Solving problems you didn't know you had. ⬢ @InfinityBotList · @TryByteSend · @TryEmberly ⬢ Married to @CallMeAByte & @code ⬢ CEO @NodeByteLTD 🇬🇧
In my Igloo
Joined May 2018
- Tweets1.8K
- Following81
- Followers479
- Likes1.5K
I guess Hacktober isn’t over yet
‼️ Ubuntu and Red Hat still have no fix for a Linux kernel flaw that Anthropic says its unreleased AI model turned into a remote root exploit.
The bug, CVE-2026-98432, is a use-after-free in the IPv4 TCP handshake, rated 9.8 out of 10.
The exploit needs no credentials and targets servers with a multipath TCP listener, which Go 1.24 and later open by default.
The fix reached stable kernels on 11 October and Debian has shipped it. Ubuntu still marks every release from 16.04 to 26.10 vulnerable.
Red Hat now rates it Critical but has no patched kernel for RHEL 8, 9 or 10.
Anthropic has not released the exploit. By its count, it takes 48 minutes to leak a kernel pointer and five more to run commands as root.
🧑💻
@shufflebotlol is coming back thank you @CodeMeAPixel for the help with me not knowing how to get spotify stuff to work. ❤️🤣
And somehow this is how I spend most of my days 👀
Security update: Popplio 1.15.2 and Omniplex 1.8.1 fix four issues, including a webhook SSRF and a short-link open redirect.
omniplex.gg is already patched, so there's nothing you need to do. Self-hosting? Please update.
Details 👇
omniplex.gg/blog/security-up…
Pixel 🇨🇦 retweeted
🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild.
Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64.
Patch now → 22.23.4 / 24.22.1 / 26.12.1
Read ↓ thehackernews.com/2026/10/re…
Pixel 🇨🇦 retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
You can’t be serious, you’re the one that started this entire process and now you just sit back and act like staying in Canada was the plan all along…. Mad that you didn’t get what you wanted and the people told you to be a better government instead?
Thank you, Alberta!
I’m very pleased to see the initial results from Elections Alberta show widespread support for remaining in Canada. Albertans have voted for a stronger Alberta in a united Canada.
Thank you to all Albertans who took time to vote on these critically important referendum questions.
Tomorrow evening, October 20, I will address Albertans live at 6:45 p.m. to discuss the results of all referendum questions for which results are available, and where our province goes from here.
Pixel 🇨🇦 retweeted
Thank you, Alberta!
I’m very pleased to see the initial results from Elections Alberta show widespread support for remaining in Canada. Albertans have voted for a stronger Alberta in a united Canada.
Thank you to all Albertans who took time to vote on these critically important referendum questions.
Tomorrow evening, October 20, I will address Albertans live at 6:45 p.m. to discuss the results of all referendum questions for which results are available, and where our province goes from here.
Make sure you update Node too folks, PHP isn’t the only one having a bad week 🫡
🚨 High-severity Node.js flaw could allow remote code execution; CVE-2026-111497
Node.js has patched an out-of-bounds write vulnerability in its bundled Brotli decoder.
⠀
An attacker able to supply malicious Brotli-compressed data to an application could potentially corrupt memory and execute code on the underlying server.
⠀
Affected:
• Node.js 22.x
• Node.js 24.x
• Node.js 26.x
Fixed:
• Node.js 22.23.4
• Node.js 24.22.1
• Node.js 26.12.1
⠀
End-of-life Node.js versions may also be vulnerable and will not receive upstream security updates.
Administrators should upgrade and restart affected services.
Source:
nodejs.org/en/blog/vulnerabi…
Vercel putting in that work like always 💪
Did this man, really just say the forbidden words….. @connor200024 when I’m up all night tonight patching vulns I’m blaming you.
I have patched the NodeJS version for @TryByteSend following the latest vulnerabilities 🫡
Pixel 🇨🇦 retweeted
The PHP Foundation says Chainguard unilaterally broke the embargo and published built images containing the critical RCE fixes more than six hours early:
“This disregarded weeks of work by many parties toward a coordinated disclosure.”
socket.dev/blog/php-embargo-…
Pixel 🇨🇦 retweeted
⚠️ Vulnerability alert: php2shell
Unpatched sites running PHP 5.4 or later are at risk of remote code execution, data exposure, and crashes.
If your site’s web traffic is proxied through Cloudflare, we deployed protections before official public disclosure. Check the blog post to see which mitigations are enabled by default.
Even with these mitigations in place, update PHP as soon as possible to fix the underlying vulnerabilities.
xitter.gq/Cloudflare/status/2112…
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. cfl.re/488w8dc
Lmfao, and the findings continue. Now that the wave is started it probably ain’t gonna end anytime soon prepare to keep patching
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
Unvalidated AI output (author admits in replies: omp with glm5.3 + ds4), not a lab result. Its screenshot says both CVEs are fixed; the 'surviving paths' need unserialize() of attacker data or an app LFI. Patch per php.net: php.net/archive/2026.p…
Pixel 🇨🇦 retweeted
Archive.org is currently offline. We are working to restore service now.
Pixel 🇨🇦 retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Pixel 🇨🇦 retweeted
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
Unvalidated AI output (author admits in replies: omp with glm5.3 + ds4), not a lab result. Its screenshot says both CVEs are fixed; the 'surviving paths' need unserialize() of attacker data or an app LFI. Patch per php.net: php.net/archive/2026.p…