~Dee~

Aerospace 🤝InfoSec| Real Madrid | Jazz Piano| Grace always finds me.

[~Dee~ @peekay_io]

When Mesut Ozil was the best CAM in the world 😳😳

[Rishabh Karnawat @rishabhkio]

i read this at least once a month.

[James Pavur @JamesPavur]

Congrats to @killa who solved https://t.co/a4rI7FPsln hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).

Check out their awesome writeup here: https://t.co/vnui8sJ5mj

[hacker.house @hackerfantastic]

Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. https://t.co/5Pk2aLtFR3

[Gali @galiofgalilee]

BREAKING:
Scientists confirm that an ADHD brain can hyperfocus for 4 hours straight on a complex hobby—but will physically freeze for 3 days over a chore that takes 90 seconds to finish.
Researchers baffled.
ADHD community: "Yeah, we know."

No clinical citation needed—every parent and kid staring at a pile of shoes by the door is the study. Here is why tiny tasks paralyze an ADHD brain, and how to trick yourself (or your kid) into starting.1/6

[Silas Cutler (p1nk) @silascutler]

New PHP2SHell tracker from the @Censysio ARC team :

https://t.co/k6d8zrOJhp

[Marcus Hutchins @MalwareTechBlog]

I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:

Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:

a) a world-class exploit developer with an extreme case of imposter syndrome.

b) currently looking at some very confident-sounding but wrong LLM output.

I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.

I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).

The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".

People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.

So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.

What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).

The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.

LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.

[Kostas @Kostastsale]

Really proud of what we managed to capture and put together at Threat Hunting Labs around PHP2Shell in just a day of non-stop work. I'm tired but wanted to share this quickly with the community.

We took real exploitation activity and turned it into something the whole community can benefit from. Raw logs, hunting queries, Sigma and Suricata rules, a PCAP, and a full investigation with our own analysis.

We normally reserve the detailed researcher analysis for subscribers, but we've made everything free for this one.

No gatekeeping here, this is free for everyone. Hope you find it useful!

https://t.co/CVfthEAEVZ

[vivian @vheeorji22]

I want to relearn mathematics from scratch as a grownup

[Unix @Unixsystem13]

Imagine trying to brute force 1 out of 394,020,061,963,944,792,122,790,401,001,436,138,050,797,392,704,654,466,679,482,934,042,457,217,714,972,106,114,142,662,548,849,156,408,066,279,903,068,160 possible values and getting it on the 5th try.

[Herrington Darkholme @hd_nvim]

-----BEGIN RSA PRIVATE KEY-----
4
-----END RSA PRIVATE KEY-----

[~Dee~ @peekay_io]

@brettshavers Definitely interested

[Ernest Coleman @cole__xy]

This is what women have been dealing with while in school. After graduating, it doesn’t get better because there’s more wahala at their workplace too.

[Rajeev Sharma @RajeevSharma00]

I am a second-generation American. I was BORN in the United States. I was raised here. This is the only country I have ever called home.

I grew up believing in mostly conservative principles. Individual liberty, meritocracy, personal responsibility, and the American Dream. I believed these were values worth defending.

But somewhere along the way, something went terribly wrong.

I watched fellow Americans being told they didn't belong because of the immutable characteristics like ancestry. I watched patriotism become a test of ethnicity. I watched people who spent their entire lives loving this country being treated like outsiders in their own homeland.

And perhaps the most heartbreaking part was the silence of people we once considered political allies.

Let me make something absolutely clear.

My American identity is NOT conditional on my skin color. My citizenship is NOT diminished by my surname. And my patriotism does NOT require validation from anyone.

I can disagree with you on immigration, economics, foreign policy, or virtually any political issue. That is democracy.

But I will NEVER entertain a debate about whether I belong in the country where I was born.

No political party is entitled to my unconditional loyalty. Especially not at the expense of my dignity.

I did not come to America. I was born in America.

And I refuse to spend the rest of my life proving that I belong in my own country.

