Jamstack Jay

Passionate about cloud security, and VR/AR (before the hype). House music, craft beer, chess, and math are my jam. Always learning, always evolving

[Christian Findlay @CFDevelop]

I hope the takeaway from this PHP thing is that people start to wake up to the fact that our software and infrastructure is like Swiss cheese, can’t be trusted and this is the work of HUMANS.

AI is not the threat. Infact, AI is the ticket to finding and fixing the security holes

[Ethan Levins ✝️ @EthanLevins2]

Jared Kushner would be charged for treason in a just world.

But, we live in one dominated by evil pedophiles.

[David Sacks @DavidSacks]

There’s a world of difference between user-authorized agents (Muse, Instinct, Grokbot, etc.) and true unauthorized/rogue agents that could constitute cyberattacks.

Most of the activity described in the Axios story appears to be the former: customers sharing credentials with agents so they can take actions on their behalf. This may violate bank terms requiring humans to log in themselves, but these are in no way cyberattacks.

The direction banks should go is to support user-directed agents. For example, Amex is an authorized connection in Muse, making it easy for users to grant, limit, and revoke access.

Read-only permission levels are a sensible interim step. Several banks already support or are moving toward them. Full write access (with user credentials) is a different risk category and should be approached carefully.

Frightening the public by blurring the line between user-authorized agentic behavior and cyberattacks is irresponsible.

[Rula Jebreal @rulajebreal]

The United Nations should confront impunity, not crown it.
The UAE has put forward a candidate for UN secretary-general. Its record is appalling.
It has armed Sudan’s genocidal RSF militia, which has carried out mass murder and mass rape. It also stands accused of arming and financing warlords and militias in Libya and across the Middle East—empowering war criminals who rule through violence and brutal repression.
It has bankrolled Trump and the dictators who crushed the Arab Spring, helping extinguish millions of people’s hopes for democracy, dignity, and freedom.
Elevating a UAE candidate to UN secretary-general would not be a triumph of diplomacy. It would be a debasement of the international system: rewarding a corrupt regime accused of enabling atrocities with leadership of the very institution charged with preventing them.

[Christian Findlay @CFDevelop]

I hope people realize that governments and other actors are already using spyware to exploit these vulnerabilities

They’ve been telling us they’re doing this for over a decade

This is how they hack phones and computers

Get it now?

Maybe time to fix the holes you think?

[Jamstack Jay @ljayham]

@pinedegen @_benkaufman That was always going to happen, denial is a river in Egypt

[Ben Kaufman @_benkaufman]

The funny thing is everyone was saying AI slop code will cause a cyber crisis but it’s actually all the old human slop causing it and the AI is just cleaning it up

[Gergely Orosz @GergelyOrosz]

Implications of AI, in relation to software security:

#1 CVE discovery sped up ~10-100x vs before

#2 Manual patching needs to die... but how?

#3 Security monitoring needs to improve massively

#4 Defenders will need to use a LOT more AI

#5 Security will cost a LOT more

And #4 is an interesting one, given that many security professionals heavily dislike AI (and X: they're on Mastodon!)

But the longer security teams live in denial about AI, the more their systems will be vulnerable for attackers to access, without them ever knowing. Like how TiDB was practically an open house for attackers to come-and-go for a whole month...

[John Wight @JohnWight1]

This time next year, Zelensky will be safely ensconced at a country mansion somewhere in Sussex. There he will be feted and visited by the likes of Boris Johnson, Keir Starmer, Sunak, Obama, Hillary Clinton, von der Leyen, Sean Penn, William and Kate, and Tony Blair et al.

His memoir, ghost written, will see him embark on a promotional tour of the chat show and podcast circuit, during which he will be curated as the man who stood up to Putin and was betrayed by Trump. Lucrative Hollywood offers for the rights will follow.

As part of this hagiographic carnival, Zelensky will be given an honorary knighthood by King Charles, accompanied by the usual trumpets and banquet.

Meanwhile, back in Ukraine, investigators will uncover corruption under his premiership on an industrial scale. These findings will be summarily dismissed as a in the West as a fabrication, cooked up in the Kremlin.

For the ordinary Ukrainian, left to pick up the pieces, heartrending stories of men being kidnapped from their families by Zelensky's conscription press gangs --- never to be seen again -- will be commonplace.

These stories will be joined by accounts of war pensions denied, compensation payments for the loved ones of fallen soldiers declined, and as will details of widespread torture and abuse within the ranks.

No lessons will be learned -- just as none were learned from previous failed military adventures in Afganisation, Iraq, Libya, Syria, etc.

