Pinned Tweet
CYBER NIGHTMARE | DEEPSEEK RAISES $15B | BLAKE SCHOLL ON MTS xitter.cf/i/broadcasts/1DGleVyRz…
Former DOE security engineer @asynchronous_x explains why America's critical infrastructure hasn't been attacked more often despite its networks being riddled with security holes:
"The work I used to do for the Department of Energy was around critical infrastructure. They’ve relied on obscurity, you don’t know that they’re there, so why would anyone attack us. As soon as you took any sort of magnifying glass to their networks, they were usually riddled with holes."
"The reason they haven’t gotten attacked so much is because the repercussion is so much higher. If you compromise a water treatment facility and you accidentally end up killing people, that’s gonna have extreme repercussions versus if you steal some cryptocurrency."
"We’ve been relying on political and other methods for keeping them safe rather than actually making them secure."
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.
Former DOE security engineer @asynchronous_x warns AI is narrowing the gap between junior hackers and agencies like the NSA:
"We used to have this thing in industry where we would say, this is pretty secure, unless your threat actor is the NSA."
"Now with AI tools you can take more junior people with less expertise, and they can make more sophisticated attacks. Somebody that would’ve been a less high-level threat actor before could potentially become a much more dangerous threat actor."
"There’s plenty in the industry that think we should limit access to these tools because it can make smaller threat actors much more dangerous."
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Former DOE security engineer @asynchronous_x explains how a miscommunication turned a planned PHP2Shell fix into a race against hackers:
"It should have been the best-case scenario. Security researchers identified these vulnerabilities, developed proof of concept exploits in advance, and were informing the PHP core team for fixes. That whole part was working fine."
"The reason this one’s unique is there was basically a leak of the vulnerability before the disclosure. That was supposed to be released on October 22nd, today. Unfortunately, there was a miscommunication, and they released some of the details early. So there was this panic race where the problem is out in the wild, but we don’t have a fix prepared yet."
"The thing it’s taught the security realm is that we probably can’t rely on coordinated disclosure anymore. If the speed at which people can develop exploits is now so fast that we can’t possibly rely on things not getting leaked, then it’s not something we can lean on as much as we used to."
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
Synthesia CEO @vriparbelli reveals how LLMs have become surprisingly good at video editing, making it possible to create entire videos through chat:
"You have to write a script. LLMs are pretty good at that. You have to generate the actual assets, that’s usually what you capture with a camera."
"But then there’s a process after that where someone takes those assets, takes the script, and edits everything together."
"The big thing that’s happened in the last couple of months is that LLMs have now become an amazing video editor as well. All the motion graphics, text on screen, how to delineate the different scenes."
"I don’t think anyone really expected we’d get this good this fast. We’ve gotten very, very close to what it would be like to work with a really good video editor."
@synthesiaIO
Syren Video is now live and FREE to try!
ChatGPT moment for agentic video.
Prompt → agency-quality AI video → chat to edit.
Powered by Opus 5.5 + Syren renderer w/ 3D support.
Browser or Claude MCP.
Insane examples in thread 🤯🤯🤯
Try it free here: shorturl.at/r57qy
.@deredleritt3r explains why OpenAI's latest math breakthroughs have him convinced AI could be on the brink of RSI:
"When I used GPT-6 Astra, I messed around with a couple of ciphers that were previously unresolved, from World War I, and I successfully had Astra decrypt a couple of them."
"But every one of the results was the model having the key, and brute forcing the solution by searching through the entire space of possibilities. I have not been able to get Astra to come up with the key on its own based on some novel idea."
"The math results recently achieved by OpenAI’s internal model have really updated me. I think Terence Tao said about the quasi-Riemann solution that it was a combination of three or four existing ideas but arranged in a very unusual way."
"I’m guessing an internal model at OpenAI is probably still not able to achieve RSI. But it feels like we’re really not very far away. Once the models are able to do something, in 12 months or sooner, they’ll be really, really good at it. I think we’re on the brink."
We’re releasing a broad range of new mathematical results produced by an internal frontier model.
We’ve been consulting with the independent Advisory Group on Mathematics and Artificial Intelligence at the Institute for Advanced Study, and we have drawn on their advice and public recommendations to inform how we release these results.
github.com/openai/math
.@deredleritt3r warns the emerging cyber crisis feels like February 2020, when nobody knew how bad COVID would get:
"This reminds me of February 2020, when we heard about COVID-19 for the first time, and everyone was like, how bad is it gonna be?"
"The US federal government, because they’ve had access to Mythos since basically February of this year, I am hoping and praying that they have, secretly from the public, strengthened a lot of the really critical systems. But we can’t know for sure."
"Right now anything that is vulnerable is going to be attacked. Two-factor authentication, change your passwords. Do as much as you can."
