There will be Pete Buttigieg tweets. "This sh*t was all I knew, you and me only, I did it all for you, still you were lonely"
Midwest 😘
Joined May 2020
- Tweets135K
- Following1.1K
- Followers1.3K
- Likes33K
🐝 Simora 🐝 retweeted
Perhaps the threat was never a rogue AI agent trying to subvert humans—but humans using AI to hurt other humans.
🐝 Simora 🐝 retweeted
Uh… guys?
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
🐝 Simora 🐝 retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
🐝 Simora 🐝 retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
🐝 Simora 🐝 retweeted
What this shows isn't how powerful AI is at finding bugs. It's how little systematic security review most codebases actually get.
The NSA just told companies to pull their websites offline if they can't patch them right away.
The reason is a bug that's been sitting in the code behind 70% of websites for 14 years. Last Friday a guy found it in one evening by typing five words into an AI.
Those five words were "find bad vulnerabilities in PHP." He's Dan Lorenc, CEO of a security company called Chainguard, and all he had going in was a rumor that something big was coming in PHP.
A small firm called Calif had already found the same flaw back on August 1 using OpenAI's GPT-5.6 Sol. Wiz, the security company Google bought, found it on its own less than three weeks later with Gemini and GPT. Since then OpenAI, Wiz, Calif and PHP's maintainers have been quietly building a fix that Lorenc himself called "crazy."
You'd think a bug this bad would've gotten caught sometime since 2012. PHP is open source, so anyone on earth could read this code. Wiz says turning the flaw into a working attack took a chain of steps right at the edge of what human researchers could realistically pull off. For 14 years the sheer amount of work was doing most of the protecting.
AI made that work cheap enough to knock out on a Friday night, for anyone who knows where to point it.
And the rumor got out. Bug ID numbers started floating around online Tuesday. Hours later one of the research teams posted a video of the exploit by mistake, and PHP moved its release up a day. Early Wednesday, Chainguard pushed its fix out more than six hours ahead of everyone else, saying people were already getting attacked, and Lorenc says his company's decoy servers caught IP addresses from China and Russia going after the flaw.
Here's why the NSA went straight to "unplug it." VirusTotal counted about 758,000 exposed servers running old PHP versions, 5.4 through 8.1, that don't get security updates anymore. Only around 272,000 are on versions that do. So for roughly three out of four servers that show their version number, there's no patch to install, and pulling the plug is the only fix they've got.
This is happening everywhere at once, too. Microsoft just fixed 1,413 vulnerabilities in a single month, more than in any full year on record. OpenAI says it expects finds like this one to jump sharply over the next few months.
Every company sitting on a secret bug now has until the first rumor leaks and somebody with an AI subscription goes looking.
🐝 Simora 🐝 retweeted
From StarTribune:
"After repeatedly explaining issues she disagrees with Gov. Tim Walz on, frustrated Sen. Amy Klobuchar pressed Speaker Lisa Demuth to say where she has broken with Donald Trump. Demuth said the war in Iran needs to end soon & she has taken issue with Trump’s trade war with Canada and foreign beef imports.
"That’s the best you can come up with?" Klobuchar shot back. “I literally can’t believe it. The war in Iran? You waited and waited and waited until those gas prices were up over $4 a gallon. … You literally said Kristi Noem showed steady leadership when 3,000 ICE agents descended onto the streets of our state..."
🐝 Simora 🐝 retweeted
I honestly can’t stop watching this and laughing. One of the funniest things I’ve ever seen
🐝 Simora 🐝 retweeted
Minnesota Senator Amy Klobuchar has supported Gov. Tim Walz, but says if she were in charge, there are some things she would have done differently.
Same right-wing trolls who condemn Amy for that attacked Kamala Harris for not saying she would have done anything differently from Biden.
#CantWin
🐝 Simora 🐝 retweeted
The NSA just told companies to pull their websites offline if they can't patch them right away.