I am an American. Not a guest. Not a foreigner. Not a second-class citizen.

An American. Full stop.

[Be - Yaa🦋❤️ @Lulu4Wendy]

Exactly!!!!….i don’t care what the media is saying about marriage but the fact that my parents are still together after more than 40 years of marriage is even a go ahead for me.

[Gregory M. Kurtzer @gmkurtzer]

Wow. I woke up to an impressive number of upset people who apparently don’t understand how LLMs work and can’t cope well with me pointing it out.

An LLM is a statistical next-token prediction model. That’s how it works. It’s an extraordinarily sophisticated calculator performing math you could theoretically do by hand (if you were sufficiently masochistic).

Math doesn’t know what it’s calculating. Pi doesn’t spend its evenings contemplating the nature of circles, and c doesn’t ponder the relationship between matter and energy.

That doesn’t make the results any less accurate, impressive, or useful.

Between inference requests, an LLM isn’t sitting around thinking. It isn’t reconsidering its answers, wondering whether it made a mistake, contemplating its existence, or questioning whether it’s conscious. Its weights remain fixed (it doesn’t learn), and computation resumes when it receives input.

We know this because we designed these systems. The architectures, mathematics, implementations, and research are extensively documented. You can study them yourself.

Of course, some people immediately lean into comparisons of biological intelligence or philosophical debates over consciousness because that is what they know.

But biological intelligence and artificial neural networks are fundamentally different systems. Similar outputs don’t establish equivalent internal experiences.

I experience consciousness directly. I infer that other humans do too because we share biological structures and processes. We don’t have equivalent evidence for an LLM, and nothing about its known operation gives evidence of conscious experience.

Which brings me back to my original point.

To me, understanding is conscious comprehension. It means being aware of information, recognizing its meaning, and experiencing that comprehension. If I wasn’t conscious I could not understand.

We can perform actions unconsciously. We can produce correct results without knowing why they’re correct. But I distinguish those capabilities from consciously understanding what we’re doing.

An LLM can solve complex problems, explain difficult concepts, and produce remarkably accurate information. I give it full credit for those capabilities.

But producing an answer that we rationalize as understanding isn’t the same as experiencing understanding.

You don’t have to agree with my definitions. We can debate functional understanding versus conscious comprehension all day, but that won’t establish whether an LLM actually experiences anything.

The right debate is this…

Could machines exhibit something different from human consciousness, something measurable, meaningful, and worth studying?

I think so, absolutely!

I’m entirely open to discussing “machine consciousness” in terms of observable, testable computational properties. We built these systems, we can instrument them, examine their internal mechanisms, and investigate what they’re capable of.

That seems far more productive than endlessly arguing over whether a machine experiences life the way humans do.

So here’s my question:

How would you define machine consciousness, and more importantly, how would you measure it?

[SANS DFIR @sansforensics]

North Korean hackers hide malicious code in software packages and constantly change it to avoid detection.

At #DFIRSummit, Jenn Gile of OpenSourceMalware shared real examples, detection strategies & a GitHub hunting guide.

Join FREE Live Online: https://t.co/6TMWyImast

[Fr John Corrigan @illativefaith]

POPE LEO HAS PASSED the night peacefully.

THE HOLY FATHER BREATHED HIS LAST dose of aerosolised saline via the nebuliser and is now resting comfortably.

HIS HOLINESS IS NO LONGER WITH US in intensive care, having been transferred to the medical unit.

🇮🇹 ➡️ 🔀 ➡️ 🔄➡️🏴󠁧󠁢󠁥󠁮󠁧󠁿

[Madrid Zone @theMadridZone]

🚨 Thibaut Courtois has completed more passes in the 1st half (19) than Real Madrid's starting double pivot, Fede Valverde (16) and Aurélien Tchouaméni (17).

[Nonfa KING @ajeezayGH]

If this comes your TL .. you need it

[Bax @MattBaxendell]

Columbus, Ohio.

The best city in the country.