The circus will move on to the next, confirming that though the faces change, the game remains the same.

[Peter Dedene @dedene]

Somewhere, a CTO just found out their servers still run PHP 5.6 💀

[Ivana @ivanainai]

Has Opus 5.5 been quietly NERFED??

I reran the exact same Mentos simulation prompt from September 30 today.

Same model. Same prompt. 20 days apart.

Look at the difference. 💀

It looks like making the current model worse is the easiest way to make the next release look 10x better?

[Jamstack Jay @ljayham]

@jphilipp @deedydas Ah I think we're on the same page then

[Jeremy Corbyn @jeremycorbyn]

I will never be deterred from speaking out against Palantir, which should have no place in our public services whatsoever.

Kick Palantir out!

[Austen Allred @Austen]

Oh my goodness this has to be right.

Instead of generating a random 256-bit number they generated a random number between 0 and 256.

That’s how they got 4, 66, 155, 156, 230 and 237.

[Young child/golden retriever @EggMasonValue]

BREAKING: eMudhra exits SSL/TLS certificate business, blames social media instead of incompetence for the same

[Andrew Curran @AndrewCurran_]

The problem seems to be that the banks can't tell if the agents have been given permission by their users to access their accounts or not. Every big AI company is in the process of launching a proactive agent with access to everything. This is going to turn into a big issue.

[apewood @apewoodx]

LinkedIn is gonna go crazy about these cybersecurity attacks when they find out next month

[🟣 Chris Holland @chrisholland]

Lot of #PHP snark going around right now from folks who've either never written software, or never done it in PHP (in the last 20 years).

I've architected, designed and hand-coded copious amounts of software in Java/Spring/Hibernate, .Net/C# Entity Framework and PHP/Symfony/Doctrine, applying very similar patterns and better practices of completely stack-agnostic concepts such as:

- Test-Driven Development (and given half-day and full-day hands-on live-coding workshops at conferences worldwide)
- Onion/Hexagonal Architecture
- Domain-Driven Design
- Data Mapper ORMs

Beyond workshops, I have spoken on these topics at conferences worldwide as well.

I might argue that I am not completely devoid of clue when it comes to these stacks' capabilities.

In fact, I have hired, coached and cross-trained engineers across these 3 stacks.

And I can assure you PHP shines within these paradigms, with an extremely vibrant, mature and robust ecosystem of Application Frameworks, Security Frameworks and Tools, and Open-Source Software Components and Libraries.

PHP is not WordPress. WordPress is not PHP. If you care about quality software, PHP is a great home for you. So is Java. So is C#. So are other languages. If you suck at software you'll suck in any stack. If you're good, each stack has strengths you can play to.

NOW let's talk about security.

This vulnerability, is the very first RCE to this level in PHP's history. It was reported back in August. AI did help. A lot. (Wiz claims one researcher did in a week what would previously have taken a team months)

Previous PHP RCEs had limited attack surfaces:

- 2024 - Windows CGI Only
- 2019 - One specific nginx setup
- 2012 - CGI only

None of which applied to reasonably-better practice typical Linux + Nginx + php-fpm deployments.

This right here was ... unique, I think even across any stack. The only language-runtime equivalent to it was probably Windows IIS Code Red.

That's not to say other stacks didn't have framework-level vulnerabilities with devastating impacts, if memory needs refreshed:

Ruby — Rails CVE-2013-0156: every Rails app, default config, pre-controller, botnet-exploited. The strongest analogue in any stack.

Java — Struts 2 CVE-2017-5638 (Equifax). Log4Shell needed the app to log attacker input; Spring4Shell needed WAR-on-Tomcat + JDK 9+ + POJO binding.

Node — React2Shell CVE-2025-55182 (Dec 2025, CVSS 10, CISA KEV): default create-next-app exploitable, but Express/Fastify/Nest untouched.

.NET — MS10-070 padding oracle (2010) leaked web.config/machineKey on every ASP (dot NET) site; RCE was a derived second step. Kestrel/ASP.NET Core has never had an RCE.

Look ... let's drop the snark. LLM-driven vulnerability research and breaching frameworks are about to humble the absolute heck out of all of us. They already have.

If you think your stack is not at risk, think again.

[Jamstack Jay @ljayham]

@jphilipp @deedydas "his own fires"

That literally is a misrepresentation of what happened

[Maximilian @maxedapps]

Having close to zero dependencies is becoming more important than ever.

Of course, with AI, it's really easy to build your own (minimal) versions of whatever functionality you need.

What a big shift in the ecosystem!