My brother in Christ

not a dev

[My brother in Christ @jackedtitties]

@putzisbackbaby where are we currently ?

[ɖʀʊӄքǟ ӄʊռʟɛʏ 🇧🇹🇹🇩 @kunley_drukpa]

Hitler’s Eagle’s Nest is currently on fire - what does this omen mean?

[dru @andrewkelly747]

im the best rapper alive

prod @beatsbySTIX

shout out @HappyNewsNtwrk

[My brother in Christ @jackedtitties]

you use 12-hour, I use 24-hour, we are not the same

[Derek Devicemanager @IT_unhinged]

Security called me at 6:12 AM today.

"Patch every PHP server immediately."

I asked what happened.

"Two critical vulnerabilities. Remote code execution. No authentication required."

Cool.

How many PHP servers do we have?

According to inventory: 12

According to reality:

Nobody knows.

We found one running WordPress.

Three running old internal tools.

One under someone's desk.

Two inside vendor appliances.

A forgotten employee directory from 2016.

And a server named:

PHP-OLD-DO-NOT-TOUCH

Naturally, that one runs payroll exports.

Then we found a PHP 5.6 box.

I asked who owned it.

The documentation said:

BRIAN.

Brian left in 2019.

We called Brian.

He said:

"Oh wow, that's still running?"

Excellent.

By 8 AM, leadership joined the incident call.

CEO:

"Can hackers actually get in?"

Security:

"Potentially yes."

CEO:

"Without a password?"

Security:

"Yes."

CEO:

"Then why do WE need passwords?"

Not the lesson.

Finance asked if we could wait until the weekend to patch because downtime affects revenue.

Security explained that the alternative was letting strangers execute code on our servers.

Finance asked for a cost comparison.

At 9:17, someone suggested temporarily taking the vulnerable websites offline.

Marketing refused.

"Our campaign is live."

So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.

We finally patched everything we could find.

Then our scanner discovered another PHP server.

Hostname:

TEMP-PHP-2014

Uptime:

4,512 days.

Nobody knows what it does.

Nobody owns it.

Nobody can shut it down.

But every time we block network access, the warehouse stops printing shipping labels.

Security has classified it as critical infrastructure.

It is running PHP 5.4.

The vulnerability has existed longer than half our employees.

The emergency patch took four hours.

Finding out what PHP actually runs took eleven.

The internet isn't held together with code.

It's held together with servers everyone is afraid to turn off.

[Kaleb @KalebPrime]

Guys, pick a number between 0 and 99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999

[jacky @jjacky]

i'm thinking of a random number between 1 and 2^256

[My brother in Christ @jackedtitties]

if I ever become a CA i'd propose priv key

000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000069420

cryptographically superior

[My brother in Christ @jackedtitties]

boomerware 🤣😂

[Roy @usr_bin_roygbiv]

We are witnessing the unravelling of 20 years of lazy zirp slop h1b boomerware in real time

[santi @santtiagom_]

si hoy vieron noticias de sitios desconectados y una alerta de seguridad en PHP, está relacionado con las vulnerabilidades que les conté acá.

les cuento la historia desde el principio.

PHP es el lenguaje que usan muchísimas webs, incluidas las que funcionan con WordPress. encontraron 2 fallas críticas que, bajo ciertas condiciones, permiten ejecutar código en un servidor sin siquiera iniciar sesión.

¿qué pasó?

(1) en 2024 ya habían detectado señales de uno de los problemas. corregirlo era complejo y todavía no habían demostrado cómo aprovecharlo para ejecutar código.

(2) en agosto de este año, investigadores con ayuda de IA lograron demostrar ese riesgo. Calif, OpenAI y Wiz aportaron hallazgos que hicieron evidente la gravedad.

(3) durante los últimos 2 meses, los mantenedores de PHP trabajaron en las correcciones y coordinaron con proveedores para preparar las actualizaciones. el plan era publicarlas el 22 de octubre.

(4) ayer empezó a circular información antes de tiempo. PHP publicó la alerta y adelantó los parches un día. después, Calif publicó por error un video demostrativo que terminó circulando en redes.

(5) Cloudflare detectó intentos de ataque y algunas organizaciones desconectaron sus sitios por precaución hasta poder actualizarlos.

(6) hoy, 21 de octubre, se publicaron las versiones corregidas.

si tienen un sitio con PHP, hay que actualizar el PHP que corre en el servidor. actualizar WordPress o sus plugins no alcanza.

me da la sensación de que vamos a ver muchas más historias así. fallas que llevan años en software que usamos todos los días y que ahora, con ayuda de IA, se vuelven más fáciles de encontrar y explotar.

[DFWStormChasers @DFWStormChasing]

Y'all ever seen an entire Subway on the interstate?

[My brother in Christ @jackedtitties]

@MaruCampos_G Chingas a tu madre cada vez que respires

[maeve ~ @miaaowing]

opsec level: 4️⃣

[Connor @unravelmyheart]

Anything u lose by being real is fake

[My brother in Christ @jackedtitties]

Hippocampusmaxxing

[Marc Landers @marclanders]

Data on 35,000+ adults: the more cannabis you’ve used in life, the bigger your hippocampus and the better your brain works after 40!

People who had ever used cannabis tended to have larger brain volume in key areas that are full of natural cannabis-like receptors (especially the hippocampus, amygdala, caudate, and putamen – these areas are important for memory, emotions, learning, and movement).

The more cannabis someone had used in their lifetime, the larger these brain areas were and the better they performed on tests of learning, processing speed, and short-term memory.
https://t.co/lD3hSSj3Cr

[Dennis Kortsch ⚡️ @dennis_kortsch]

I just deleted 190GB of claude code session worktrees.

Tell your agent to clean up after itself.

[refriedbuttsects @refriedbuttsect]

if spongebob had my job he would Not be ready he would k*ll himself

[My brother in Christ @jackedtitties]

@doristsao Pls stop

[trap dad @dude_gang]

you met me at a very mexican time in my life