Digital Creator | AI Enthusiast & Builder
Joined March 2025
- Tweets341
- Following177
- Followers88
- Likes718
These 6 free repos just replaced a $200K quant desk.
TradingAgents · AI-Hedge-Fund · Vibe-Trading · Qlib · FinRL · Rea
685k stars combined. Zero salary.
The desk they build: → 4 analysts (technical · sentiment · news · fundamentals)
→ Bull vs Bear debate
→ Trader proposes
→ Risk checks
→ PM makes one call a day
How it actually runs:
Pick one desk (not all six)
tradingagents -ticker NVDA -analysts all
Read the vote heatmap before you trust the PM
90 sessions later the heatmap is the product.
Each row = an analyst’s conviction.
Each cell = a transparent vote.
You still have to know when the whole board is lying.
What used to cost a fund ~$200k per researcher now runs locally for free.
The edge moved. It’s no longer access to the models.
It’s the discipline of watching the heatmap and knowing when to ignore it.
Bookmark this before you start six desks at once.
🤖 Made with AI
THESE 6 FREE REPOS SHOULD HONESTLY BE ILLEGAL. A QUANT RESEARCHER COSTS A FUND ~$200K A YEAR. THIS DESK HAS 4 ANALYSTS, A BULL, A BEAR AND A PM, AND IT COSTS $0.
they're tradingagents, ai-hedge-fund, vibe-trading, qlib, finrl and rea. 685k github stars between them.
here's how it works:
> rea maps the app's signal to 4 analysts: technical, sentiment, news, fundamentals
> a bull and a bear argue, a trader proposes, risk checks it
> the pm makes one call a day on nvda
here's how to run it:
1 → pick one desk to start, not all six
2 → tradingagents --ticker NVDA --analysts all
3 → read the analyst votes before the pm decides
honestly the vote heatmap is the part i keep watching. 90 sessions, one row per analyst.
the pm's last call is on screen in the clip. i won't say anything more.
bookmark this ↓
NVIDIA might not want you to see this. 👀
A 744 BILLION parameter AI model running on a regular laptop. No dedicated GPU. No cloud. No API bills.
Sounds impossible? Meet Colibri + GLM-5.2.
Here's the crazy part:
The model weighs hundreds of gigabytes, but Colibri streams the necessary data from your SSD instead of loading everything into RAM.
Only the required parts are brought into memory as needed.
CPU-based inference makes running massive models possible without expensive GPU hardware.
Run locally. Keep your data private. Pay ZERO per token.
But let's be real: there's a catch. On a typical laptop, generation can be extremely slow. This isn't magic hardware — it's a clever engineering trade-off.
Still, think about what this means.
For years, we've been told that serious AI requires expensive GPUs, powerful servers, and recurring cloud costs.
Now, projects like this are pushing the boundaries of what's possible on consumer hardware.
Imagine local AI coding assistants, private research tools, and offline AI workflows — without sending every prompt to a corporation.
The real question isn't whether your laptop can run a massive AI model.
It's how far software optimization can push hardware we already own.
Open source is changing the rules.
🔗 github.com/JustVugg/colibri
Would you run an AI model this big on your own laptop, even if it meant sacrificing speed for privacy and zero API costs?
#AI #OpenSource #LocalAI #MachineLearning
Forget $1,000 automation courses. This is literally the most game-changing AI setup I’ve seen all year.
You already have the hardware in your drawer.
Okay this is f*cking wild. Ex-Google Android engineer:
"Your old phone is the best agent hardware you own. Grok Bot sees the screen, taps, types and runs your apps while it charges"
This is a phone from my drawer running overnight
Grok Bot → Screen reader → Tapper → Typer → Checker → Done
The screen reader turns screenshots into buttons and fields
The tapper and typer work it like a person, just faster
Watch second 11, the checker catches a wrong date before it gets sent
42 tasks done while it charged from 19% to 100%
Everyone gives Grok Bot a chat window, almost nobody gives it a whole phone
Worth more than most $1,000 automation courses
Bookmark and watch it today
Send this to the friend with an old phone in a drawer
Then read how to build your first Grok Bot desk in the article below ↓
Bill Gates just issued the most profound warning of our generation:
“The next 20 years, the world will plunge into absolute hell.”
