Solving problems you didn't know you had. ⬢ @InfinityBotList · @TryByteSend · @TryEmberly ⬢ Married to @CallMeAByte & @code ⬢ CEO @NodeByteLTD 🇬🇧
In my Igloo
Joined May 2018
- Tweets1.8K
- Following81
- Followers479
- Likes1.5K
Pixel 🇨🇦 retweeted
ੈ✩‧₊˚༺🍄༻˚₊‧✩ੈ
🍄@CodeMeAPixel
🍁@InfinityBotList
🍄@NodeByteHosting
🍁@TryByteSend
🍄@TryEmberly
ੈ✩‧₊˚༺🍁༻˚₊‧✩
People online love to spin things into end of the world panic. To clarify for my Canadian friends: nobody is warning of an incoming crisis. This is just Public Safety Canada’s standard, ongoing reminder to stay prepared with basic supplies.
I guess Hacktober isn’t over yet
‼️ Ubuntu and Red Hat still have no fix for a Linux kernel flaw that Anthropic says its unreleased AI model turned into a remote root exploit.
The bug, CVE-2026-98432, is a use-after-free in the IPv4 TCP handshake, rated 9.8 out of 10.
The exploit needs no credentials and targets servers with a multipath TCP listener, which Go 1.24 and later open by default.
The fix reached stable kernels on 11 October and Debian has shipped it. Ubuntu still marks every release from 16.04 to 26.10 vulnerable.
Red Hat now rates it Critical but has no patched kernel for RHEL 8, 9 or 10.
Anthropic has not released the exploit. By its count, it takes 48 minutes to leak a kernel pointer and five more to run commands as root.
🧑💻
@shufflebotlol is coming back thank you @CodeMeAPixel for the help with me not knowing how to get spotify stuff to work. ❤️🤣
And somehow this is how I spend most of my days 👀
Security update: Popplio 1.15.2 and Omniplex 1.8.1 fix four issues, including a webhook SSRF and a short-link open redirect.
omniplex.gg is already patched, so there's nothing you need to do. Self-hosting? Please update.
Details 👇
omniplex.gg/blog/security-up…
Pixel 🇨🇦 retweeted
🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild.
Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64.
Patch now → 22.23.4 / 24.22.1 / 26.12.1
Read ↓ thehackernews.com/2026/10/re…
Pixel 🇨🇦 retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
You can’t be serious, you’re the one that started this entire process and now you just sit back and act like staying in Canada was the plan all along…. Mad that you didn’t get what you wanted and the people told you to be a better government instead?
Thank you, Alberta!
I’m very pleased to see the initial results from Elections Alberta show widespread support for remaining in Canada. Albertans have voted for a stronger Alberta in a united Canada.
Thank you to all Albertans who took time to vote on these critically important referendum questions.
Tomorrow evening, October 20, I will address Albertans live at 6:45 p.m. to discuss the results of all referendum questions for which results are available, and where our province goes from here.
Pixel 🇨🇦 retweeted
Thank you, Alberta!
I’m very pleased to see the initial results from Elections Alberta show widespread support for remaining in Canada. Albertans have voted for a stronger Alberta in a united Canada.
Thank you to all Albertans who took time to vote on these critically important referendum questions.
Tomorrow evening, October 20, I will address Albertans live at 6:45 p.m. to discuss the results of all referendum questions for which results are available, and where our province goes from here.
Make sure you update Node too folks, PHP isn’t the only one having a bad week 🫡
🚨 High-severity Node.js flaw could allow remote code execution; CVE-2026-111497
Node.js has patched an out-of-bounds write vulnerability in its bundled Brotli decoder.
⠀
An attacker able to supply malicious Brotli-compressed data to an application could potentially corrupt memory and execute code on the underlying server.
⠀
Affected:
• Node.js 22.x
• Node.js 24.x
• Node.js 26.x
Fixed:
• Node.js 22.23.4
• Node.js 24.22.1
• Node.js 26.12.1
⠀
End-of-life Node.js versions may also be vulnerable and will not receive upstream security updates.
Administrators should upgrade and restart affected services.
Source:
nodejs.org/en/blog/vulnerabi…
Vercel putting in that work like always 💪
Did this man, really just say the forbidden words….. @connor200024 when I’m up all night tonight patching vulns I’m blaming you.
I have patched the NodeJS version for @TryByteSend following the latest vulnerabilities 🫡
Pixel 🇨🇦 retweeted
The PHP Foundation says Chainguard unilaterally broke the embargo and published built images containing the critical RCE fixes more than six hours early:
“This disregarded weeks of work by many parties toward a coordinated disclosure.”
socket.dev/blog/php-embargo-…
Pixel 🇨🇦 retweeted
⚠️ Vulnerability alert: php2shell
Unpatched sites running PHP 5.4 or later are at risk of remote code execution, data exposure, and crashes.
If your site’s web traffic is proxied through Cloudflare, we deployed protections before official public disclosure. Check the blog post to see which mitigations are enabled by default.
Even with these mitigations in place, update PHP as soon as possible to fix the underlying vulnerabilities.
nitter.gq/Cloudflare/status/2112…
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. cfl.re/488w8dc
Lmfao, and the findings continue. Now that the wave is started it probably ain’t gonna end anytime soon prepare to keep patching
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
The PHP 8.5.12 release fixes the two specific CVEs (via state/bailout changes) detailed in official advisories; referenced "surviving paths" (e.g. var_destroy UAF) are separate pre-existing unserialize issues unrelated to this patch.
php.net/archive/2026.p…
github.com/php/php-src/se…
github.com/php/php-src/se…
github.com/dinosn/php-8.5…
Pixel 🇨🇦 retweeted
Archive.org is currently offline. We are working to restore service now.