Gurveer

I'm building @aurorallm — the cheapest way to call every LLM.
Open-source. Auto-routes to the cheapest capable model. Cut your bill.

[Gurveer @gurvrx]

@sufyanbuild Let's connect

[Gurveer @gurvrx]

@Shraddhaship Let's

[Gurveer @gurvrx]

@NushCore Kounsa app

[Gurveer @gurvrx]

DeepSeek v4.1 flash High vs mimimax m3.1 flash High

[Gurveer @gurvrx]

@d117z https://t.co/0jm2wyt7ad

[Gurveer @gurvrx]

@lcfr_hax https://t.co/0jm2wyt7ad

[Gurveer @gurvrx]

@TheHackersNews https://t.co/0jm2wyt7ad

[Gurveer @gurvrx]

💀 working exploit

https://t.co/0jm2wyt7ad

[Gurveer @gurvrx]

Critical Vulnerabilities PHP CVE-2026-109618 / CVE-2026-109619, fixed in 8.4.27.

Four services, one command:
- 8.4.26 target
- 8.4.27 control
- chain A: session injection + LFI
- chain C: handler mismatch

15 Suricata, 5 Sigma, 7 ModSecurity, OpenResty. Replay-tested on pcaps.

[Gurveer @gurvrx]

@bcs_erictaylor Here we go: https://t.co/0jm2wyt7ad

[Gurveer @gurvrx]

@jaydeepjmakwana layered safeguards (cost + loop detection + rate limits)

[Gurveer @gurvrx]

Everyone is building ai agents.

Nobody is building the thing that stops an agent from spending $4,000 overnight because a retry loop got stuck.

Autonomy without a cost ceiling isn't a product.

It's a liability with a roadmap.

[Gurveer @gurvrx]

@dcbuilder https://t.co/BmoFrfl1jJ

[Gurveer @gurvrx]

@deedydas https://t.co/BmoFrflz9h

[Gurveer @gurvrx]

@TheHackersNews https://t.co/BmoFrflz9h

[Gurveer @gurvrx]

@FBICyberDiv here we go, lab: https://t.co/BmoFrflz9h

[Gurveer @gurvrx]

Whole lab is docker compose — vulnerable target, patched control that must fail, two patch-independent chains.

Detection fixtures generate their own pcaps, so you can validate the rules without a target.

[Gurveer @gurvrx]

Why 1001 form parts before the interesting ones?

To blow past max_input_vars and force the parser into the OOM path. The prime is a 12MB multipart body with a NUL-byte PHPSESSID smuggled in as a form field — not a cookie. PHP truncates the key at the NUL.

[Gurveer @gurvrx]

Second request leaks libphp through a 56-byte HashTable page.

Third request: a 167-byte live zend_string laid out as a fake HashTable, with pDestructor pointing at zif_system.

Command budget after the struct: 14 bytes. `id>/out/p1` fits. Barely.

[Gurveer @gurvrx]

The bug: session.upload_progress + memory exhaustion during request startup.

PHP hands back uninitialized heap in the session cookie. A 26-char session id comes back as ~4KB of live pointers.

First leak = where the heap is. That's ASLR dead.

[Gurveer @gurvrx]

I wrote detection rules for a PHP RCE, then measured whether they fire.

Suricata 8.0.7 inspects ~4KB of a request body.
The exploit puts its payload at ~90KB.

Every deep-content rule I wrote was decorative. 🧵