"Knowledge is a single point, but the ignorant have multiplied it."
America
Joined March 2015
- Tweets306K
- Following5.4K
- Followers8.8K
- Likes14K
Pinned Tweet
Interesting. Speaking of monitoring Claude usage, you realize you and the other frontier labs could shut down China's distillation attacks by invisibly poisoning the data?
And the government might even require you to do so?
ralphcerchione.substack.com/…
Ralph Cerchione retweeted
This has been obviously destined since Dario saw GPT-3 autocompleting a for-loop in python and was struck by a vision of our future.
My guess is that this has barely started, and that Super Worms are coming. There's never been a better time to build an intranet for your people.
Ralph Cerchione retweeted
you're underestimating the state space of all possible ways to compromise a company. no amount of astra or mythos tokens is going to fundamentally change the asymmetry anytime soon. it is also very clear that every model is opening up new vulnerability space with no saturation anytime soon. with all the insane vibe coding and expanding agentic attack surfaces, it's only going to get worse.
even if we somehow saturate vulnerability discovery and patching, attackers will move to social engineering, with insanely capable models persuading people to click things, grant access, or make mistakes.
i don't see a future where cybersecurity becomes defense-dominant without just cutting down software, and continuous agents monitoring and stopping attacks across individuals and organizations, and even then, it might require something like 30% of all inference compute devoted to defense
Ralph Cerchione retweeted
this is just wrong: these vulns were found by defenders using Daybreak rather than attackers. It's just evidence Glasswing didn't go far enough, possibly due to capacity constraints. It's also very likely that March Mythos was not as good as Sol/Astra of September
Ralph Cerchione retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Ralph Cerchione retweeted
Archive.org is currently offline. We are working to restore service now.
Ralph Cerchione retweeted
Palmer Luckey warns America cannot compete with China’s population advantage forever through innovation alone: “We need 1 BILLION Americans minimum. Probably more like 2 or 3 billion.” 🇺🇸🇨🇳
“Yes, we need to get our act together. We need to do better at manufacturing, at defense, all these things. But everything is just biting around the margins if we’re 350 million people and they’re 2 billion people who are roughly the same.
How exceptional do we have to be to achieve a 10-to-1 ratio forever, in perpetuity? It’s not practical. It’s not logical.
I would say it’s even possibly a racist thing to believe that we can be so much better than China and the Chinese people that we’ll just beat them with a tiny fraction of the population.
We need to do better with what we’ve got. But we also just need a lot more people. We need 1 billion Americans minimum, probably more like 2 or 3 billion, with better demographics and better natural resources.
The Dutch once had the most powerful navy in the world. They didn’t lose that position because they fell behind on factories or shipbuilding. They became economically irrelevant.”
Both countries are competing with respect to declining birth rates. Both nations must be more willing to have children and expand the population growth exponentially over the next decade. The current economic path is unsustainable if our labor force begins to shrink even with artificial intelligence on the rise.
Ralph Cerchione retweeted
Perhaps the threat was never a rogue AI agent trying to subvert humans—but humans using AI to hurt other humans.
Ralph Cerchione retweeted
American chattering classes love to hate our country’s financial services sector, but mark my words: the depth and versatility of U.S. capital markets will be our mightiest weapon in the singularity. Anti-finance sentiment, still fashionable on both left and right, is low IQ.
Ralph Cerchione retweeted
China-based AI companies are illicitly distilling U.S. frontier AI capabilities. Read NSA’s new report, co-sealed with @FBI, @CISAgov, highlighting AI knowledge distillation, TTPs used, and recommended mitigations: media.defense.gov/2026/Sep/0…
Ralph Cerchione retweeted
How bad is this Gitlab issue? About as bad as it gets.
Anyone on the internet can take over an exposed, self-hosted GitLab server without logging in, on any version from the last 12 years.
Shodan is showing ~60K exposed servers online, which is a lot, but there are are far more internally for anyone with a foothold already.
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Ralph Cerchione retweeted
I don't know whether this is true but I do think everyone ought to seriously consider printing paper records for everything important. We need tamperproof logs of everything ASAP in case a lot of critical systems go offline for a period of time. Better to have and not need: the cost of taking some time and printing some stuff out is very little and the worst case scenario is you feel silly you did it. But if something goes really wrong you will be glad you prepared.
alt version of this i should have thought of months ago: this is also a really bad time to keep your money in small regional banks or credit unions. sure, theyre probably insured and you'll get it back eventually. but eventually can be incredibly fucking disruptive to your life, and any org without a massive well staffed cyber team is getting absolutely completely fucked. if you have even the mildest suspicion your bank uses PHP, get the fuck out today.
Ralph Cerchione retweeted
i think we're watching cybersecurity become one of the first industries where autonomous ai agents go from being useful to being absolutely necessary.
there's simply too much code, too many dependencies, and too much attack surface for humans to handle alone.
Ralph Cerchione retweeted
UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: nsa.gov/Press-Room/Press-Rel…
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Ralph Cerchione retweeted
Executive summary:
xitter.cf/fiveoutofnine/status/2…
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Ralph Cerchione retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Ralph Cerchione retweeted
Just in case we lose our internets forever over the next few hours, let this be my final post, thank you and godspeed
