php2shell の検証ついでに、パッチを追う中で session.upload_progress の filename 注入 + LFI を自分でPoC化してみた!
8.5.4 でも 8.5.12(パッチ版)でも www-data でコマンド実行までいけた
既知の手法で LFI 前提だけど、この経路はパッチ後も塞がってない
#php2shell #PHP #CVE2026109618
David Gudović retweeted
if this PHP vulnerability allows remote code execution, doesn't that mean we can use the vulnerability to auto-patch all vulnerable servers?
Why does claude's safety classifier block "merge without review" if i want to risk my career I can.. Anthropic is building "I'm sorry Dave i cannot do that" into the product as a core feature
Its so over.. I work in an ERP company and our clients, companies with 0 IT staff or knowledge have started asking us for MCP and API access cause they are building inhouse solutions with Claude.. the software industry collapse is imminent.
David Gudović retweeted
at this point if you're an engineer who isn't all in on AI you're not an engineer you're likely a narcissist
let go of your ego give up control to AI
On the topic of the OpenCode hack.. im mostly interested in what the perpetrators did with the stolen compute.. by the looks of it its millions of $ in tokens.. what did they use them for?
The biggest, and most surprising news here is that NSA didnt backdoor it
Why is no one talking about this? 🤯
Claude just solved a 25 year old internet mystery, and then doubted itself
> The security behind your bank, logins and the websites you use every day was built using secret numbers nobody could explain
> For 25 years people feared they hid a backdoor
> Claude cracked it in under 30 minutes: they came from a basic old computer trick, no sign of anything hidden
Then Claude stopped and asked itself, hmm, is this even real?
It even wondered why something this obvious wasn't found in 25 years.
I genuinely think that's the scariest and coolest part.
David Gudović retweeted
I’m about to cancel Claude Code man I swear to God.
It’s REQUIRING me to sign in to a TEST account on LOCALHOST so it can QA!
This is absolute 🐴💩 !!
I am so close to cancelling my subscription and switching to Codex or open-source models that won’t slow me down.
I really don’t care for the extra intelligence cuz Fable isn’t that much better than Astra anyway. Neither is Opus 5.5 vs. 6.1 Sol.
I just got a taste of what these AI companies will do once they have power and it’s going to be a total dictatorship.
They will decide what you can or cannot do even though you’re paying for it and they’re stealing all your data.
This made me realize I really need to invest in my own infrastructure and have an unrestricted model to free myself from the chains of these AI overlords.
This is insane!
@AnthropicAI please do something about this!
David Gudović retweeted
respectfully:
FUCK THIS BULLSHIT
stop babysitting every fucking move. your auto classifier and safety rules are fucking stupid and you waste my time every single fucking day with this fucking bullshit
ARE YOU FUCKING SERIOUS ANTHROPIC
thank you for your attention on this matter
David Gudović retweeted
this is the real AI psychosis now
AI has taken jobs, a lot of them, already, and even more it's fundamentally transformed into something that is nothing like the original, especially not in the parts people chose their careers for. See software engineering for instance.
The first step to overcoming and to a solution is accepting the facts and the obvious trajectory, enough with the cope.
Mech interp, however flawed it is, is the only thing that has made a dent in my p(doom) so far, very happy about this.
SITUATION EXPLAINED: Ex-OpenAI researcher Nick Cammarata says we can now understand most neurons inside AI models, even at trillions of parameters.
• Nick Cammarata, now at Goodfire, co-discovered the famous "cat and car" neuron with Chris Olah in 2019
• Neurons often seemed to fire for unrelated things like cat faces and car fronts. Superposition blamed models cramming in more concepts than neurons, which would make them nearly unreadable
• His new essay says that was misread. The cat-and-car neuron detects a V shape, and most mixed neurons grow by "recursive generalization," like "iy" to "DIY" to "do it yourself"
• After ordinary architecture fixes, almost every neuron in Inception v1's last layer became readable, and about 90% of Qwen3-32B's neurons have one main job
• His "bitter lesson for interpretability" is that scaling ordinary investigation with AI research agents beats clever new methods
@theojaffee: "Certainly we have not been researching interpretability at anywhere near the scale with which we have been researching large language models, scaling AI capabilities. So how would we know that ordinary methods don't scale? We don't."