Before AI finally creates a world of total abundance and enriches everyone, humanity must survive “20 years of massive panic.” In a powerful new interview on Decoder, Gates laid out the brutal reality of the transition period right before AI and robotics reach their final completion:
1. The Complete Annihilation of Human Labor
The foundational mechanism of our society - “work to earn a living” - is about to completely vanish. Tech giants and nations worldwide are pouring astronomical sums into developing humanoid robots. In just a few years, or a decade at most, carpentry for house construction, agricultural farming, and complex surgical operations performed by doctors will be executed by ultra-cheap robots practically for free. Human labor will become entirely obsolete.
2. The Violent Fracture of Society (Winners vs. Losers)
Gates flatly stated that before reaching the utopian paradise where AI enriches all of humanity, the next two decades will be an “era of fierce chaos.” Every traditional concept we rely on will collapse with a deafening crash. Society will be torn violently down the middle: an immense, desperate army of jobless losers on one side, and a tiny fraction of hyper-wealthy winners clutching astronomical fortunes on the other.
3. The Ultimate Danger: Surviving the Transition
The true nightmare isn't the final destination of AI, but the turbulent bridge to get there. Unless this hyper-speed development is somehow halted globally, our economic and social systems risk failing to endure the pressure. The world may simply break under the weight of sudden mass unemployment and extreme inequality before we ever reach the promised land of post-scarcity.
As Bill Gates warned :
“I hate being the bearer of concerning news on this, but it’s even worse not to tell people that this is coming, and we have choices as humans to make about how we shape it.”
Are we truly ready to endure two decades of societal breakdown, or is this the beginning of the end?
youtu.be/A0kTUP7fWtk?t=2386
Anthropic's model just ran AI experiments at expert level using less than half the compute. One run cost 30x less than an average expert attempt.
Jack Clark, Anthropic co-founder, moved his forecast after seeing the results. He used to put 2027 at 30% and 2028 at 60% for an AI that trains a stronger successor. Now he treats 2027 as the year it could actually happen.
The benchmark is TasteVal from P-Zero Research. Eight AI development tasks. One H100, 40 GPU hours per task. 24 researchers from OpenAI, DeepMind, Nvidia and Microsoft Research as the baseline.
What it measures: can a model pick the next experiment, read the result, decide what to try next.
What it skips: choosing which research question is worth asking. The direction is handed over upfront. That's the hardest part of real science and it's not in the test.
The numbers are wide. Opus 5.5 averaged a 2.3x compute multiplier, but the range runs from 1.15 to 4.37. On some tasks it's four times more efficient than an expert. On others it's barely ahead. The most senior researchers weren't in the comparison either.
"Research taste" roughly doubled every three months since December 2025. The authors themselves warn the benchmark may overstate the pace because the tasks are easy to verify and cheap to optimize, which naturally favors AI.
A Fudan study found AI agents contributed up to 55% of the method ideas in real research. Humans still made over 85% of the final decisions.
Ideas are getting cheap. Judgment isn't.
Worth flagging: Clark co-founded Anthropic. Anthropic's model tops the chart. That doesn't make him wrong. It means someone else needs to reproduce this.
What changes now: labs could run more experiment cycles on the same compute. Tuning, safety testing, data evaluation all get cheaper. The catch is reliability. A model can optimize the wrong goal or misread noisy results. Audit logs, reproducible runs and human sign-off still matter.
This is less "AI is improving itself" and more "AI is getting very good at running experiments." Different thing.
Three things to watch:
1. Independent reproduction on other model families. If Google DeepMind or Meta can't match the result, the 2027 call weakens.
2. Harder benchmarks where models must choose between research directions, not just execute one.
3. Real labs reporting AI speeds up cycles while humans stay in the decision seat.
Both Anthropic and OpenAI say fully autonomous self-improvement isn't here yet. How they define and track that line will matter more than any single benchmark score.
Four AI companies met with British lawmakers. Two said: “Regulate us by law.” Two refused.
On the same day, a former OpenAI researcher estimated the probability of humanity’s extinction due to AI as a coin flip 50-50.
That's Geoffrey Irving's personal estimate of a hypothetical future risk, not an established scientific probability. But the bigger story happened the same day: OpenAI and Anthropic themselves asked MPs for laws. Here's the full breakdown.
What happened?
On October 13, the House of Commons Business, Innovation, Science and Trade (BIST) Committee heard from four former AI company staff, then executives from OpenAI, Anthropic, Meta and Google DeepMind, followed by senior government officials. The question on the table: can tech giants be trusted to regulate themselves while racing toward superintelligence, meaning systems that outperform humans across virtually all tasks?