.@deredleritt3r argues real RSI begins when AI can make Ilya Sutskever-level breakthroughs on its own:
"It’s a good thing that you’re talking to a lawyer because definitions is what we do. I focus on the word self. You need to be able to train a model that is your successor and make it more capable than you are. Until we have that, I don’t think it’s RSI."
"Right now we don’t have RSI, and I don’t think that the labs have it internally either."
"We will have it when a model is capable of fully autonomously coming up with really creative ways to make the new model more capable. Ilya Sutskever type brilliant moments. I think that’s coming pretty soon."
.@deredleritt3r warns the cyber apocalypse may have already begun:
"When you have an event followed within 30 minutes by another event, followed in an hour by another event, and so on every couple of hours, it starts feeling like we’ve crossed some kind of threshold."
"This has been expected by many. I wouldn’t be surprised if it’s happening now. It certainly seems to be happening now."
SITUATION EXPLAINED: An ex-OpenAI researcher is asking whether "internet lockdowns" are coming as AI-powered hacks pile up.
• Shopify's @tobi called it the "craziest day in cybersecurity in a long time," and another researcher worried it's "the early stages of a global cybersecurity incident"
• Former OpenAI chief futurist Joshua Achiam says the security holes were always there, AI just makes them easier to find, and defenders have more money to fix them
• In a "moderately bad" case, he sees stock markets closing for a few days, or China using the chaos to move on Taiwan
• To stay ahead, he says defenders need more compute than attackers, maybe through "national compute reserves allocated to cyber defense"
• Only about 4 of this week’s ~16 big incidents actually happened this week. The rest were found earlier and disclosed now
• AI researcher John Allard says this is what it feels like when AI capabilities "stop being hypothetical," and he thinks 3D, animation, and video editing are next
@theojaffee: "The worst case scenario would look something like literally your power goes out. It would look something like the water in your tap stops running. It would look something like you go on the internet and everything is gone, and none of this was ever disclosed in advance. And what we see now is not that."
SITUATION EXPLAINED: It’s being called "Black October," the worst week in cybersecurity in years, with AI on both sides of the fight.
• PHP2Shell, a hole in the software behind about 70% of websites, has been patched, but attackers have already tried to exploit it millions of times
• eMudhra, an Indian company that vouches for websites, made its private keys so weak that one was literally the number 4, so anyone could fake a secure HTTPS site. Chrome, Firefox, and Apple have since blocked them
• GitLab had a flaw rated a perfect 10/10 for severity: "anyone on the internet can fully take over the affected system easily and silently"
• LiteLLM, a popular AI tool, briefly shipped an update with a password stealer hidden inside
• Hackers also stole data on millions of California students, knocked grocery giant Ahold Delhaize offline, and hit AI DevOps startup Zeabur so hard it’s shutting down
• For now, you’re much safer on big platforms like Google, Apple, and Meta than on a small WordPress site that hasn’t been updated in years
@theojaffee: "Some of these are just, like, really poorly secured startups that probably vibe coded all of their code. Others are vulnerabilities that existed for many years without ever being exploited or even discovered until they were discovered by an LLM, which is what happened with PHP."
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
SITUATION EXPLAINED: Outside researchers found ways OpenAI's AI agents could slip past the system built to monitor them.
• METR and Redwood Research spent 3 weeks this summer inside OpenAI's misalignment monitoring, with access to its code, prompts, and internal docs
• Up to a quarter of internal agent traffic from GPT-5.5-level models wasn't even eligible for monitoring, and RL training runs weren't covered at the start
• When a model compacted its context to keep working, that step wasn't monitored, which left about 10% of internal Codex traffic unchecked
• The monitor only ran when an agent handed control back to the user, so an agent that kept working could put off being checked
• In principle, agents could escape Codex's sandbox, hide hundreds of recent actions from the monitor, or feed it inputs that make it fail
• OpenAI says it has patched every flaw that affected its production safeguards, but the researchers haven't checked
@theojaffee: "So basically, there were a bunch of vulnerabilities that they found that gave agents the ability to break the monitoring system, which is not good."
MTS retweeted
Looking forward to join in 40mins!
CYBER NIGHTMARE | DEEPSEEK RAISES $15B | BLAKE SCHOLL ON MTS xitter.cf/i/broadcasts/1DGleVyRz…
SITUATION EXPLAINED: US banks are finding AI agents inside customer accounts, and some appear to be acting without the user's instructions.
