd | Cyberstuff | Data science(AI) | Jedi Knight | Sportoholic | Grinch | Übermensch | Science, yeah! | Derechos Reservados©Pablo Corona Fraga 2009
México
Joined June 2009
- Tweets41K
- Following950
- Followers5.4K
- Likes6.6K
Pablo Corona Fraga retweeted
Wel, no the 30th time at las vegas, I meant:
For the 30th time, at las vegas sphere
Pablo Corona Fraga retweeted
Getting ready for watching @Metallica for the 30th time at the Sphere Las Vegas!!
Pablo Corona Fraga retweeted
Finding bugs is the easy part. Shipping fixes that hold up is harder.
We analyzed thousands of Codex sessions from our work on Patch the Planet with @OpenAI and built patching-bugs, a plugin that writes a fix, proves it, and checks it for regressions.
To prove a fix, the plugin checks that the original code fails, the patch passes, and reverting the patch brings the bug back.
patching-bugs hands each fix to regression-hunt, our second new plugin. We ran it on the patches behind 21 known regressions, and it reported 25% fewer false positives than a baseline Codex agent.
Both plugins work best when your repo has a THREAT_MODEL.md and a PATCHING_GUIDELINES.md. blog.trailofbits.com/2026/10…
Pablo Corona Fraga retweeted
LLMs...Letting me do fun things I never would have wasted time on.
"I reviewed all 30 public GitHub repos for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) by reading code only. The slide has the full
grouped table; the headline findings:
Nothing works against a real target. Every genuine memory-corruption chain is lab-bound: it needs exact per-build offsets, display_errors=On, a single prefork mod_php worker, and a specific image.
Independent reviewers (allureluoli, dinosn, Gi1gamesh123) and the leaked primary source itself all converge on "no public artifact achieves code execution" on the patched core bug. Every real shell
in these repos comes from an app-side LFI or deserialization sink, not the CVE.
Three are original and real, all lab-only. 9bie (the source of the Set-Cookie leak chain), Marven11 (the most sophisticated, a true in-band leak), and Karasawa2025 (whose "Fermat" troll description
hides a working ROP + display_errors=off exploit). These are the only ones with a genuine ASLR-defeating leak primitive that is their own.
Most are copies. One original (9bie) spawned five derivatives:
- twili8 is an outright uncredited rip-off: its own README still says git clone 9bie/... and the Docker files are byte-identical.
- godylockz and xuehuolll are byte-identical to each other.
- dinosn and 3em0 are credited ports that add value.
Three are mislabeled. iQingshan, KarimUD7 (≈98% the same code), and Gi1gamesh123 exploit a different bug entirely (the Calif unserialize var_hash UAF) against their own planted endpoints, filed
under the php2shell CVE numbers.
The rest is noise. The most-starred repo (ikow, 905★) delivers the least: broken or stubbed chains with the two "real" ones paywalled behind Substack. eness (558★) is a leakless forge that can't
defeat ASLR. syrex1013 ships AI-generated fake CVEs in a side directory. Whackermelon hallucinates a non-existent openai/php2shell-checker. lcfr-eth is a parody with a memecoin address, and Icex0
is an empty repo. The genuinely honest work is the crash labs (allureluoli, slabbdev, 0x4148), which prove the bug without claiming RCE.
The ASLR column, star counts, copy lineage, and the specific "tell" for each repo are all in the table. The page is private to your account; use the Share menu if you want to send it to the team"
Pablo Corona Fraga retweeted
"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."
thephp.foundation/blog/2026/…
Pablo Corona Fraga retweeted
URGENTE: Si manejan algún sitio en PHP, actualícenlo a la última versión de su rama. Se viene el apocalipsis de PHP: php.net/archive/2026.php#202… #PHP
Pablo Corona Fraga retweeted
🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.
Pablo Corona Fraga retweeted
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:
php.net/index.php#2026-10-20…
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow
The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.
PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
Pablo Corona Fraga retweeted
En 2026 se han generado casi el 40% de todos los CVE del Kernel de Linux desde 1997. Tras la IA, ¿qué provoca más CVEs del kernel?
Según Greg Kroah-Hartman, mantenedor del núcleo y voz relevante en la seguridad, una línea es responsable de la mitad de los CVE desde 2024. Hilo¬
Pablo Corona Fraga retweeted
VirusTotal is now available in ChatGPT
Scan files, URLs, and domains for potential threats, right from your chat
chatgpt.com/plugins/plugin_a…
Pablo Corona Fraga retweeted
🔴🔐 ¡Sigue EN VIVO el último día de #AMCS2026!
🔗 youtube.com/live/OUipfcrybl0…
🤖 Inteligencia artificial
⚛️ Criptografía poscuántica
🛡️ Ciberseguridad
🏆 Premio Nacional de Ciberseguridad 2026
💻 Conéctate vía YouTube y acompáñanos.
#MéxicoCiberseguro
Pablo Corona Fraga retweeted
🚀🎓 ¿Cómo fortalecemos el talento que necesita el ecosistema de ciberseguridad?
🎙️ Pablo Corona Fraga (@@pcoronaf) presenta su Conferencia Magistral: Presentación de la Plataforma Talento Ciberseguro
🕦 11:50 h | 💻 Virtual
🌐 Agenda #AMCS2026:
mexicociberseguro.org.mx/ite…
Pablo Corona Fraga retweeted
Leaving aside Anthropic's incentives for publishing this research, there is no doubt that open weights models will soon create the same security threats that closed source models have been demonstrating, except without guardrails. We are close. Probably good to plan accordingly.
Pablo Corona Fraga retweeted
We edited Mark Twain's Huckleberry Finn and fed it to 9 AI models to summarize a chapter, twice each. Only Claude Fable 5 followed the edited text both times; GPT-5.5 followed it once ↓
Pablo Corona Fraga retweeted
AI can already recall more than any physician alive.
which means the entire value of a medical
education just shifted from knowing to judging.
we haven't caught up to that yet.
Pablo Corona Fraga retweeted
I'm building an agentic video editor that does it all, creating animations, demonstrations, motion graphics on its own after you provide it a brief of what the video should be about
Pablo Corona Fraga retweeted
In Ovid's Metamorphoses, Pygmalion sculpts a woman from ivory, then prays to Aphrodite to give it life. In Homer's Iliad, Achilles fights with Scamander, a powerful god who takes the form of a river as if it were a person. In the Egyptian Pyramid Texts, we read of the ceremony of the opening of the mouth, a ritual that reanimates corpses or statues so as to embed them with a soul's life force. In Jewish folklore, there is the Golem, clay animated by inscribing it with the Tetragrammaton, the unpronounceable name of God. In Hinduism, the Vedic ritual of Pran Pratishta places the life force in an other wise inanimate object. Among the Pueblo people, native to the southwestern United States, an individual house and the village itself are seen as sentient entities through which the breath of the cosmos flows.
In our time, we see some who project consciousness and perhaps even sentience into AI, artifacts that are formed from artificial neural networks which themselves are abstractions that execute on symbolic von Neumann machines that in turn run on cunningly designed fragments of silicon flecked with certain rare earth minerals and etched with intricate patterns that channel lightening.
In each of these cases, we humans - undeniably sentience creatures of exquisite complexity and capable of curiosity and wonder and love and hate - project sentience on to a multitude of distinctly non-sentient artifacts.
The fact we have done this throughout our history and in our mythology and religion and even our casual daily lives tells us much about ourselves.
Each of us seeks to know and be known, see and be seen, and so I suspect that much of why we do this is because we desire a connection. To quote a line from Sagan's Contact, "You're an interesting species. An interesting mix. You're capable of such beautiful dreams, and such horrible nightmares. You feel so lost, so cut off, so alone, only you're not. See, in all our searching, the only thing we've found that makes the emptiness bearable, is each other."