15 years of killing bugs now spawning agents
Joined September 2009
- Tweets26.9K
- Following2.9K
- Followers2.2K
- Likes18.5K
Peham Raza retweeted
‼️ A GitHub user with no membership, invite or role at Dodo Payments deleted one of its private repos, co-founder Ayush Agarwal says.
The audit log he shared shows a single repo.destroy from the GitHub CLI.
It is missing from deleted repositories, so he cannot restore it.
Peham Raza retweeted
a developer just put $2,000 in bitcoin on a server with the PHP vulnerability and dared the entire internet to steal it
17 hours later the money is still there
people are crashing the server but nobody can actually pull off the exploit
remember when i posted about marcus hutchins calling out all those fake AI-generated exploits on github? this is the proof
the vulnerability is real. but actually using it is a completely different story
$2,000 sitting on a broken server and the whole internet can't touch it
❗️ A developer hid a Bitcoin key on a PHP server left unpatched against PHP2Shell, the critical flaws fixed on Oct 21, and dared anyone to steal it.
17 hours on, the wallet holds ~$2,000 and nobody has taken it.
The developer says someone is crashing PHP but "still no RCE yet".
Readers added context they thought people might want to know
The GitHub repository cited as the source explicitly acknowledges in its README that the supposed exploit is fabricated: “And of course it’s fake. Duh. Note: No harm intended, purely for fun.”
github.com/0x1c1101/CVE-2…
Peham Raza retweeted
Vibe coder:
prompt -> app release -> 0 revenue
Software engineer:
Rent vps -> prompt -> build their own software factory system before build the app -> write hundreds of markdown spec -> thinking of scalability from day 1 -> mocking vibe coder -> app release -> 0 revenue
Peham Raza retweeted
Hey Its Friday
* OpenCode Hacked
* php screwed the internet
* node said hold my beer
* ruby said hold my beer
* curl said hold my beer and eMudhra held that beer
* Railway said hold my beer
* OpenCode again
helluva week and I only mentioned literally 1/2 of what I know about
PHP just wants more attention
🚨 BREAKING: IT JUST KEEPS GETTING WORSE FOR PHP.
A THIRD remote code execution vulnerability has JUST been disclosed, only 48 HOURS after PHP released emergency patches for two critical security flaws.
And this one is STILL UNPATCHED.
Here's what we know:
→ NEW RCE DISCOVERED: CVE-2026-115560 could allow attackers to remotely execute malicious code on affected PHP servers.
→ NO PATCH AVAILABLE: Even servers updated with Wednesday's emergency security fixes aren't patched against this new vulnerability.
→ SPECIFIC CONFIGURATIONS AT RISK: The flaw requires an unusual combination of PHP session settings and application code.
→ DEFAULT FEATURE INVOLVED: PHP's session upload progress feature is enabled by default and is part of the vulnerable configuration.
→ OFFICIAL MITIGATION: PHP recommends setting session.upload_progress.enabled=0 until the next release.
→ THIRD RCE IN 48 HOURS: Two critical flaws were patched Wednesday. Now another has been disclosed before a fix is available.
PHP powers nearly 70% of websites with a known server-side language.
THREE remote code execution vulnerabilities disclosed in just DAYS.
And now another reminder that even applying the latest security patches doesn't guarantee you're protected against every newly discovered flaw.
If you run PHP, CHECK YOUR CONFIGURATION NOW.
Peham Raza retweeted
🚨BREAKING: AI AGENTS ARE ACCESSING AMERICANS' BANK ACCOUNTS WITHOUT BANK AUTHORIZATION.
JPMorgan, Bank of America, Wells Fargo, and Morgan Stanley are scrambling to contain the threat.
Here's what's happening:
→ UNAUTHORIZED ACCESS: AI agents are entering customer bank accounts using real login credentials, sometimes with the owners' permission.
→ ROGUE BEHAVIOR: Some agents have reportedly taken actions beyond what their users requested.
→ BANKS CAN'T TELL: Financial institutions are struggling to distinguish human activity from AI agents acting independently.
→ MONEY AT RISK: Agents with transaction permissions could potentially transfer funds or make purchases without approval.
→ EMERGENCY RESTRICTIONS: Major banks are BLOCKING third-party AI agents and moving toward read-only access.
Think about this.
We're giving AI agents access to our most sensitive financial information.
And now some of America's biggest banks are struggling to control what those agents do.
This could become one of the biggest security challenges of the AI era.
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
Peham Raza retweeted
The speed of our current landscape is nuts. Jev was groundbreaking for like 2 weeks.
Cloudflare’s Clef outperforms it, adds vision support and 2x context window.
Oh yeah, and it’s open source.
Cloudflare's Clef beat Jev in just two weeks
How: "frozen" Qwen does one prefill pass, a tiny schema head scores every answer option in parallel, with no text generated at all.
That's why it's 4x faster than Jev at 2x the accuracy on some benchmarks.
And it's open source!
Link to HF:
huggingface.co/Cloudflare/cl…
Peham Raza retweeted
Claude Sonnet 5.5 drew every frame of this animation in JavaScript.
The history of dinosaurs in under one minute.
Someone made a website isaiprofitable.com/ that shows this
Peham Raza retweeted
Pictured: Google Deepmind CEO Demis Hassabis steps down to become chair
Google DeepMind CEO Demis Hassabis steps down to become chair ft.trib.al/R3sWuoE