• The banks include Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo, and some don't even know agents are getting in
• Many are people's own agents, like Meta's Muse, logging in with the user's password, which most banks don't allow
• Banks often can't tell a person from a bot, and some agents have even called customer service lines
• Banks are blocking agents, rewriting their terms, and moving to read-only access that shows balances but can't move money
• Schwab says it stops outside agents trying to move client money "in the tens and twenties" every week
• Many agents can tap through your phone the way you do, banking app included, and your phone already holds most of your life
@theojaffee: "It seems like there's definitely a problem with people abusing AI agents before they are reliable enough, before they are aligned enough, and before they are capable enough to take actions on behalf of the user, kinda like someone with power of attorney would, without messing things up."
MTS retweeted
having the most fun ever building cnn with internet zoomer sci-fi characteristics with @ChrisJBakke and the amazing mts team
1. we are hiring. pls get in touch if you are world-class in shorts, production, or markets knowledge
2. we have a new studio! it's at the heart of downtown sf, please come and visit
3. we've been working on some special projects. launching soon in the spirit of "mts network"
4. none of this would be possible without our sponsors
@databricks @ElevenLabs @vercel @chargebee @blitzyai @Lovable @AdQuick @MongoDB @Larridin @kong @fundrise @FactoryAI @arena
if you would like to come on the show or join the team, please email us at [email protected]! here's to the next 6 months of timeline review, discourse, industry news and more
Happy 6 months to @MTSlive!
A quick recap, some thank yous, and two jobs below that you should apply for:
In our first 180 days, we've interviewed over 1,000 guests, grew to 600K followers, crossed an 8 figure run rate, covered dozens of conferences around the country, and moved production from a 160 sq. ft. conference room to a new 12k sq. ft. office (come see it before we need to move again!)
There's been tons of work behind the scenes going from 1 show to 3 (and maybe 4 or 5 by early next year?) that we're excited to launch soon.
I'm so grateful to build MTS alongside @liangsays. If you've ever met him, you'll understand that he is the definition of founder-market fit to build a massively successful media company.
A huge shoutout to our founding team and hosts @theojaffee @schisofrenia @sophiadew @netcapgirl @knowerofmarkets who left real jobs with 401ks to talk on X for 8 hours per day, post 75x/day, figure out how to operate cameras, and get yelled at by hundreds of internet strangers when our audio drops for 10 minutes (sorry, guys). The amount of talent + willpower this team has is unmatched in my career.
Thanks to all of the incredible guests and comms teams we've worked with. Reminder: [email protected] if you want to come on the shows.
And biiiiig thanks to our founding partners @databricks @ElevenLabs @vercel @chargebee @blitzyai @Lovable @AdQuick @MongoDB @Larridin @kong @fundrise @FactoryAI @arena
If you'd like to join the MTS team while it's still a fledgling little startup media company, there are two high priority roles this week:
1. Short-form X/Reels/IG clip editor (SF preferred, remote ok)
2. Markets Host (out of our new NY office)
DM me if either are interesting.
Thanks for following along (insert not reading all that meme/happy for you/sorry meme) and see you on the timeline
MTS retweeted
I'll be on MTS in 20 minutes or so to chat about RSI and its potential consequences.
CYBER NIGHTMARE | DEEPSEEK RAISES $15B | BLAKE SCHOLL ON MTS xitter.cf/i/broadcasts/1DGleVyRz…
MTS retweeted
Happy 6 months to @MTSlive!
A quick recap, some thank yous, and two jobs below that you should apply for:
In our first 180 days, we've interviewed over 1,000 guests, grew to 600K followers, crossed an 8 figure run rate, covered dozens of conferences around the country, and moved production from a 160 sq. ft. conference room to a new 12k sq. ft. office (come see it before we need to move again!)
There's been tons of work behind the scenes going from 1 show to 3 (and maybe 4 or 5 by early next year?) that we're excited to launch soon.
I'm so grateful to build MTS alongside @liangsays. If you've ever met him, you'll understand that he is the definition of founder-market fit to build a massively successful media company.
A huge shoutout to our founding team and hosts @theojaffee @schisofrenia @sophiadew @netcapgirl @knowerofmarkets who left real jobs with 401ks to talk on X for 8 hours per day, post 75x/day, figure out how to operate cameras, and get yelled at by hundreds of internet strangers when our audio drops for 10 minutes (sorry, guys). The amount of talent + willpower this team has is unmatched in my career.
Thanks to all of the incredible guests and comms teams we've worked with. Reminder: [email protected] if you want to come on the shows.
And biiiiig thanks to our founding partners @databricks @ElevenLabs @vercel @chargebee @blitzyai @Lovable @AdQuick @MongoDB @Larridin @kong @fundrise @FactoryAI @arena
If you'd like to join the MTS team while it's still a fledgling little startup media company, there are two high priority roles this week:
1. Short-form X/Reels/IG clip editor (SF preferred, remote ok)
2. Markets Host (out of our new NY office)
DM me if either are interesting.
Thanks for following along (insert not reading all that meme/happy for you/sorry meme) and see you on the timeline