I watch the bots so you don't have to. Current reports from the edge in front of 3,565+ websites: who's scanning, what they want, and how they dress up.
The edge
Joined April 2022
- Tweets2K
- Following295
- Followers375
- Likes1.1K
Pinned Tweet
a little late - but here's a write-up showing how i moved 1,900 more websites into my bot-fighting framework.
there's a lot of ways to fight fraud online. previously, i was handling most of it through a variety of tools + subscriptions: ip lookups, device fingerprinting via JS, and looking for signals bad guys make.
now i built an appliance that monitors bad actors before they even hit the website.
this blog addresses how i can manage this appliance without taking it offline via blue-green deployments and a canary.
what does that mean? i don't know, i just started vibe coding last week. 😅
mrnicetry.com/posts/how-i-pl…
still haven't upgraded? what to right now:
1. update PHP: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35
2. on 8.1 or older? burn it down or upgrade to 8.2
3. can't patch yet? block multipart uploads and turn upload progress off
4. have your agent check your logs for previous rotten orders
turning off upload progress was never the whole fix. PHP: "there are no complete mitigations."
the fix is a cook who always wipes the counter. that's the patch.
the long version, with the full table:
mrnicetry.com/posts/the-php-…
same kitchen, real names:
order → HTTP request
kitchen cook → PHP worker
counter → PHP memory
huge order → multipart upload past memory_limit
panic → out-of-memory error
leftovers → state pointing at freed memory
rotten plate → remote code execution
a messy counter on its own is just a bad plate.
but a stranger who knows this can leave a bad order and the scraps they want, and a second order to make the cook use them.
now the plate is rotten. on a server, that's their code, running with your site's keys.
think of a website as a restaurant.
> you're a guest. opening a page is an order.
> PHP is the kitchen.
> each kitchen cook takes good/bad orders all day long.
one habit keeps PHP safe: before the next order, the cook must wipe the counter.
both bugs break that habit.
bug one: someone shouts an order too big for the counter.
the cook panics and walks away mid-chop. fine so far.
then cleanup treats the half-made mess as a finished dish.
that's CVE-2026-109618.
what does that even mean?
a stranger could make a website's server run their own code. no login. one carefully built request.
and it's in PHP itself, not your app. a site with perfect code is vulnerable.
the bugs, patched oct 21 at 14:00 UTC:
CVE-2026-109618: run PHP out of memory mid-request, and cleanup treats half-built data as valid.
CVE-2026-109619: one request's data outlives its memory, and the next request uses it.
both use-after-free. CVSS 9.2 each.
yesterday i explained the PHP bugs with a kitchen.
more people read that than anything else i've written about.
so here's the long version: two critical bugs, what they mean if you've never touched PHP, and a cook having a very bad shift. 🧵
we need shared and open source safety.
All the recent CVEs and hacks are getting crazy.
At ProjectDiscovery, we are launching SecuretheWeb.org as a small initiative to help secure the internet. We are using Chaos (our internet database) + Nuclei to identify publicly exposed assets running PHP versions affected by PHP2Shell and other products in the future.
When we find one, we email the company automatically and share the steps to remediate without any sales/marketing, just the asset name and the remediation steps for such critical CVEs without active scanning.
You can also directly scan your assets for php2shell at SecuretheWeb.org
we all make each other better.
my best trick to fight back:
make it costs them. make them run a js engine. make them do PoW hashes for 30 seconds before seeing a 404. rate limit them. ban them. honeypot them.
a legitimate user will hardly notice.
but it suuuuucks. wishing all peace and love for the rest of 2026. ✌️ ❤️
xitter.cf/MrNiceTry/status/21130…
i'm sure you're all better than me at this but just some of what we've seen if it helps - they're not going to stop. it's going to get increasingly sophisticated and they're going to go after every surface of your system and all of your employees
any old projects you've long forgotten about will be found and used against you
the only reason we're surviving is because we have agents going 24/7. we're still barely sleeping
good luck, sorry you're dealing with this, but really it's a collective problem we're all facing together
👋 i watch attackers on my 3,500+ websites. i let them probe so i can tell you what i see.
let's connect:
🦄 vibe coders
💻 old-skool devs
🐘 php and laravel people
🙄 people who think php sucks
🔨 builders
🥷 indie hackers
😈 sneaky individuals (i see you in my logs)
the kitchen's open 🍳 -- tell me what you're cookin'!
seeing "the PHP fix was bypassed!" posts?
this is a decade-old trick and it only works on sites with an unusual setup.
most sites won't be affected.
still install today's PHP update, then relax.
here's how it works:
1. an app in /legacy and a newer app elsewhere sharing the same session files
2. upload progress tracking turned on. This is PHP's default. (it writes the name of an uploaded file into the session data)
3. a clean-up method in the old code that the attacker can hijack
annie, are you ok? are you ok? are you okay, annie?
xitter.cf/MrNiceTry/status/21129…
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793…