Ex-interest rate/FX risk trader, Chrtrd Accountant, inv bank. Be fearful of tail-risk. Investor & discuss current affairs. Random interests.
Pale Blue Dot
Joined February 2021
- Tweets37.6K
- Following1.1K
- Followers719
- Likes13K
Pinned Tweet
Most people are rich (or poor) because they understand (or don't) one chart properly: compounding the same return on a larger number, provides a larger return or the same return in a much shorter time frame - get to 100k then don't interrupt it.
It's discipline and patience.
Geeks are getting animated about #php2shell but it's the lamest non-story of the year.
Upgrade your browser and PHP to the latest version, nerds.
Keep calm and carry on.
Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.
tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.
The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.
The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.
@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.
For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.
Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.
If you’re interested in learning more, you can read our blogs:
Vulnerable roots: blog.cloudflare.com/emudhra-…
PHP vulnerabilities: blog.cloudflare.com/php-vuln…
An Outlier From The Regression retweeted
Mark Zuckerberg says shopping is MUSE's biggest use case so far, with over a quarter of active users engaging in shopping and an average purchase size above $200.
$META had to ask Stripe to raise credit limits in the first week because volumes exceeded expectations.
"panic!!!" "Oh don't worry, we have a fix, aren't we great...." 🙄
If you are wondering whether your website is affected, we have packaged a Codex skill to help check.
Point your Codex at this repo to guide you through it: github.com/openai/php2shell-…
Community noted.
The main thing that has come out of Open AI and Anthropic so far is overexaggeration in their participation of things, and scaremongering.
They are like children screaming for attention.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
An Outlier From The Regression retweeted
As Thatcher said, the problem with socialism is that eventually they run out of other people’s money to take and they come for you
An Outlier From The Regression retweeted
$META Meta Q3 FY26:
• Daily active people +3% Y/Y to 3.64B.
• Ad impressions +10% Y/Y.
• Revenue +26% Y/Y to $64.6B ($1.1B beat).
• EPS $3.83 ($3.83 miss).
• $10B youth-safety legal charge.
• FY26 CapEx $135B to 145B (narrower).
Another psy-op on the supposed risk of PHP but websites don't contain info, the risk to access of a database or devices is near zero because they all use multi-factor authentication, which requires physical device access.
Jacob Coxon's besties are of course fanny the flames.
Exclusive: AI just found one of the most severe online bugs ever. It puts up to 70% of the world’s websites at risk. on.wsj.com/486iOWG
Most of the PHP affected websites very likely have no traffic and are not used.
The patches cover PHP 8.2 and newer, but the tail is long: in IPinfo’s scan last week, at least 502,180 addresses still showed PHP 5.4–7.3, affected per Wiz and with no fix coming. that’s nearly 4 in 10 of those that show a version.
xitter.cf/emot/status/2112933269…
Compute cost efficiency 10 fold....rack servers, new architecture and software improvements in one.
$META CFO Susan Li:
“Muse's compute intensity means that expanding its user base will require significant investment, and we expect total serving costs to rise.”
"At the same time, we expect to improve compute cost efficiency by more than 10-fold over the next year."
An Outlier From The Regression retweeted
In just the first 72 hours since Gemini 4 Argon launched, we processed ~25 trillion tokens, the demand for intelligence is incredible and still under appreciated!
Another psy-op on the supposed risk of PHP but websites don't contain info, the risk to access of a database or devices is near zero because they all use multi-factor authentication, which requires physical device access.
The MSM backers of Jabcob Coxon again.
BREAKING: Websites warned to install critical PHP software update or go offline
trib.al/7YksiQT
An Outlier From The Regression retweeted
1995: PHP is dead, learn ColdFusion
2002: PHP is dead, learn ASP.net
2003: PHP is dead, learn Django
2004: PHP is dead, learn Ruby on Rails
2010: PHP is dead, learn Flask
2011: PHP is dead, learn AngularJS
2016: PHP is dead, learn Next.js
2022: PHP is dead, learn Solidity
2026: The NSA is advising that you turn off PHP
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Total bullshit.
a critical vulnerability was just discovered in PHP. the language that runs 80% of the internet
severity score: 9.2 out of 10. that’s about as bad as it gets
what can an attacker do with this? take full admin control of a server. steal entire databases. passwords, credit cards, payment histories. plant malware and use the server to attack other systems
but here’s the terrifying part that most people missed
the moment the patch drops tonight attackers are expected to use AI to reverse engineer what was fixed within 15 minutes
15 minutes. that’s the window between the fix going live and automated attacks launching worldwide
every online store, booking site, and corporate system running PHP that doesn’t update in those 15 minutes becomes a target
this isn’t just a developer problem. if you’ve ever signed up to a website, entered your card details, or created an account online your data is sitting on servers that might be vulnerable right now
and someone just publicly dropped the working exploit on twitter before the patch was even ready. gave every attacker on earth a head start
engineers worldwide are pulling all-nighters tonight to patch their systems before the attacks begin
change your passwords on any service that matters to you. enable 2FA everywhere. and watch out for fake “maintenance” or “password reset” emails over the next few days
the internet is about to have a very long night
Another psy-op on the supposed risk of PHP but websites don't contain info, the risk to access of a database or devices is near zero because they all use multi-factor authentication, which requires physical device access.
No suprise who is driving the story....
Another psy-op on the supposed risk of PHP but websites don't contain info, the risk to access of a database or devices is near zero because they all use multi-factor authentication, which requires physical device access.
No suprise who is driving the story....
An Outlier From The Regression retweeted
Somewhere, a CTO just found out their servers still run PHP 5.6 💀
An Outlier From The Regression retweeted
Brad Gerstner on a potential Tesla-SpaceX merger:
"If I'm on the special committee of Tesla, I have a unique fiduciary duty because he's (Elon) involved with both companies, in order to make sure this is fair for Tesla shareholders. I think you'll see between $420 and $550/share. That's my best guess."
I tend to agree with Brad that a 30%+ premium does seem likely. Question is what the timing will be, etc. I don't think they'll want to drag their feet on this.
Strong Meta earnings.
Super Intelligence is full speed ahead.
