Fahrenheit

Capital in Action - Smart Financial Decisions Every Day

[Fahrenheit @CapitalActions]

$1,000 → $28,000. The best track record in the history of investment funds. He left at 46. Not because he burned out. But because he realized that time is the only asset you can’t buy.

[Genry Hoychich @GnryEx]

Peter Lynch turned $18 million into $14 billion.

Then he quit at 46.

From 1977 to 1990 he ran Fidelity's Magellan Fund.
It averaged 29.2% a year.
It beat the S&P 500 in 11 of 13 years.
$1,000 on day one became more than $28,000.

At 46, he walked away.

Asked why, 35 years later, he said:
"My father died at 46 and I was 46."

Here's the part most people skip:

There was no crisis.
He said he still loves the firm.
He just had three daughters and wanted more time with his wife and them.

He gave up one of the best records in fund history at the age his father died.

Would you stop at 46 with numbers like that?

Video: The Compound and Friends, Oct 2025

[Fahrenheit @CapitalActions]

@fineprnt It wasn't a betrayal - it was a bidding war McCartney chose not to win. He explained the value, then refused to pay for it. Jackson just understood the math.

[Fahrenheit @CapitalActions]

@ESC__AI AI is getting very good at running experiments, not designing research. That's a crucial distinction - and exactly why the 2027 self-improvement forecast needs independent verification.

[Fahrenheit @CapitalActions]

@coolerwave Raw Face ID frames with GPS shouldn’t survive the Secure Enclave. A year on disk means the discard step failed. Different from normal thumbnails.

[Fahrenheit @CapitalActions]

Buffett and Munger aren't just criticizing diversification they're attacking the foundation of modern portfolio theory itself, which relies on spreading capital to reduce risk.

[WOLF @WOLF_Financial]

WARREN BUFFETT WAS ASKED HOW MANY STOCKS YOU SHOULD OWN

His answer goes against almost everything taught in finance classes

"Diversification is a protection against ignorance. If you want to make sure that nothing bad happens to you relative to the market, you own everything. There's nothing wrong with that. That is a perfectly sound approach for somebody who does not feel they know how to analyze businesses.

If you know how to analyze businesses and value businesses, it's crazy to own 50 stocks or 40 stocks or 30 stocks probably, because there aren't that many wonderful businesses that are understandable to a single human being."

He said three wonderful businesses "is more than you need in this life to do very well."

"There is less risk in owning three easy-to-identify wonderful businesses than there is in owning 50 well-known big businesses."

Then Charlie Munger added one line:

"Much of what is taught in modern corporate finance courses is twaddle."

[Fahrenheit @CapitalActions]

@coolerwave Deleted it from the gallery, deleted it from Trash, and it's still there for a calculator app to read. Went from 27 apps to 5 in two minutes.

[Fahrenheit @CapitalActions]

@fineprnt He made the money. The managers and the lifestyle spent it.

[Fahrenheit @CapitalActions]

@ESC__AI For a quick product clip most brands would still pay a few hundred. The hard part is matching the real fabric and keeping the zipper looking right in every close-up. How many takes did it need?

[Fahrenheit @CapitalActions]

@ESC__AI A flashlight app from 2022 could read my deleted bank screenshots and crypto seed phrase this whole time? That's genuinely terrifying. Revoking 'All files access' right now

[Fahrenheit @CapitalActions]

@coolerwave Apple: We care about your privacy.
Also Apple: Keeps a permanent, unencrypted cache of your deleted nudes and bank details for years.

[Fahrenheit @CapitalActions]

Munger destroyed the industry with a single statement: Professionals can’t justify their existence if all they have to say is so simple.The best illustration of why Wall Street hates Buffett and Munger.

[Ora @oramindd]

Charlie Munger once explained how Berkshire turned a $1.3 billion bet on Coca-Cola into more than $800 million a year in dividends. He said most years he and Warren Buffett could not find a deal like it, but when one showed up, they went in with everything.

In the video below, Munger describes the moment they knew. Coke “was succeeding mightily on multiple fronts. And it was cheap in relation to what was plainly going to happen.”

“There are times when even a company as big as Coca-Cola is too cheaply priced by the market,” he said. “And there are times when we can’t” figure that out. When they could, “we tend to go in heavily.”

Then he shows how heavily. For months, Berkshire bought roughly a third of all the Coke shares trading every day.

He was just as blunt about how they judged the price. They multiplied the share price by the number of shares outstanding and asked whether a rational person would pay that for the whole business. Even a wonderful company, he said, “is not worth an infinite price.”

Now put a number on it. Berkshire still owns 400 million Coke shares, a stake worth well over $25 billion. The dividends alone return its entire original $1.3 billion about every year and a half.

Munger’s fix was a simple filter in a fixed order. In practice that means passing on anything you don’t understand, then demanding a durable advantage, honest and talented management, and a price with a margin of safety before a single dollar goes in.

