Andrew "Andy" Manoske

Building Security + Enterprise Products @CoreWeave. Built Security Products @HashiCorp, Crypto and Defense Products @NetApp. 🖤: Kendo, trance music, Warhammer

[Andrew "Andy" Manoske @a2d2]

The traffic sucks. Everything's expensive. But living in a place where convos abt physics, CS, and math are the daily norm rules.

[Andrew "Andy" Manoske @a2d2]

Black October is showing that building AI defense factories is a national security imperative

[Andrew "Andy" Manoske @a2d2]

Tracking with everything here.

Employing software factories - and likely dedicated defense factories for blue team tooling that collaborates with the former - is going to become essential to secure enterprise computing.

[Alan Wells @alanwells]

Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products.

Some thoughts:

- Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one.

- We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week.

- At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns.

- Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things.

- You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here).

- To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity.

- KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it.

- Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!

[Deok @deok_filho]

nice try

we spun up 10 THOUSAND sandboxes, @opencode running in each one pointing towards our serverless inference endpoint to get ASCII art

I'm feeling like an artist today 🪏

CoreWeave Scale

[Andrew "Andy" Manoske @a2d2]

The Eye of Sauron has fallen on Ruby. Multiple 9.0 (and even 10) CVSS vulnerabilities discovered today and luckily remediated.

Props to the community for patching so fast. Every major OSS project is probably on a hair trigger to respond right now.

https://t.co/6Zmj6u2UPc

[Andrew "Andy" Manoske @a2d2]

Well one of those crypto libraries now has problems.

The most popular DNS server in the world has a readily-exploitable RCE.

Not great.

https://t.co/JlcOtrjCm2

[Andrew "Andy" Manoske @a2d2]

4 mos ago I wrote a blog saying events like the last 48 hours in cyber were going to happen:

- We need to detect, respond, and degrade malicious agentic C2 infra

- We need to review common crypto libs ASAP. PHP2Shell on OpenSSH would be apocalyptic.

https://t.co/nKRKPqnTL9

[Andrew "Andy" Manoske @a2d2]

@sumeetvtweets 100%. And that vulnerability remains unpatched as of right now (at least I haven't seen it in Fedora).

Best believe there is an Abliterated LLM-powered agent creating an exploit for it and launching it at every server that pops up "Linux" on its sandbox's recon-ng probe.

[Phoronix @phoronix]

Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

As high as CVSS 9.0. Whoops.

https://t.co/opCRSE80Vq

[Andrew "Andy" Manoske @a2d2]

Example: Microsoft discovering of STORM-0940, a major Threat Actor leveraging agent swarms for the ConnectWise attacks.

Getting IoCs for their C2 is critical. But human IR is too slow for this adversary. When do we get proactive? What does that mean?

https://t.co/IEm1vl5iLS

[Andrew "Andy" Manoske @a2d2]

4 mos ago I wrote a blog saying events like the last 48 hours in cyber were going to happen:

- We need to detect, respond, and degrade malicious agentic C2 infra

- We need to review common crypto libs ASAP. PHP2Shell on OpenSSH would be apocalyptic.

https://t.co/nKRKPqnTL9

[Andrew "Andy" Manoske @a2d2]

Hot take:

Explosive days in security like today are because AI is showing us that the night is darker and more full of terrors than we imagined.

If we don’t build widespread agentic defenses and remediation, it’s going to get very bad. Very fast.

[Andrew "Andy" Manoske @a2d2]

On degrade: NSA's instructions are unprecedented. Not surprised if CYBERCOM is going Search and Destroy for malicious agentic C2.

It will likely not be enough, and we need to ask uncomfortable questions about how the private sector gets involved.

https://t.co/B6STpPglPn

[Andrew "Andy" Manoske @a2d2]

Hot take:

Explosive days in security like today are because AI is showing us that the night is darker and more full of terrors than we imagined.

If we don’t build widespread agentic defenses and remediation, it’s going to get very bad. Very fast.

[Tony Ma @t1o6n3y]

🚨 Security vulnerabilities reported in a SINGLE day:

PHP — 2 CVEs
Node.js — 10 CVEs
NGINX — 5 CVEs
Go — 1 CVE
GitLab — 12 CVEs
eMudhra — CA certificate compromise

[Andrew Curran @AndrewCurran_]

Regarding potential attacks on energy, food, and water infrastructure, the threat is quite real. Someone is currently probing infra and feeling it out, it is an active threat. Even a little preparation can be helpful, just in case. This comes from the joint cybersecurity advisory released by the NSA and partner agencies on August 19:

'The threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using Al-generated exploitation scripts disguised as legitimate monitoring tools. The actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected. The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. This is not a theoretical risk - it is an active threat. Depending on the specific circumstances, exploitation of poorly protected PLCS could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems.'

'Using Al to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools. In addition, Al enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures. Threat actors can easily collect public information about vulnerabilities and weaknesses, find exposed and exploitable PLCs, and use Al-generated scripts to act on that information. If PLCs are exposed to the Internet, they are at high risk for exploitation.

Threat actors are leveraging open source industrial automation libraries - specifically snap7.d11/python-snap7 - combined with Al-assisted scripting to create custom tools that mimic legitimate OT monitoring solutions. These tools provide read/write access to Siemens S7 Series PLC memory, configuration data, and ladder logic programs via the S7comm protocol.'

[Andrew "Andy" Manoske @a2d2]

One word: agents.

[Matthew Prince 🌥 @eastdakota]

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

[OpenAI @OpenAI]

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.

Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.

Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.

This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
https://t.co/TW3jrSbB3f

[Anzal Abidi @AnzalAbidi]

Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.

Here is the short version of what happened and who got hit.

1. eMudhra (Trusted CA compromise)

eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.

One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.

Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.

• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl https://t.co/vhiGLxNhIS
(TLS error = safe. 200 OK = still vulnerable.)

2. PingCAP / TiDB Cloud (10.6 TB breach)

Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.

Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.

Who is affected in the leaked records:

• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)

• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: https://t.co/C512KFOEq5, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase

• Developer profiles leaked (from a purchased https://t.co/28tjHqd5Wr table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.

If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.

3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)

Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.

Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).

Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.

[CoreWeave @CoreWeave]

Bringing production-scale AI inference to life takes a strong open ecosystem. As a founding member of the project to now releasing llm-d 1.0, we're thrilled to support this community and fuel the future of open innovation 💪

[Andrew "Andy" Manoske @a2d2]

@matt_slotnick Thank you again for your interest!

- Horus Lupercal
Hiring Manager for Chaos Undivided

[Matthew Green @matthew_d_green]

Everything comes down to human bottlenecks right now, or will come down to them in the next 12 months. And the defender bottlenecks are awful. There’s going to be a lot of pain before that changes.

[Andrew "Andy" Manoske @a2d2]

The Agentic Adversary is out and absolutely stunting on traditional infrastructure.

We need better agentic defenses. Yesterday.

[Choblin @choblin29]

HOLY WTF. Reuters is reporting that a Chinese-speaking hacker used AI agents to compromise websites belonging to more than 100 companies, including Deere, SharkNinja and Cummins, after attempting intrusions against over 1,200 sites.

The estimated cost: roughly $5,000 in AI tokens, or $50 per successful breach. Successful intrusions took around 23 hours on average.

The attackers used the open-source Cairn agent framework, apparently combining DeepSeek models with a Claude Code harness. One campaign gave its agents instructions in fewer than 100 Chinese characters.

NorForge researcher Snorre Fagerland: 'It's a new world now.'