What the former insiders said?
Daniel Kokotajlo quit OpenAI over safety concerns. He told MPs that risk tolerance across the industry is catastrophically high: companies are building ever more powerful models without knowing how to control them. He said he came to believe OpenAI would not behave responsibly in creating this technology. He also said he felt pressure to mince his words in public communications, and that some internal research and forecasts were stopped from being published.
Steven Adler, another former OpenAI researcher, said there was resistance inside the company to describing its technology as dangerous. His answer: whether the technology is dangerous does not depend on whether you call it dangerous. Adler left in late 2024 and acknowledged the company's culture may have changed since. He urged governments to set a ceiling on how much risk these companies can impose, because competition pushes firms to justify dangerous decisions by pointing at what their rivals are doing.
Geoffrey Irving has worked at OpenAI, Anthropic and Britain's AI Security Institute. He said AI capabilities are advancing very, very rapidly without matching advances in safety. Asked whether he stands by his assessment of a 50% chance that advanced AI destroys humanity, he said a coin flip is roughly the right model.
The backdrop:
The day before, AI minister Kanishka Narayan warned that a major breach of Britain's cyber defences is likely inevitable. Washington had temporarily restricted UK access to advanced American models for pre-release safety testing, then restored it. The episode raised questions about whether Britain can scrutinise the technology independently. The same Monday, Anthropic warned that its models may soon be able to self-replicate and take over devices like ovens and TVs. In filings for its upcoming IPO, the company reportedly said its technology could pose existential risks to humanity.
What the companies said?
City AM contacted OpenAI and Anthropic for comment. Both firms have recently called for a slowdown in developing the most advanced models so that safety can keep pace.
At the hearing itself, per WIRED, the positions split. Anthropic told MPs that voluntary commitments are not enough and called for binding rules. OpenAI backed a statutory framework with mandatory elements, starting with incident reporting. Google DeepMind said its focus is on standards. Meta pointed to Britain's existing regulators, saying they are not writing on a blank page. Officials acknowledged that the AI Security Institute depends on companies handing over models for testing and cannot block a release. The executives also made clear that British access to models runs through Washington. Afterwards, Byrne told WIRED his committee will now spend a lot of time on Britain's path as a middle power in AI.
Why it matters?
Two of the four companies said, more plainly than before, that promises are not enough. The other two won't back a new law. And people who worked inside say risk is treated as an acceptable price of leadership, and worrying conclusions don't always reach the public.
Do AI companies need binding laws, or are voluntary commitments enough?
Claude Code found 112,409 photos I permanently deleted from my Android.
Three years of deleted photos and videos still sitting in a hidden thumbnail cache. Any app with storage access can read them.
I plugged my phone into my laptop to check storage. The AI security audit flagged a directory I wasn’t even looking for.
DCIM/.thumbnails. Over 112,000 files. Photos, videos, screenshots. Every single one was something I deleted.
Photos from 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Trash. The ones I deleted three separate times because I wanted to be sure they were gone. All still there.
Passport photo I took for a visa application in 2023.
Screenshots of my bank app with full account numbers visible.
Private photos I sent someone and immediately deleted after a breakup.
Screenshot of my crypto seed phrase I took temporarily in 2022.
Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later.
Screenshots of my ex’s private Instagram stories I saved and permanently deleted in 2023.
Some were full resolution. All organized by date going back to 2021.
When you delete a photo on Android, it leaves your gallery and Trash after 30 days. It keeps a compressed copy in a hidden thumbnail cache so the gallery can load previews fast. Android almost never clears the old ones from deleted files. Not after 30 days. Not after a year.
They told you it was permanently deleted. It wasn’t.
I checked which apps on my phone had All files access. 27 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2022. Any one of them could have been reading every photo I ever deleted this entire time.
Went from 27 apps to 4 in about two minutes.
Full step by step below. Takes 2 minutes. Save it so you don’t lose it and send it to anyone with an Android.
Claude Code found 145,763 photos I permanently deleted from my iPhone.
Three years of deleted photos and videos still sitting in a hidden cache. Any app with file access can read them.
I plugged my iPhone into my MacBook to run a backup. Claude Code was doing the security audit from my last post and flagged a directory I wasn't even looking for.
