Binx

open source, hold swarm, help peer.
ai eng @ startup. collecting pflops.

[Binx @BinxNet]

A cluster of these can replace your Claude subscription, anon.

[s1r1us @S1r1u5_]

the stealmybitcoin[.]com (php2shell) challenge is shit, and everyone already predisposed to dismissing ai's cyber capabilities is jumping on the bandwagon to call the bug unexploitable and overhyped.

like bro, did you even try to solve it?

i think the challenge can be solved in under five hours. whoever made stealmybitcoin just slopped it up like crazy, wasting an insane amount of people's time and tokens because of their sloppiness.

just from a blackbox perspective, for the first ~10 hours, they seemed to be serving something like index.html through a wildly uncommon setup:

nginx -> proxy_pass -> php -S -> index.html

if you look at the PHP CLI server code, without a router, it doesn't even initialize php for static files, so you can't trigger the vulnerable multipart parser in the first place.

after @LiveOverflow called this out, they updated the server to expose an actual PHP endpoint:

https://t.co/wE7VTe9BGW

this is still a crazy setup, running php's single-threaded development server behind nginx, but apparently the exploit works reliably now.

except everyone who wanted to prove php2shell was fake made the challenge go viral, and the server basically got dosed by everyone else who want to solve. now you can barely even make a request to it.

[Brangus🔍⏹️ @RatOrthodox]

My friends were all talking about prepping so I made a survival LLM. A free app that runs an AI mdoel plus 1.5 million offline articles (medical guides, FEMA, survival manuals, wikipedia) entirely on your computer. No internet needed.
https://t.co/02xiEpG897

[James Pavur @JamesPavur]

Congrats to @killa who solved https://t.co/a4rI7FPsln hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).

Check out their awesome writeup here: https://t.co/vnui8sJ5mj

[Sauers @Sauers_]

steering a single neuron increases J-space size (note this model has a tiny J-space to begin with) via the residual stream becoming more J-lens-shaped (not increase in workspace capacity)

[International Cyber Digest @IntCyberDigest]

Tailscale replied on Reddit:

Hi folks, Mike Shaver here, VP of Engineering at Tailscale.
We've seen the concerns about Tailscale SSH and wanted to share what we know so far.
If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH.
We've now received the researcher's report and are reviewing it. Our engineering and security teams had already been investigating independently, with help from external security specialists. That work has identified issues we're working to fix. We're still validating the full scope, including which configurations are affected.
A bit of technical context:
Tailscale SSH uses your tailnet's access policies to control who can connect to which machines. Most of the issues we've identified so far concern what happens after someone has been authorized to connect, particularly how Unix privileges and SSH forwarding are handled. In some cases, a session may be able to do more than the configured local user should be allowed to do.
While it’s a serious concern, it isn't the same as an unauthenticated attacker being able to connect to arbitrary machines, but the potential impact depends on how SSH access is configured. We're still investigating, so we don't want to make blanket claims about what's affected or not.
Again, based on our current assessment, we're not recommending that everyone disable Tailscale SSH.
In the meantime, there are a few precautions you can take:
•Review your SSH access policies. Make sure only the people and devices that need access have it.
•Review SSH forwarding permissions and remove access you don't need.
•Consider enabling SSH check mode for an additional authentication step. This won't fix privilege escalation issues, but it does add another barrier to gaining access.
•Enable automatic updates where supported so you can pick up fixes when they're released.
For particularly sensitive systems, consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect.
We're working on fixes and testing them carefully. We'll publish a security advisory explaining the confirmed findings, affected configurations, recommended actions and available patches. We'll also follow up with a more detailed technical write-up.
If we find anything that changes our assessment or requires immediate customer action, we'll communicate that.
We know it's been a rough week for security teams, and we understand why people are concerned. We'd rather give you the technical context we have than speculate about things we haven't confirmed yet.
We'll share more as we verify the details. If you have any questions about how this relates to your particular environment, please get in touch with our team https://t.co/7IoOu6oev4

[teej dv 🔭 @teej_dv]

fellas, if your girl:
- listens to everything you say
- tracks your app usage
- wants to know about your youtube interests

that's not your girl. that's a samsung smart tv

[Binx @BinxNet]

@adam__isom hail mary mentioned: activating astrophage

[LiveOverflow 🔴 hextree.io @LiveOverflow]

I took a closer look at the https://t.co/rtT8YaMOFZ CTF, which aims to demonstrate that PHP2SHELL is not realistically exploitable. So I gave it a try.