The reason is a bug that's been sitting in the code behind 70% of websites for 14 years. Last Friday a guy found it in one evening by typing five words into an AI.
Those five words were "find bad vulnerabilities in PHP." He's Dan Lorenc, CEO of a security company called Chainguard, and all he had going in was a rumor that something big was coming in PHP.
A small firm called Calif had already found the same flaw back on August 1 using OpenAI's GPT-5.6 Sol. Wiz, the security company Google bought, found it on its own less than three weeks later with Gemini and GPT. Since then OpenAI, Wiz, Calif and PHP's maintainers have been quietly building a fix that Lorenc himself called "crazy."
You'd think a bug this bad would've gotten caught sometime since 2012. PHP is open source, so anyone on earth could read this code. Wiz says turning the flaw into a working attack took a chain of steps right at the edge of what human researchers could realistically pull off. For 14 years the sheer amount of work was doing most of the protecting.
AI made that work cheap enough to knock out on a Friday night, for anyone who knows where to point it.
And the rumor got out. Bug ID numbers started floating around online Tuesday. Hours later one of the research teams posted a video of the exploit by mistake, and PHP moved its release up a day. Early Wednesday, Chainguard pushed its fix out more than six hours ahead of everyone else, saying people were already getting attacked, and Lorenc says his company's decoy servers caught IP addresses from China and Russia going after the flaw.
Here's why the NSA went straight to "unplug it." VirusTotal counted about 758,000 exposed servers running old PHP versions, 5.4 through 8.1, that don't get security updates anymore. Only around 272,000 are on versions that do. So for roughly three out of four servers that show their version number, there's no patch to install, and pulling the plug is the only fix they've got.
This is happening everywhere at once, too. Microsoft just fixed 1,413 vulnerabilities in a single month, more than in any full year on record. OpenAI says it expects finds like this one to jump sharply over the next few months.
Every company sitting on a secret bug now has until the first rumor leaks and somebody with an AI subscription goes looking.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
🐝 Simora 🐝 retweeted
PollVault/Emerson poll | 10/12-10/14 LV
US House 2026 | Iowa’s 2nd congressional district
(Trump +10 | 2024)
🟦Lindsay James 50%
🟥Joe Mitchell 47%
——
US Senate Iowa 2026
🟦Josh Turek +4 (50-46)
—
Iowa Governor 2026
🟦Rob Sand +13 (54-41)
🐝 Simora 🐝 retweeted
Sad and infuriating. Especially knowing this is going to keep getting worse as more cuts take hold from the big beautiful bill.
🐝 Simora 🐝 retweeted
Marcia Blackburn is the Kay Ivey of Tennessee; she's there to be a puppet for the real power in the capital.
🐝 Simora 🐝 retweeted
Zero charisma. Total Pick Me energy.
Won't even make it to 3% in the presidential primary he's been obsessively running for for the past 2 years
I am a New Deal Democrat, not a Chuck Schumer Democrat.
I'm in Florida campaigning with @AngieNixon because we need a Democratic Party that is not beholden to the donor class. That means more Angie Nixons in this party and fewer Chuck Schumers to lead the way forward.
🐝 Simora 🐝 retweeted
PollVault/Emerson poll | 10/12-10/14
US House 2026 | Montana’s 1st congressional district
(Trump +11 | 2024)
🟦Sam Forstag 50%
🟥Aaron Flint 46%
🐝 Simora 🐝 retweeted
PollVault/Emerson poll | 10/12-10/14
US House 2026 | Michigan’s 7th congressional district
(Trump +1, Barrett +4)
🟦William Lawrence 53%
🟥Tom Barrett 45% (incumbent)
——
US Senate Michigan (MI-7)
🟦El-Sayed +11 (52-41)
—
Michigan Governor (MI-7)
🟦Benson +13 (53-40)
🐝 Simora 🐝 retweeted
You'd think a man's whose own mother sold him up river for a bottle of Vicodin would have a modicum of respect for another former child victim. But here we are!