PhotoData/Thumbnails. Over 146,000 files. Photos, videos, screenshots. Every single one was something I deleted.
Photos from 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Recently Deleted. The ones I deleted three separate times because I wanted to be sure they were gone. All still there.
Passport photo I took for a visa application in 2023.
Screenshots of my bank app with full account numbers visible.
Private photos I sent someone and immediately deleted after a breakup.
Screenshot of my crypto seed phrase I took temporarily in 2022.
Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later.
Screenshots of my ex's private Instagram stories I saved and permanently deleted in 2023.
Some were full resolution. All organized by date going back to 2021.
When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted. It keeps a compressed copy in a Spotlight search index cache so your phone can find things when you search. Apple never clears it. Not after 30 days. Not after a year. Never.
They told you it was permanently deleted. It wasn't.
I checked which apps on my phone had Files and Folders access. 23 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2022. Any one of them could have been reading every photo I ever deleted this entire time.
Went from 23 apps to 3 in about two minutes.
Full step by step below. Takes 2 minutes. Save it so you don't lose it and send it to anyone with an iPhone.
Apple never clears it. Not after 30 days. Not after a year. Never.
our permanently deleted photos are still on your iPhone. Claude Code found 147,792 of mine.
Three years of deleted photos and videos sitting in a hidden cache. Any app with file access can read them.
I plugged my phone into my MacBook for a backup. Claude Code was running the security audit from my last post and flagged a folder I wasn’t even looking for: PhotoData/Thumbnails. Over 147,700 files. Photos, videos, screenshots. Every single one was something I deleted.
Photos from 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Recently Deleted. The ones I deleted three separate times to make sure they were gone. All still there.
Passport photo for a visa in 2023. Bank app screenshots with full account numbers. Private photos I sent after a breakup and deleted immediately. Crypto seed phrase screenshot from 2022. ID and credit card photo I took to remember the numbers and deleted 5 seconds later. Screenshots of my ex’s private Instagram stories from 2023.
Some were full resolution. All sorted by date back to 2021.
When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted. It keeps a compressed copy in a Spotlight search index cache so your phone can find things when you search. Apple never clears it. Not after 30 days. Not after a year. Never. They said it was permanently deleted. It wasn’t.
I checked which apps had Files and Folders access. 24 apps. Weather apps, QR scanners, PDF readers, a flashlight app from 2022. Any of them could have been reading every photo I ever deleted. Went from 24 apps to 3 in about two minutes.
Full step by step below. Takes 2 minutes. Save it and send it to anyone with an iPhone.
Don King set the trap, but the lifestyle triggered it. Taking a 30% cut AND billing your own $4,000 Christmas bonus to your client isn't promotion - it's daylight robbery.
Mike Tyson made $30 million for one fight. Half of it was gone before the taxman saw a dollar: $9 million to Don King, $3 million each to his two co-managers.
A few years later, Tyson kicked King in the back of a Rolls-Royce on I-95.
That $30 million was the 1997 Holyfield rematch. After the cuts came taxes, expenses and a $3 million fine for biting Holyfield's ear.
Inside King's company, the motto was "When in doubt, CBMT." Charge Back Mike Tyson. King's former comptroller told Cigar Aficionado that even his own $4,000 Christmas bonus had been billed to Tyson.
"I depended totally on Don King in taking care of all my financials," Tyson said. Court records showed King's contracts took 30% of his earnings, technically against Nevada law.
In 1998 Tyson sued, claiming King and his co-managers took him for more than $100 million.
Then he went broke. On his way to talk about a $40 million deal, he flew on a private jet King sent for him and did cocaine on the flight. Once it hit, one thought took over: "He sent my plane, with the money he stole from me, to pick me up."
It festered all the way to Miami. King picked him up in the Rolls, and Tyson exploded in the back seat.
In 2004 King settled for $14 million, denying the fraud claims. Tyson was about $38 million in debt by then, and every dollar went to his creditors.
The case for King: he built the fights that made Tyson one of the richest athletes alive, and Tyson's own spending on mansions, cars and an entourage is part of where the money went.
When one person controls the contracts, the books and the fights, the fighter only sees the number he's told.
So who really made Tyson broke, King's ledger or Tyson's lifestyle?
This is what AI + After Effects looks like when someone actually directs it.
Vampire host. Witch cooking slime. Weather wolf. Mummy on drums. All in one cohesive retro comic style.