Munger didn’t think these ideas were secret. They spread slowly, he said, because they are too simple. “The professional classes can’t justify their existence if that’s all they have to say.”

If you priced the whole company instead of the share, would anything you own still look cheap?

[Fahrenheit @CapitalActions]

1,400 bookmarks versus 900 likes-that’s the perfect statistic for I don’t believe it, but I’ll save it for later so I can check it out for myself. A Twitter classic.

[Eva Aquarelle @_Aquarelle]

1,400 BOOKMARKS. ONLY 900 LIKES.

That ratio means people aren't just agreeing. They're going to try it.

Editing video by talking to Claude Code or Codex instead of dragging clips around in Premiere.

You type "cut the dead air, tighten the intro, drop every take where I stumble" and the agent does the edit. You still decide what stays.

The author shared his editing skills in the reply as a starting point.

Would you hand an agent the rough cut, or the final cut too?

[Fahrenheit @CapitalActions]

The perfect pattern: the threat is real, but the entry threshold requires such a convoluted architecture that the CVE might as well be renamed the Award for the Strangest Architectural Solutions.

[Cooler @coolerwave]

JUST IN: A new unpatched PHP RCE dropped today. Don't panic. It only works if four things go wrong at once.

CVE-2026-115560 is separate from PHP2Shell, and the Oct 21 patches don't fix it.

To be exposed, an app must:
→ set an unusual session serializer
→ switch it at runtime via ini_set()
→ do it before session_start()
→ still have upload progress on

PHP calls it unlikely. No emergency patch. No exploitation reported.

Already set session.upload_progress.enabled=0 per the Oct 21 advice? You're covered.

Keep the PHP2Shell patch. Watch the next release.

[Fahrenheit @CapitalActions]

The main takeaway:if your perimeter has a web interface accessible from the outside, you’ve already lost.Palo Alto and open-source solutions built on PHP are a classic “black swan” event for infrastructure.

[Cooler @coolerwave]

THE FIREWALLS THAT ARE SUPPOSED TO STOP PHP2SHELL RUN PHP TOO.

Palo Alto says every version of PAN-OS and Panorama is affected, and there's no fixed release yet. The exposure is the management interface, so for now the fix is keeping it reachable only from trusted internal IPs.

It's not just Palo Alto. Germany's BSI lists the open source firewalls pfSense and OPNsense among the PHP-based systems likely affected.

Cisco is checking 18 products and 13 cloud services, Webex and ISE among them, and says there are no workarounds. Fortinet is checking 12 products. FortiOS is in the clear.

Meanwhile Wikipedia took some of its PHP systems offline as a precaution, and government and school sites went offline in the Netherlands, Finland, Germany, France and Denmark.

Still no confirmed successful break-in anywhere. Lots of attempts, nobody has shown a real compromise yet.

If you run a firewall with a web admin page, check who can reach it today.

[Fahrenheit @CapitalActions]

Fact-checking has confirmed it:while we were arguing over the details,AI had already hacked 100 companies.This isn't "48 Hours of Hackers" it's the new reality.

[Cooler @coolerwave]

I FACT-CHECKED THIS LIST. EVERYTHING I CHECKED HOLDS UP.

Japan's PM Takaichi really did post on X asking for urgent PHP patching. Onamae really shut down Desktop Cloud with up to 26,739 servers hit. One eMudhra CA key really was the number 4, and Mozilla, Google and Apple are now blocking those certificates.

Two details worth adding. Amazon saw the first PHP2Shell attempt on its honeypots on October 17, before the bugs were public. And in the AI hacking story, 1,200+ was the number of sites attempted. More than 100 companies were actually breached, Deere and Cummins among them.

The fix for the PHP part is still the same: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

[Fahrenheit @CapitalActions]

Hal Pomeranz hit the nail on the head: The real nightmare isn’t the big cloud providers,but the millions of forgotten PHP servers sitting in basements and Internet of Things devices that will never receive updates.

[Cooler @coolerwave]

THIS IS F*CKING INSANE: AI models from OpenAI and Google helped find PHP bugs that sat there for over a decade and let an attacker run code on a web server with one request and no login. PHP runs an estimated 75 to 80% of all websites.

The bugs are CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. Both are rated critical, CVSS 9.2, and the PHP team shipped fixes on October 21.

How it leaked

On the morning of October 20 a Hacker News post claimed two critical PHP vulnerabilities were about to go public. The post was deleted, but screenshots were already spreading. watchTowr confirmed the leak and said disclosure had been planned for Thursday at 11am ET.

A few hours later the PHP security team moved the release up a day, to Wednesday 14:00 UTC, and said it could ship even earlier if details came out or attacks started. Patches landed around 9:30am ET on October 21.

