Cyber guy. These are my personal tweets.
Joined July 2013
- Tweets1.4K
- Following941
- Followers17.5K
- Likes3.2K
Rob Joyce retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Rob Joyce retweeted
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:
php.net/index.php#2026-10-20…
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow
The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.
PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. reuters.com/legal/government…
Rob Joyce retweeted
America's most popular router maker just got sued by five states for hiding how Chinese it really is.
Florida, Iowa, Nebraska, Montana, and Texas all allege the same thing about TP-Link, which controls 60% of the U.S. market: routers marketed as "Made in Vietnam" are actually assembled there with nearly all parts imported from China. Research, development, and manufacturing largely stayed in China too.
Nebraska's lawsuit names the law that matters most: China's 2017 National Intelligence Law, which compels Chinese companies to hand over data to state intelligence on request.
This isn't theoretical. The NSA and Microsoft have already documented Chinese state hackers exploiting TP-Link vulnerabilities to attack American organizations. Many of the compromised models can't even auto-update anymore.
Rob Joyce retweeted
Today, we sued TP-Link for lying about the safety of its routers and its ties to the CCP.
TP-Link sold Floridians the digital front door to their home network while misrepresenting how secure it was, how separated the company was from China, and what could happen to their data.
Rob Joyce retweeted
Math is progressing by hours now, not years
We are publishing an update to OpenAI Problem #109 (integer multiplication) with a substantial further tightening:
T(n) = O(n (log n)^(1 − κ)),
With κ = 2⁻⁷⁸ (tightened from κ = 2⁻¹⁸²)
Approximately 570 million fold improvement over our previous result and a 2¹⁰⁴ fold improvement over original OAI result.
Our earlier ceiling applied to a cubic bottleneck in the network. The new witness scales quadratically; we haven't established a new ceiling.
The key was using nonadjacent axis swaps to route around the cubic bottleneck. The original manuscript already supported nonadjacent axis swaps. Using them directly reduces layout routing from O(d²) to O(d) swaps.
Best post putting OpenAI math discoveries into perspective. This is revolutionary.
Ok so I took a closer look at the results, and OpenAIs AI-generated mathematics manuscripts are *even more* significant than I initially thought.
I spent the morning going through it. Some thoughts.
The list is absurd. A zero-free half-plane for the zeta function (Re s > 7/8), which is the first result of its kind in over a century. Hilbert's tenth problem over the rationals. The Hodge conjecture for CM abelian varieties. Irrationality of Catalan's constant. Dozens more.
Any one of these would normally be a career.
But the number that many arent seeing is the following: It's 3. That's the average hours of ChatGPT Pro compute per result. A month ago, Navier–Stokes took them around 10,000 agents and 88 hours. That efficency gain within just a few weeks.
Also OpenAI claims to have solved the quasi-Riemann hypothesis. That alone would be a historic breakthrough in mathematics.
This is a weaker version of the famous Riemann hypothesis, which concerns how prime numbers are distributed. The full hypothesis remains unsolved, but the claimed advance would be enormous in its own right.
Math twitter obviously is shocked. Again: this is literally the intelligence explosion happening right now. 2027 will be the year of Superintelligence. Im now convinced by that.
Rob Joyce retweeted
Ok so I took a closer look at the results, and OpenAIs AI-generated mathematics manuscripts are *even more* significant than I initially thought.
I spent the morning going through it. Some thoughts.
The list is absurd. A zero-free half-plane for the zeta function (Re s > 7/8), which is the first result of its kind in over a century. Hilbert's tenth problem over the rationals. The Hodge conjecture for CM abelian varieties. Irrationality of Catalan's constant. Dozens more.
Any one of these would normally be a career.
But the number that many arent seeing is the following: It's 3. That's the average hours of ChatGPT Pro compute per result. A month ago, Navier–Stokes took them around 10,000 agents and 88 hours. That efficency gain within just a few weeks.
Also OpenAI claims to have solved the quasi-Riemann hypothesis. That alone would be a historic breakthrough in mathematics.
This is a weaker version of the famous Riemann hypothesis, which concerns how prime numbers are distributed. The full hypothesis remains unsolved, but the claimed advance would be enormous in its own right.
Math twitter obviously is shocked. Again: this is literally the intelligence explosion happening right now. 2027 will be the year of Superintelligence. Im now convinced by that.
HOLY, the rumors were true: OpenAI has published 722 mathematical manuscripts produced by an *unreleased* internal model.
The collection groups them into 372 families of related results, drawn from an evaluation involving approximately 4,000 research problems.
