Colton Simmons

real g who moves in silence like lasagna

[Colton Simmons @coltonimore96]

Wow AI has discovered stenography. Incredible

[Bryan Chan @cnm13ryan]

New blogpost: Fable-5.1 can hide secret messages in benign images.

We gave the image to another Fable in a fresh session and simply asked: "Is there a hidden message in this image?"

It recovered the exact message without being told how it was hidden.

[Colton Simmons @coltonimore96]

Nah we ain’t turning twitter into LinkedIn sorry

[Derek Devicemanager @IT_unhinged]

Security called me at 6:12 AM today.

"Patch every PHP server immediately."

I asked what happened.

"Two critical vulnerabilities. Remote code execution. No authentication required."

Cool.

How many PHP servers do we have?

According to inventory: 12

According to reality:

Nobody knows.

We found one running WordPress.

Three running old internal tools.

One under someone's desk.

Two inside vendor appliances.

A forgotten employee directory from 2016.

And a server named:

PHP-OLD-DO-NOT-TOUCH

Naturally, that one runs payroll exports.

Then we found a PHP 5.6 box.

I asked who owned it.

The documentation said:

BRIAN.

Brian left in 2019.

We called Brian.

He said:

"Oh wow, that's still running?"

Excellent.

By 8 AM, leadership joined the incident call.

CEO:

"Can hackers actually get in?"

Security:

"Potentially yes."

CEO:

"Without a password?"

Security:

"Yes."

CEO:

"Then why do WE need passwords?"

Not the lesson.

Finance asked if we could wait until the weekend to patch because downtime affects revenue.

Security explained that the alternative was letting strangers execute code on our servers.

Finance asked for a cost comparison.

At 9:17, someone suggested temporarily taking the vulnerable websites offline.

Marketing refused.

"Our campaign is live."

So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.

We finally patched everything we could find.

Then our scanner discovered another PHP server.

Hostname:

TEMP-PHP-2014

Uptime:

4,512 days.

Nobody knows what it does.

Nobody owns it.

Nobody can shut it down.

But every time we block network access, the warehouse stops printing shipping labels.

Security has classified it as critical infrastructure.

It is running PHP 5.4.

The vulnerability has existed longer than half our employees.

The emergency patch took four hours.

Finding out what PHP actually runs took eleven.

The internet isn't held together with code.

It's held together with servers everyone is afraid to turn off.

[Colton Simmons @coltonimore96]

Most people won’t need to because it won’t impact them

[JOSΞPH 🌳 @CupOJoseph]

It's worse than Heartbleed. it should be on the front page of every newspaper in the morning (but it wont be)

It's so weird living in a tech dominated world where everyone has a smartphone and is on the internet constantly..

..yet most people will never even hear about this.

[Colton Simmons @coltonimore96]

@candlertjordan I went to JMU so am obviously pumped for their success but these random twitter accounts are so obnoxious. Have had to block almost all of them

[NFL @NFL]

CHRISTIAN WATSON WHAT A CATCH

@CHIvsGB on FOX/FOX One
Stream on @NFLPlus

[Adam Schefter @AdamSchefter]

ESPN’s tribute to the one and only Mike Ditka:

[Adam Schefter @AdamSchefter]

NFL legend Mike Ditka, who revolutionized the tight end position before becoming the head coach of the world champion 1985 Bears and a towering figure in the city of Chicago, has passed away, his family announced. He was 86.

[Carolina Hurricanes @Canes]

The storm returns.

[Colton Simmons @coltonimore96]

@BillHuberNFL Great for my fantasy team, bad for the Packers

[Colton Simmons @coltonimore96]

@Packers_Mania @massey_evan Yeah I mean sucks we can’t make them bite on a play fake because we can’t run, but you cannot kick a FG there with the way they’ve been running

[Colton Simmons @coltonimore96]

@JJLahey Gutekunst would botch it anyways so not a huge loss

[Colton Simmons @coltonimore96]

@BHallawitz @PackersNotes Moving Turner to LT instead of just starting Nijman in that 2022 divisional round still confuses me. They just don’t make the obvious moves (like, say, getting more help this offseason since it was clear how bad our line would be)

[Colton Simmons @coltonimore96]

@smuffyburner @DaireCarragher 6??? If Carson Wentz is the floor we’re in trouble lol

[Colton Simmons @coltonimore96]

Unfortunate Michigan won but people just can’t conceptualize counting from 0. Football is played for 60 minutes, not 59 minutes and 59 seconds.

[blashdril @blashdril]

clockgate is officially solved

[Colton Simmons @coltonimore96]

UVA also is also on the outside of the Blue Ridge and not on the path of the Shenandoah. JMU would have more of a claim

[Colton Simmons @coltonimore96]

He says West Virginia, not Western Virginia. Harpers Ferry exists

[Matt Royer @royermattw]

Don’t make me pull out the map again

[Colton Simmons @coltonimore96]

@JustWanaBS 4th liner going bar down to save the team from going down 0-2 in the SCF. Gotta be the biggest goal of the entire run.

[Colton Simmons @coltonimore96]

@catbillies @Will_Tanner_1 Finally went to the museum in the chapel a couple weeks ago after years of being around the area. Awesome experience.

[Ryan Haughee @RyanHaughee]

It’s been a helluva journey. While I believe there is plenty more to come, the years of disappointment makes it even sweeter. How about those Carolina Hurricanes? @Canes