Raphael Spannocchi

How can democratic decisions be smarter than the median voter? Beyond Arrow's paradox. Building @Anode_GG.

[Raphael Spannocchi @raphbaph]

The true test of any organizational paradigm or collective consensus building effort is this:

Does it make the whole more intelligent than the one, or less?

Do people get better when interacting with the system? Or worse?

It's really that simple, and that hard.

[Raphael Spannocchi @raphbaph]

@lennysan Blackroll ...

[Raphael Spannocchi @raphbaph]

@jonnym1ller @tomosman with the help of abliterated models you could do a service to society that way!! 🥰

[Mina Foundation (httpz) 🪶 @MinaFoundation]

The deployment framework for the Mina Decentralized Treasury is now published.

It sets out how MINA holders will propose and vote on ecosystem funding, the three-phase rollout, and the safeguards in place as @AragonProject takes on stewardship.

Read it here: https://t.co/CikYcHAjdr

[Raphael Spannocchi @raphbaph]

@TheAhmadOsman yes

[Raphael Spannocchi @raphbaph]

LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.

😂 this!!

[Marcus Hutchins @MalwareTechBlog]

I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:

Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:

a) a world-class exploit developer with an extreme case of imposter syndrome.

b) currently looking at some very confident-sounding but wrong LLM output.

I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.

I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).

The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".

People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.

So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.

What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).

The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.

LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.

[Raphael Spannocchi @raphbaph]

@eriaac @jonnym1ller THIS!!!

[Raphael Spannocchi @raphbaph]

Inspirational move by a truly aligned foundation.

Token holders: this is what you deserve!

[Aragon.eth 🦅 @AragonProject]

Aragon will steward the Mina Decentralized Treasury process, supporting the MINA community as they propose, evaluate, and vote on ecosystem funding.

The deployment framework is now published, outlining the phased rollout, safeguards, and path toward full community autonomy.

[Raphael Spannocchi @raphbaph]

@jonnym1ller @elder_plinius nothing there happened though. that's my point exactly. maybe someone will somehow use these robots to hurt someone else somehow.

or... hear me out, just use a gun. or a knife, or something easy to use and obtain. something cheap
like a screwdriver. 🪛

[Raphael Spannocchi @raphbaph]

@jonnym1ller @emanuelturis yeah but also for defenders!

[Raphael Spannocchi @raphbaph]

trivial is actually the perfect point. with AI there might be in some
distant scenarios possibly be a way for them to somehow damage humans by making use of objects in their surroundings maybe

a nuke detonates and incinerates an entire city in a second

can you see the difference?

[Raphael Spannocchi @raphbaph]

@jonnym1ller the impact of a nuke is trivial

[Raphael Spannocchi @raphbaph]

@jonnym1ller but this is software. it's not dynamite. please! this is ridiculous.

this kind of narrative is so harmful!
it will lead to a lot of very unnecessary and very dangerous regulations with tons of unintended second order effects if repeated by enough gullible people.

[Raphael Spannocchi @raphbaph]

@jonnym1ller this has nothing in common with nukes. not one thing. the conjecture is absurd. frivolous even.

[Raphael Spannocchi @raphbaph]

@negue331 The "safety" people?

[Raphael Spannocchi @raphbaph]

Who was that guy that predicted a big cyber incident happening soon with a follow on crackdown on open source AI like two
weeks ago or so?

And many of the exploits come out of OAI, and somehow arrived before the fixes...

idk.. maybe I am getting paranoid.
Likely.

[Raphael Spannocchi @raphbaph]

@jonnym1ller https://t.co/Evqdn18ITq

[Illia (root.near) (🇺🇦, ⋈) @ilblackdragon]

We are at Security Armageddon now.

A large part of internet is affect in some way today, lots of older software vulnerabilities are coming out and through those more software is getting exploited.

PHP systems like Wordpress power a big part of content websites. Malicious TLS certificates especially affect basic services and older codebases. Plus node.js, plus LiteLLM, etc etc.

Uncensored models are becoming a key to enable security defenses to keep up. Formal verification allows to improve on how things are verified but still requires smart models to translate between systems and make sure formalizations are correct.

We also really need to transition to models that involve cryptography where right now API keys and access tokens are used. Hosting platforms that can secure the software even from platform itself.

Meanwhile, update, patch, rotate.

[Raphael Spannocchi @raphbaph]

It's not a weapon any more than a shell script is or can be. Can we stop the fear mongering? Honestly please 🙏

This path will lead to so much suffering. The worst possible world is the one where the government and the big labs control AI.
Imagine that! Absolutely horrible. Exemptions and preferential access for cronies only, rampant corruption and of course rampant surveillance because that's always gonna be A OK

[Raphael Spannocchi @raphbaph]

@johncarl @jonnym1ller this!

[Raphael Spannocchi @raphbaph]

@adntaha_ai @jonnym1ller one more thing to considet is not just defense when someone is attacking but proactively testing systems to make them more secure.