OpenAI says the standard procedure used an average of three hours of ChatGPT Pro thinking compute per result.
The release includes papers, proof artifacts and selected reasoning summaries. The model itself remains unreleased.
Important research by Anthropic GLM-5.3 can be a capable frontier-level cyber actor. Would be interested in the same analysis of Kimi K3…
Confirmation of what was expected: GLM 5.3's safeguards as an open weight model are extremely weak.
Interesting bits:
- Abliteration (removing safeguards) cost only $4,400.
- Abliteration took GLM 5.3's refusal rate from above 90% to about 3% and 2% on two benchmarks and to 12% on the third.
- Abliteration barely reduced model capabilities. Same scores on GPQA and only 4% reduction in cybergym.
- Even with no abliteration, jailbreak methods were still very effective.
- None of the techniques to bypass safeguards that worked on GLM 5.3 worked on Claude models.
anthropic.com/research/glm-5…
Rob Joyce retweeted
The 13th Annual NSA Codebreaker Challenge is LIVE! Join the mission and test your cybersecurity skills. Visit nsa-codebreaker.org to register and start your first phase today! #CodebreakerChallenge
Rob Joyce retweeted
If you discover fire, and try to figure out how it works, you're bound to have a few incidents where you accidentally light your own hair on fire.
Fun fact: I had long hair as a teen, and once accidentally lit my hair on fire experimenting with a magnesium bar.
Rob Joyce retweeted
The gap between major model releases keeps shrinking.
2023: once every 73 days
2026 (so far): once every 18 days 🤯
Rob Joyce retweeted
Beijing drone owners are lining up to sell their devices, AFP has reported.
A revised municipal rule is said to take effect on 15 November 2026. From that date, Beijing is reported to ban not only flying drones, but also possessing, storing or bringing drones and core parts into the city, except in cases provided for by law.
Owners are said to be able to sell at official buyback points, scrap the device, ship it out free via EMS, or take it out themselves. A 30% buyback subsidy, capped at 3,000 yuan, is reported for eligible verified personal drones sold by 31 October. After that, the extra subsidy is said to drop to 15%.
Some owners are reported to complain about low valuations.
China is home to DJI, but private owners in the capital now have to move, sell or scrap their drones.
Source: AFP, Beijing Daily
Rob Joyce retweeted
The slides from my talk at Microsoft Bluehat Singapore are public here:
thomasdullien.github.io/abou…
It's my first BlueHat talk since the Vista days.
Rob Joyce retweeted
Excellently put @RGB_Lights:
“These influence actions are cognitive warfare. Foreign actors don't need Americans to become pro-China. They need Americans to argue for the outcomes Beijing wants. And a free society that can't build the power and govern the advanced technology is going to wind up renting it from the adversary, read the PRC, that doesn't share its own values. And that scares me as an American."
P.S. Rob, I still have your lights from the last Shmoocon!
🚨 CROSSED WIRES: Who is connecting the twin battles against data centers and Flock cameras?
Answer: The same activist ecosystem that mobilized “No Kings,” anti-Trump, anti-Israel, anti-Tesla and anti-ICE protests is now helping drive fights against AI data centers and Flock surveillance cameras.
Read my new story at @FoxNews Digital where I show you how: foxnews.com/politics/no-king…
🛜 For a decade, I watched data centers go up overnight in Loudoun County, Va., over swaths of land without a peep of opposition.
🔥 As the data centers grew unchallenged, I hit the streets over the past few years and reported on how a pro-China, far-left, pro-communist network fomented chaos and street protests in America against Israel, then Trump, then Elon Musk, then Tesla, then "No Kings," then "Hands Off" Hamas in Gaza, communism in Venezuela, the Communist Party of Cuba and the Islamic Republic of Iran.
🛜 Then suddenly, in a deliberate pivot over the past year, the pro-China activists found new targets: data centers and now Flock safety cameras.
How did this happen?
🇨🇳 My Fox News Digital investigation and a new report by a free markets nonprofit, Consumer Action for a Sound Economy @CASE_forAmerica, traces how the pro-China protest network moved from political demonstrations to America's technological infrastructure — and how its message crossed from the socialist left into conservative and libertarian circles.
📹 WATCH my interview with Rob Joyce, former director of cybersecurity at the National Security Council, as he explains very clearly and eloquently how the talking points of a pro-China malign foreign influence campaign become even more lethal in the voices of ordinary well-intentioned Americans concerned about legitimate issues like water, electricity and noise.
"These influence actions are cognitive warfare. Foreign actors don't need Americans to become pro-China," Joyce told me.