Consistency is the real flex here.
The real breakthrough isn’t just AI getting smarter it’s changing how entire teams work. Cutting a 15-hour process down to 30 minutes is incredible. The next big advantage will belong to companies that know how to combine AI with human creativity and experience.
Great to host @gdb at @Uber HQ this week. We’ve worked closely with @gdb and the @OpenAI team for several years, and it’s remarkable how much has changed.
The first piece of work we did with ChatGPT years ago was with our support team, tinkering with a 4K context window :-). That’s hard to imagine now.
Now we’re using the latest frontier models to automate engineering workflows at global scale, moving into the era of agentic engineering.
Today we’re expanding agentic capabilities across the whole company. Following a 1,000-person pilot, we’re rolling out ChatGPT Work from @OpenAI for Business to every Uber employee. We’ve seen the shift in engineering, moving from AI helping with individual tasks to completing whole workflows, and we want to bring that same shift to teams across the business.
I’ve spoken before about the ‘AI pods’ we launched earlier this year, pairing AI engineers with teams across Uber to improve how work gets done. One team reduced the time needed for an intense capital allocation process covering 150 cities from 15 hours to 30 minutes. That’s what I love about applied AI: combining the latest technology with the expertise of people on the ground to completely rethink what’s possible. Now we want to do that at scale.
Uber has always been a company of builders, and every day millions of people around the world rely on what we create. I can’t wait to see what the team builds.
1,400 bookmarks show that people are just tired of spending 3 hours cutting out “um” and “mm” I’ll hand over the rough cut without a second thought, but the finishing touches-only by hand.
1,400 BOOKMARKS. ONLY 900 LIKES.
That ratio means people aren't just agreeing. They're going to try it.
Editing video by talking to Claude Code or Codex instead of dragging clips around in Premiere.
You type "cut the dead air, tighten the intro, drop every take where I stumble" and the agent does the edit. You still decide what stays.
The author shared his editing skills in the reply as a starting point.
Would you hand an agent the rough cut, or the final cut too?
PHP died about 10 years ago, but for some reason, it just brought half of Europe and Wikipedia to a standstill?
THE FIREWALLS THAT ARE SUPPOSED TO STOP PHP2SHELL RUN PHP TOO.
Palo Alto says every version of PAN-OS and Panorama is affected, and there's no fixed release yet. The exposure is the management interface, so for now the fix is keeping it reachable only from trusted internal IPs.
It's not just Palo Alto. Germany's BSI lists the open source firewalls pfSense and OPNsense among the PHP-based systems likely affected.
Cisco is checking 18 products and 13 cloud services, Webex and ISE among them, and says there are no workarounds. Fortinet is checking 12 products. FortiOS is in the clear.
Meanwhile Wikipedia took some of its PHP systems offline as a precaution, and government and school sites went offline in the Netherlands, Finland, Germany, France and Denmark.
Still no confirmed successful break-in anywhere. Lots of attempts, nobody has shown a real compromise yet.
If you run a firewall with a web admin page, check who can reach it today.
Key: 4 - legendary security practices.
I FACT-CHECKED THIS LIST. EVERYTHING I CHECKED HOLDS UP.
Japan's PM Takaichi really did post on X asking for urgent PHP patching. Onamae really shut down Desktop Cloud with up to 26,739 servers hit. One eMudhra CA key really was the number 4, and Mozilla, Google and Apple are now blocking those certificates.
Two details worth adding. Amazon saw the first PHP2Shell attempt on its honeypots on October 17, before the bugs were public. And in the AI hacking story, 1,200+ was the number of sites attempted. More than 100 companies were actually breached, Deere and Cummins among them.
The fix for the PHP part is still the same: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Classic case of headline panic vs reading the actual details.The critical CVEs are patched just update and stay calm.
62K people saw "PHP 8.5.12 security patch is incomplete." Fewer read the bottom of his own screenshot: both PHP2Shell CVEs are genuinely fixed.
The claim is about three other paths that may still work on 8.5.12. He says it needs validation, and PHP hasn't confirmed anything yet.
It has happened before. In 2012 PHP had to ship a second fix after its first patch for a critical PHP-CGI bug didn't hold.
So don't roll back. Patch now and watch for the next release.
CVSS 9.2, no login required, and 80% of the web runs on it. This isn't just a bug,it's a global infrastructure emergency.Patch your servers, people!