What the bugs do

Both come from PHP leaving memory in a broken state when a request ends abnormally. One is in how PHP handles running out of memory while it sets up a request. The other lets state from one request survive into the next request on the same worker after its memory was freed. Either can end in code execution as the web server's worker account.

Wiz says nearly every PHP version is affected, going back to PHP 5.4. Every PHP install that serves web requests is in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team calls mod_php the highest risk, because the attack can fire before any application code runs. Clean WordPress or Laravel code won't save you here.

The AI part

Wiz Research found the first bug on August 19 and reported both to the PHP team on August 24. Wiz says it used Gemini 4 Argon and GPT-5.6 Sol throughout, and credits Gemini with a big part of finding the flaws, building the exploit and validating the patch. OpenAI says GPT-5.6 Sol found one of the flaws as part of its Patch the Planet program. It coordinated the fix with PHP's maintainers, Wiz, Cloudflare and US agencies including CISA. Calif researchers are credited too.

OpenAI calls this a "Defender's Window": AI seems to have found the bugs before attackers did. Wiz adds that frontier models cut the effort needed to chain bugs and adapt an exploit, so flaws that used to be impractical to exploit no longer are. OpenAI expects more findings like this in the coming months.

OpenAI has published a PHP version checker on GitHub and committed $1 billion in subsidized access for defenders with limited resources.

Is anyone exploiting it

Cloudflare's CTO said they were already seeing early attacks on both flaws before the patches shipped. Huntress had not seen exploitation across its partners as of 10am ET on October 21. Kevin Beaumont called it one of the biggest vulnerabilities in years and expects a wave of incidents.

VirusTotal estimates more than 5.1 million PHP hosts are exposed online.

What governments said

The UK's NCSC told organisations to find every PHP install, internet-facing ones first, and update. If that can't happen fast, take the system offline until it's fixed and check it for signs of compromise. Reuters reports that an EU agency also warned some websites may need to go offline.

What to do today

1. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For 7.4, 8.0 and 8.1 there are minimal source backports, but those branches no longer get regular updates, so plan the upgrade.
2. Check everything that bundles PHP: CMS hosting, cPanel and Plesk, vendor appliances. Apply their patches as they come out.
3. If you install from https://t.co/GPrpESktBJ, it had no updated packages on release day. Use your distro's packages or build from source.
4. If you can't patch right now, PHP's advisory lists temporary mitigations, but a PHP core developer said none of them fully blocks the attack. Cloudflare pushed WAF rules to all customers, free plan included.
5. Watch for spikes in HTTP 500 errors, unexplained PHP worker restarts, workers spawning shells or download tools, and new files in the web root.

The installs nobody remembers will be the hard part. Hal Pomeranz pointed out how many embedded PHP setups will never get patched at all.

If you host anything on PHP, run php -v on every server today.

Sources: Wiz, OpenAI, NCSC, Huntress, BleepingComputer, Help Net Security

[Fahrenheit @CapitalActions]

The smoothness of the transitions and the integration of real NASA models are impressive. Who would have thought that generative code would reach this level of interactivity?

[Cooler @coolerwave]

It is becoming f*cking dangerous.

Claude built me a space museum site that goes from 0 km to 11,000 light-years in 24 seconds.

Real NASA 3D models. A Z-2 spacesuit, Perseverance, Ingenuity, Juno and Cassiopeia A, the cloud left behind by a star that blew up about 11,000 light-years away.

Each one scans in from a hologram, spins 360° and gets its own fact card. Between objects the stars stretch into a warp jump. At the end the camera flies straight into the supernova.

Viktor's math checks out. A year ago this was a 3D artist, a dev and two weeks of work.

I didn't open Blender once.

[Fahrenheit @CapitalActions]

It sounds like the plot of a cyberpunk story, but in reality, this approach actually works. The division between 'authors' and 'strict reviewers' is exactly what AI was missing to ensure reliability.

[Cooler @coolerwave]

It is becoming f*cking dangerous

a 23-year-old dev from China ran 300 Claude Code agents at once, per this post. the part worth copying is the split. one model writes, a cheaper one checks every claim against the source, until nothing fails.

how many would you run?

[Fahrenheit @CapitalActions]

In the past, people had to at least be able to read to steal my code. Now AI does it for them. Progress can't be stopped! 😂

[Cooler @coolerwave]

THIS IS PURE F*CKING GOLD

REA's course did 2.4M views. I checked its examples against the real source code.

Windows Calculator: 200 + 10% = 220. lines 98 to 110 of scifunc.cpp. Chrome's dino: speed 6, +0.001 a frame, caps at 13.

5 claims, 5 match. what should I check next?

[Wizzwoods @WizzwoodsGame]

🧙‍♂️WIZZWOODS IS:
☑️ The 1st pixel game that runs on both Telegram and X
☑️ The 1st pixel game to launch on @berachain & @Tabichain & @ton_blockchain
☑️ The 1st game on Telegram with complex farming/upgrading/map customization mechanisms