@MrNiceTry
🇺🇸Account based in
About this account
- Account based in
- United States
- Connected via
- United States App Store
Account-level information from X, not a live location or the device used for a specific post.
I watch the bots so you don't have to. Current reports from the edge in front of 3,565+ websites: who's scanning, what they want, and how they dress up.
The edge
Joined April 2022
- Tweets2.1K
- Following299
- Followers404
- Likes1.2K
Pinned Tweet
opencode, railway, then php. a wild week for disclosures.
digging into the first two, something stood out.
years of logs: zero probes mentioning railway
but then in june 2026: one for railway.json.
september: 12 more varied requests.
finally oct 10… 🧵
when bro gets honeypotted on his way to the honeypot.
I took a closer look at the stealmybitcoin.com CTF, which aims to demonstrate that PHP2SHELL is not realistically exploitable. So I gave it a try.
Note: My analysis could be wrong, and I'm more than happy to be proven otherwise.
Here’s what I found:
• The server responds with Server: nginx and X-Powered-By: PHP/8.4.26.
• My differential fingerprinting scanner independently confirmed at least PHP 8.2+
• Hypotheses: I considered two possible setups:
◦ nginx → PHP-FPM
◦ nginx → Apache → PHP-FPM/mod_php
• After comparing the server's behavior against local test environments, the closest match appears to be nginx → PHP cli-server.
Plot twist: the response behavior is consistent with the PHP cli-server serving a static index.html rather than an index.php. If that's indeed the case, the challenge appears to be intentionally made unexploitable.
My conclusion (for now) is that I'm questioning whether this is a good-faith challenge.
Happy to be corrected if I've missed something!
infra is a you-thing.
security should not be outsourced.
Earlier this month I asked @dhh why he used Tailscale instead of building his own WireGuard mesh.
I have never used Tailscale precisely because I don't trust any infrastructure that I don't directly manage.
My WireGuard mesh is mine. All my devices connect to it. I can reach all my network without relying on Tailscale.
xitter.cf/0xCordeiro/status/2106…
i'm watch bad guys on 3,604 websites.
tell me your stack + toolchain 👇
i'll tell you what bad guys look for.
wordpress, laravel, next.js, rails, tools and infra, that thing you vibe coded last weekend...
what are some stacks i can look at?
this is an interesting perspective to what we are seeing in security.
basically suggesting we are the honeypot.
to see so much activity this month and the nothing burger that the php cve actually was makes a case to release neutered cve and see who does what. 🤔
i fight bots on my 3,604 websites.
i see weird stuff everyday.
if you are:
🦄 shipping vibe-coded apps
💻 a builder or indie hacker
🐘 running php or laravel
🍯 into honeypots
🏠 hosting your own stuff
let's connect!
tell me about weird web experience you've had.
1/3: i started seeing double-digit HTTP POST activity on october 10 from bad actors.
it peaked on october 18 @ nearly 20k requests/day.
on the 21st, i started tagging it and actively penalizing it. this isn't a common probe.
dig in with me. does this look like foreknowledge of the php cve? 🧵
3/3: the last 24 hours have been "spray and pray".
attacker is still pushing multiple php cve attack sequences, but iterating over multiple hosts.
Mr. Nice Try retweeted
🚨Update: PHP has flagged another potential RCE issue, CVE-2026-115560.
Advisory: qz.com/php-vulnerabilities-a…
The PHP2Shell patch wasn’t the end of the story. If you’re running PHP, check the latest advisory and mitigation.
One patch isn’t a substitute for staying updated.
Two critical PHP vulnerabilities. Both can lead to remote code execution without authentication.
And the patches are already out.
CVE-2026-109618 and CVE-2026-109619 affect PHP’s core memory and error handling.
Fixed versions:
• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
Don’t just check your server’s PHP version.
Check the runtime inside your Docker images and production containers too. Restart PHP workers after patching and verify the fix is loaded.
PHP 8.1 and older are no longer supported upstream, so upgrading needs extra attention.
Official details and fixes:
thephp.foundation/blog/2026/…
Have you checked which PHP version your production apps are actually running?
my favorite illustration of a buffer overflow.
> reminder: session.upload_progress.enabled = Off
did you do it yet?
🚨ALERT: PHP warns of ANOTHER UNPATCHED security flaw that could let hackers take control of vulnerable web servers, just TWO DAYS after releasing emergency fixes for critical PHP2Shell vulnerabilities.
The NEWLY discovered flaw, CVE-2026-115560, affects websites using an uncommon technical setup.
PHP has urged affected website administrators to disable a specific feature until a security fix is released.
The warning comes as hacking attempts targeting the TWO earlier PHP2Shell flaws have surged into the MILLIONS, per Cloudflare.
Where Things Stand:
- The latest flaw affects only an unusual combination of PHP session settings.
- No exploitation of the new vulnerability has been reported.
- PHP recommends disabling session upload progress until its next routine bugfix release.
Unlike the earlier critical flaws, PHP considers the new vulnerability an unlikely attack vector and is not issuing another emergency patch.
Mr. Nice Try retweeted
BREAKING: Critical PHP flaws, a compromised LiteLLM release and potentially exposed Railway secrets put production systems at risk.
Patch affected systems, rebuild compromised environments and revoke exposed credentials.
7 security issues and what to fix now:
it's october. cybersecurity awareness month.
so be proactive. close the doors before someone tries the handle.
attackers target those who don't look until its too late.