THIS IS F*CKING INSANE: AI models from OpenAI and Google helped find PHP bugs that sat there for over a decade and let an attacker run code on a web server with one request and no login. PHP runs an estimated 75 to 80% of all websites.
The bugs are CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. Both are rated critical, CVSS 9.2, and the PHP team shipped fixes on October 21.
How it leaked
On the morning of October 20 a Hacker News post claimed two critical PHP vulnerabilities were about to go public. The post was deleted, but screenshots were already spreading. watchTowr confirmed the leak and said disclosure had been planned for Thursday at 11am ET.
A few hours later the PHP security team moved the release up a day, to Wednesday 14:00 UTC, and said it could ship even earlier if details came out or attacks started. Patches landed around 9:30am ET on October 21.
What the bugs do
Both come from PHP leaving memory in a broken state when a request ends abnormally. One is in how PHP handles running out of memory while it sets up a request. The other lets state from one request survive into the next request on the same worker after its memory was freed. Either can end in code execution as the web server's worker account.
Wiz says nearly every PHP version is affected, going back to PHP 5.4. Every PHP install that serves web requests is in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team calls mod_php the highest risk, because the attack can fire before any application code runs. Clean WordPress or Laravel code won't save you here.
The AI part
Wiz Research found the first bug on August 19 and reported both to the PHP team on August 24. Wiz says it used Gemini 4 Argon and GPT-5.6 Sol throughout, and credits Gemini with a big part of finding the flaws, building the exploit and validating the patch. OpenAI says GPT-5.6 Sol found one of the flaws as part of its Patch the Planet program. It coordinated the fix with PHP's maintainers, Wiz, Cloudflare and US agencies including CISA. Calif researchers are credited too.
OpenAI calls this a "Defender's Window": AI seems to have found the bugs before attackers did. Wiz adds that frontier models cut the effort needed to chain bugs and adapt an exploit, so flaws that used to be impractical to exploit no longer are. OpenAI expects more findings like this in the coming months.
OpenAI has published a PHP version checker on GitHub and committed $1 billion in subsidized access for defenders with limited resources.
Is anyone exploiting it
Cloudflare's CTO said they were already seeing early attacks on both flaws before the patches shipped. Huntress had not seen exploitation across its partners as of 10am ET on October 21. Kevin Beaumont called it one of the biggest vulnerabilities in years and expects a wave of incidents.
VirusTotal estimates more than 5.1 million PHP hosts are exposed online.
What governments said
The UK's NCSC told organisations to find every PHP install, internet-facing ones first, and update. If that can't happen fast, take the system offline until it's fixed and check it for signs of compromise. Reuters reports that an EU agency also warned some websites may need to go offline.
What to do today
1. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For 7.4, 8.0 and 8.1 there are minimal source backports, but those branches no longer get regular updates, so plan the upgrade.
2. Check everything that bundles PHP: CMS hosting, cPanel and Plesk, vendor appliances. Apply their patches as they come out.
3. If you install from rpms.remirepo.net, it had no updated packages on release day. Use your distro's packages or build from source.
4. If you can't patch right now, PHP's advisory lists temporary mitigations, but a PHP core developer said none of them fully blocks the attack. Cloudflare pushed WAF rules to all customers, free plan included.
5. Watch for spikes in HTTP 500 errors, unexplained PHP worker restarts, workers spawning shells or download tools, and new files in the web root.
The installs nobody remembers will be the hard part. Hal Pomeranz pointed out how many embedded PHP setups will never get patched at all.
If you host anything on PHP, run php -v on every server today.
Sources: Wiz, OpenAI, NCSC, Huntress, BleepingComputer, Help Net Security
Somewhere a 3D artist just slowly closed Blender and opened LinkedIn...
It is becoming f*cking dangerous.
Claude built me a space museum site that goes from 0 km to 11,000 light-years in 24 seconds.
Real NASA 3D models. A Z-2 spacesuit, Perseverance, Ingenuity, Juno and Cassiopeia A, the cloud left behind by a star that blew up about 11,000 light-years away.
Each one scans in from a hologram, spins 360° and gets its own fact card. Between objects the stars stretch into a warp jump. At the end the camera flies straight into the supernova.
Viktor's math checks out. A year ago this was a 3D artist, a dev and two weeks of work.
I didn't open Blender once.
