// tomhatzer - let's build together! 🚀

Let's bring your web projects to life 🚀 Founder @twopeaksdigital - Building

[// tomhatzer - let's build together! 🚀 @phpastes]

So, I've been working on something since MinIO went "dark" (already since a little before that) and I'm looking for testers.

Are you using PHP, #Laravel, #Symfony, ... and always wanted to host your own #S3 #server, written in #PHP?

Looking for 5 testers to get feedback. DM me

[Claudio Dekker @ClaudioDekker]

Laravel Guardrails is out!

Start from a preset, like one that holds your code to laravel/framework's own style, and a pre-commit hook checks only the lines you changed. Your oldest app passes on day one, and every failure names the file, line and fix 😎

https://t.co/N8OIz3BCOb

[Florian Roth ⚡️ @cyb3rops]

Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment:

1. Discovery with Nmap

Common and alternative web ports; HTTP headers that may expose PHP versions:

nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target>

Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.

2. Huntress: Monitoring and detection

• Confirmed facts and remaining questions
• Suspicious PHP child processes, shells and downloaders
• Webshells and other post-exploitation activity
• My process-watcher for Linux process visibility

https://t.co/XLx8za50cZ

3. Vincent Schmalbach: Hardening and patching

• Temporary nginx/Apache filters and upload-progress settings
• WAF/origin bypass checks
• Package and backport verification
• PHP-FPM/worker restarts, container rebuilds
• Side effects and checks for compromise

https://t.co/30YfHmqIcR

Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.

[HD Moore @hdmoore]

https://t.co/fgE40dHDiy

The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).

[Florian Roth ⚡️ @cyb3rops]

Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.

[Ian Carroll @iangcarroll]

It appears these intermediary certificates were issued with single-byte P-384 private keys. This means anyone can exploit this issue locally and issue valid certificates under them with no effort.

This is very, very bad! Seems undetected since issuance in 2025?

[Charlie Chapman @_chuckyc]

ok... uh so I'm making a game... it's like if GTA & Apple Maps v1 had a baby

And that baby was a custom built engine that streams in OpenMapTiles (plus some other public domain mapping data) to render the entire earth as a playable open world game

Engine is all C++ with Metal (and Vulcan) renderer - which means this thing runs on ALL Apple platforms... yes even that one (ok not the watch... yet)

Right now it's just a sandbox world. No "game" - just layers and layers of systems. Earth scale procedural weather systems (rain, storms, clouds, wind, KpI, tornadoes, hurricanes, etc) which means you can see them coming from the distance and travel across the landscape in a timelapse. And every building has a procedurally generated interior.

There's also tons of vehicles, skateboarding (with skateparks), snowboarding (with ski resorts & lifts)

Also a photography mode with all sorts of fun goodies

The whole thing is a bit mad. Work's been insane right now and I wind down before bed by going through all of the work Claude has done that day, playtesting, writing up new project plans, and then kicking off the next day's projects across my 3 Macs in my house wirring on this all day with Opus 5.5 (maybe save that explainer for another crazy person Twitter screed)

Anyway, curious what you think. Now I can post my little updates here instead of blowing up all my group chats with the weird ideas I'm trying next.

[Eric L. Barnes @ericlbarnes]

Chart go up! Apparently, people are still interested in PHP.

[Adil @cheepo2109]

x - the fear mongering app

[Florian Roth ⚡️ @cyb3rops]

Ah, now I get it. I thought the AI catastrophe meant a model escaping its sandbox, launching nukes or hacking the power grid.

Turns out it spots the AI debt bubble, shorts its own creators and crashes the financial system with trading bots.

The singularity is a margin call.

[// tomhatzer - let's build together! 🚀 @phpastes]

Read the friggin docs yourself.
Read the friggin docs yourself.
I repeat.
Read the friggin docs yourself!

You‘ll be better off understanding the stuff you‘re working with even though AI implements it for you.

[Steve Bauman @stevebauman]

Using AI as an excuse to move toward lower level languages feels completely backwards to me

“We don’t need to understand all this complexity, AI does” is exactly the wrong direction. Human understanding is required for every functioning software system

The goal should be high level languages with low level performance, not low level languages obscured and incomprehensible having to be explained by a non-deterministic AI translation layer

What we need is even higher level languages optimized for human understanding. That is the modern bottleneck we’re facing right now

[// tomhatzer - let's build together! 🚀 @phpastes]

@heyandras Did this 2 years ago. Thinking about doing it again. Not sure if a good idea, like at all.

[ZachXBT @zachxbt]

1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group.

Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain.

[// tomhatzer - let's build together! 🚀 @phpastes]

@maxclark For me, it's a bug as I like talking to my clients and having video calls with them 😄

[Rowan Fornow 🚵🚉🏙️🦣🇵🇸 @rowanfornow]

You guys just don't get it. Normal people don't have personal projects. Normal people don't do research. People whose only hobbies are pickleball and NCIS: Miami have no reason to adopt and - unless something radically changes with people, tech, or both - never will.

[// tomhatzer - let's build together! 🚀 @phpastes]

@heyandras I fully understand how you feel. You are not wrong, not at all.
Social media takes a huge toll these days and should be consumed with care. Less is more. It makes life easier and reduces pressure a lot.

[// tomhatzer - let's build together! 🚀 @phpastes]

@DanielLockyer It‘s (most of the time) not just 1Password but a Chrome issue itself with extensions taking 30 seconds or more to load and having to unlock every few minutes again. Same for Dashlane and others.

[Chubby♨️ @kimmonismus]

Talking about safety: GLM5.3 uncensored on HF. Fun times ahead.

[// tomhatzer - let's build together! 🚀 @phpastes]

@JonasScholz19