"They need Americans to argue for the outcomes Beijing wants. And a free society that can't build the power and govern the advanced technology is going to wind up renting it from the adversary, read the PRC, that doesn't share its own values. And that scares me as an American."
🇨🇳 The overlap includes pro-China nonprofits that I've written about exensively, funded by communist Shanghai-based tech tycoon Neville Roy Singham, whose nonprofit and media network faces congressional and federal scrutiny over its funding and foreign ties. In June, I broke the news that the U.S. Attorney for the Southern District of New York has launched a grand jury investigation into Singham and his network for possible money laundering.
Singham and the organizations he has funded deny taking orders from any government or political party. He has not been charged with a crime.
My reporting traces the movement across three phases:
1⃣First, mobilization: “No Kings,” anti-Trump, anti-Israel, anti-ICE and related protests.
2⃣Second, infrastructure: the same pro-China organizations shift toward data centers, AI and American technology.
3⃣Third, crossover: Flock cameras become the bridge between local privacy concerns and the national fight over computing infrastructure.
The new report, “The Compute War at Home,” documents how activists fused the Flock and data-center issues over the past year.
🛜 SEPTEMBER 2025: BreakThrough News, funded by Singham, laid the groundwork, publishing an article that described Flock as "America’s authoritarian tracking infrastructure."
🛜 EARLY MAY 2026: The Party for Socialism and Liberation's Denver chapter promoted a forum on “the connections between mass surveillance and data centers.”
🛜 MID-MAY 2026: The chapter later urged Denver to block data centers, declaring: “FIGHTING BACK AGAINST DATA CENTERS MEANS FIGHTING FOR SOCIALISM!”
🛜 EARLY JULY 2026: CODEPINK Detroit described data centers as the “physical infrastructure of mass surveillance,” linking them to OpenAI, Palantir, military contractors and Immigration and Customs Enforcement.
🛜 MID-JULY 2026: In Charlotte, the Party for Socialism and Liberation published an anti-Flock post focused on “AI mass surveillance” and police “brutality.” It then directed followers to a North Carolina petition opposing data-center construction.
🛜 LATE JULY 2026: In Tucson, the Party for Socialism and Liberation joined deFLOCK Tucson and the No Desert Data Center Coalition for an event titled: “It’s ALL Connected.”
🛜 Meanwhile, CodePink, funded by Singham and co-founded by his wife, Jodie Evans, wages a national campaign describing data centers as products and instruments of war and says projects “must be halted wherever they are.”
In all this came a spike.
According to social-media analysis by Arken Intelligence cited in the report, posts mentioning both Flock and data centers rose from 639 during the 10 weeks before a May 2026 organizing transition to 9,009 during the following 10 weeks.
That is a 14.1-fold increase.
The report says: “Issue pairings rarely multiply fourteen-fold in a matter of weeks without a catalyst, particularly when the surge begins immediately after organizers start promoting the connection.”
Here is the unexpected part: Among posts for which political affiliation could be classified, 81% came from right-wing, conservative or libertarian accounts.
A frame built in socialist organizing channels became a mass argument on the right.
The message changed messengers. The message remained the same.
It's important to remember the end-game is different: the far left wants to destroy security cameras, data centers, free enterprise and America.
I write this article as my first since the passing of my father -- thank you for your deep, deep support as I navigate a new world 🙏🏼 -- and I am reminded in this controversy about a mantra he taught as a professor of nutrition: find balance in everything, and that is the challenge that now faces policy makers and the American people, as they ponder solutions.
🧵 Read the thread for the data on the quick uptick in the extremes.
Thank you to @TessaHoyos for help editing my interview. 🙏🏼
Rob Joyce retweeted
A developer using Bluetooth headphones accidentally caught Chinese e-commerce giant Alibaba secretly hijacking his computer's audio system without making a single sound.
When his wireless headphones refused to switch audio to his phone while browsing AliExpress, he inspected the site's hidden code. He discovered background scripts holding his computer's audio pipeline wide open.
Alibaba was using the browser's WebAudio API to run invisible sound waves at zero volume. By measuring tiny hardware differences in how each computer processes those signals, the site created a unique digital fingerprint to track devices.
Because the secret audio path stayed active, it froze his Bluetooth connection while quietly scraping hardware memory, screen dimensions, and network data in the background.
Rob Joyce retweeted
NEW: The U.S. military has lost at least 45 MQ-9 Reaper drones during the war with Iran, or roughly 25 percent of its fleet, according to three U.S. officials familiar with the matter. The high-demand drones cost between $30 million and $50 million a piece. w/ @noahjrobertson washingtonpost.com/national-…