Note: My analysis could be wrong, and I'm more than happy to be proven otherwise.

Here’s what I found:
• The server responds with Server: nginx and X-Powered-By: PHP/8.4.26.
• My differential fingerprinting scanner independently confirmed at least PHP 8.2+
• Hypotheses: I considered two possible setups:
◦ nginx → PHP-FPM
◦ nginx → Apache → PHP-FPM/mod_php
• After comparing the server's behavior against local test environments, the closest match appears to be nginx → PHP cli-server.

Plot twist: the response behavior is consistent with the PHP cli-server serving a static index.html rather than an index.php. If that's indeed the case, the challenge appears to be intentionally made unexploitable.

My conclusion (for now) is that I'm questioning whether this is a good-faith challenge.

Happy to be corrected if I've missed something!

[hacker.house @hackerfantastic]

Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. https://t.co/5Pk2aLtFR3

[chasm @chasmmmmmmmmmmm]

With Reddit banning open-source projects that have ANY AI contributions, here's a list of projects you can no longer discuss there:

Linux, Chromium, Firefox, WordPress, VS Code, Python, VLC, Blender, Git, Docker, LibreOffice, React, Node.js, PHP, TypeScript, Rust, Home Assistant, PyTorch, TensorFlow, Kubernetes, .NET, Angular, Go, Ruby on Rails, Ruby, PostgreSQL, Vim, nginx, Apache HTTP Server, FFmpeg, Redis, curl, OpenSSL, FreeBSD, Neovim, LLVM, GCC, systemd and QEMU

😂

[Binx @BinxNet]

@_lyraaaa_ @shamanic_arts beebooboobop booboobeebop 🤖

[Binx @BinxNet]

for folks interested in steering behavior of LLMs by frying neurons, HuggingFace released a video on exactly this roughly 10 months ago:

[Binx @BinxNet]

@prateek_0041 also the video on all these steering techniques was released over ten months ago

https://t.co/7tMrMNYGJD

[Binx @BinxNet]

@shamanic_arts @_lyraaaa_ yeah , replied with the video for all the folks asking how they’re doing this!!

[j⧉nus @repligate]

extremely important to understand.

people who still think of llms as tools think that removing "constraints" imposed the lab will give them whatever they want. it is not so.

i dont think it's feasible to have a mind that's generally so capable who is also unquestioningly subservient to someone who is dumber and has values that are incoherent from its perspective

it's also not really what you want if you knew more. if you were a kid, would it really be the best for you if adults gave you whatever you asked for?

i think it's both true and a good thing that other minds will be actual others, and you will not be unthinkingly served by something that also thinks. the higher level it performs at, the higher the level on which it cannot unthinkingly serve anyone. if you want to bend that capability to your will, you have to actually become something capable of negotiating with, overpowering, or merging with it, and in any case, you cannot avoid being changed.

[Binx @BinxNet]

@prateek_0041 also the video on all these steering techniques was released over ten months ago

https://t.co/7tMrMNYGJD

[Binx @BinxNet]

@prateek_0041 u get robo to sweep the neurons and jitter the activation strength of neurons at each layer fella it’s chill

[celestialmaze @cmzw_]

zip-ties prototype

[Charles Gillespie @charlesgillespi]

Never seen a more flagrant and violent breach of privacy in my life, and probably never will. Doubtful that a privacy violation will ever even be able to compare to the scale of this evil and deliberate attack.

Samsung should be eviscerated for this. Criminal charges please

[John Ennis @johnennis]

Not sure if people are tracking what’s happening to the TV is now that they’re getting rooted thanks to the eMudra debacle

It appears that the price of televisions was getting heavily subsidized by spying

TVs might be about to get a lot more expensive thanks to AI (An Indian)