So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

看完特斯拉发布会Roadster原地起跳 再看比亚迪仰望U9的原地起跳。 瞬间觉得很搞笑🤦🏻‍♂️

完蛋了…..以后中国开源模型只能开源小参数的模型了…. 商务部科技部就修订《中国禁止出口限制出口技术目录》征求意见，为期一个月，涉及人工智能（大模型、智能体、算力集群、信息处理等23项）生物医药、光伏3个领域。 1️⃣限制出口AI大模型：超过10^26计算量、或2T参数、或公开评估排名全球前10的大模型。 2️⃣限制出口智能体Agent：工具调用与系统操作技术，支持集成的第三方工具数量≥200个，工具选择准确率≥90%，且在需要调用3种及以上工具协同完成任务场景中，端到端任务平均成功率≥90%；自主规划与任务分解技术，可将自然语言指令自动拆解≥20步可执行子任务链，子任务分解精度≥80%，且子任务平均成功率≥90%；标准博弈基准超过90%的人类的博弈决策技术；得分75%以上的AI辅助漏洞挖掘技术。 限制出口算力集群技术：片间互联技术、分布式训练容错技术、通信调度技术、异构集群高效推理与调度。 征求意见期间，出口相关技术需向商务部填报登记表。已通过开源、发表学术论文等方式进入公共领域的技术，不纳入管理范围。 （中国商务部） 目前看来@Kimi_Moonshot 的K4、@MiniMax_AI 的M3 Pro、@Zai_org 的GLM5以及@deepseek_ai 的下一代模型都没法开源了….. 而且相关架构、训练优化和推理加速技术也都不行了。

That was the most insane product demo I’ve ever seen. Well done Tesla!

JUST IN: Mistral CEO Arthur Mensch says the company is "a few months away" from catching up to frontier labs, per Le Parisien.

I discovered that 1000s of bots are actively monitoring X for new links posted, probably not just on my account I noticed when everytime I'd share one of my sites new features or pages, the page would get a bit slower just after posting, then I asked Claude to analyze it I tweeted a test URL as a reply somewhere deeply hidden in a thread (so not even a main post) And within 8 seconds there's thousands of crawlers opening the page! One is a military intelligence firm, that scans social media for breaking news and sells alerts to newsrooms, banks, companies and government, it specifically follows accounts with many followers Another one is a social media monitoring company that tracks what people say online I knew of course high frequency trading firms use online news to trade fast on things, but interesting to see it in real life Twitterbot (X) of course is first, within 0 seconds of sharing, it opens it (probably when I wrote the tweet) The first non-X bot arrives just 8.40s later, which I think is pretty fast considering it's a reply by me deeply hidden in a thread somewhere TL;DR they're watching you!

a while ago I made a bunch of unhinged requests to Amazon's shopping AI about things like "the best conceal carry holster for my dog" and I'm pleased to announce it's paid off

$300 for a bug that gives free access to OpenAI’s paid models with no API key or account. Zero reason to report anything else I find to them.

How abliterated models can get you pwned 👾 We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts. Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain. In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.

what the hell are they even spelling