Ovi Bodea

▪️maker-of-things▪️seeker▪️ reader▪️dog-lover▪️ traveller▪️ learner▪️teacher

[SemiAnalysis @SemiAnalysis_]

🚨🚨ALERT: ANTHROPIC IS A/B TESTING USAGE LIMITS

Many users on X are reporting LOWER usage limits right now. THEY ARE NOT WRONG. We detected an A/B test going on that DECREASES your monthly API-value by ~20% while INCREASING your 5h usage limits by ~20%. This only affects SOME accounts. (1/2)🧵

[Ovi Bodea @ovidbme]

https://t.co/mdfOzcvbxQ

[Ovi Bodea @ovidbme]

best voice model i've seen so far, by quite a margin. dessa, clearly crosses the uncany valley, it’s full-duplex, it’s not an LLM, and can run locally on mac m4 or higher.

team behind it has been buildig models since 2012 and have very good sense of humour too "...and whatever the hell Angular is"

[Ovi Bodea @ovidbme]

@o_kwasniewski are you going to maintain it?

[Ovi Bodea @ovidbme]

@DevQuizzy no, i’m tired of posting, imagine security engineers

[Ovi Bodea @ovidbme]

halloween started early this year.
the ghouls are out and they brought rces, backdoors, cracked certificates, and zero-days with them.
if you run production systems, the trick-or-treat is already over. time to patch, audit, and rotate. thread ↓

[Ovi Bodea @ovidbme]

@KaiLentit “i have a prompt injection in the terms of service” dudeeeeeee this could actually work!!

[Ovi Bodea @ovidbme]

@KaiLentit “i’m just afraid we’re building skynet on maria-db” epic!

[Ovi Bodea @ovidbme]

some good news?

[Marcus Hutchins @MalwareTechBlog]

I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:

Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:

a) a world-class exploit developer with an extreme case of imposter syndrome.

b) currently looking at some very confident-sounding but wrong LLM output.

I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.

I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).

The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".

People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.

So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.

What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).

The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.

LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.

[Ovi Bodea @ovidbme]

and another one

https://t.co/671x0y2wBP

[Florian Roth ⚡️ @cyb3rops]

https://t.co/yBSDZvoUYr

[Ovi Bodea @ovidbme]

and another one

https://t.co/IfQSnyveN3

[Railway @Railway]

An urgent notice from the Railway team

https://t.co/niUAhTAQJM

[Ovi Bodea @ovidbme]

@nodejs @nextjs @reactjs https://t.co/rpnLmpCyWF

[Vercel Developers @vercel_dev]

Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.

Vercel WAF rules are live for every project and block known exploit patterns.

https://t.co/JtfEshHnOC

[Ovi Bodea @ovidbme]

@nodejs + @nextjs /@reactjs
node released fixes for a brotli decoder out-of-bounds write that can lead to rce (cve-2026-111497) plus tls hostname verification bypasses.
update to 22.23.4 / 24.22.1 / 26.12.1.
next.js also patched two critical unauthenticated rces: one in react server components typed-array handling and one in svg/image processing through sharp. move to 16.4.1 or 15.5.28.

[Ovi Bodea @ovidbme]

@Microsoft if this was useful, follow for more of these.

[Ovi Bodea @ovidbme]

@Microsoft october patch tuesday
record release (~1,400+ cves). one confirmed exploited: cve-2026-96951, a windows shell mark-of-the-web bypass.
files from the internet can skip smartscreen and protected view warnings. cisa added it to kev.
apply the october security updates, especially on machines that open email attachments or download files.