@__alula

stupid rabbit, random thing fuckerer, ai slop connoisseur & unrepentant shitposter | she/her

alula.me
Joined May 2015
  • Tweets8.7K
  • Following1.2K
  • Followers4.7K
1.5KMedia
responsible disclosure is really dead bro github.com/php/php-src/issue…

Issues · php/php-src

The PHP Interpreter. Contribute to php/php-src development by creating an account on GitHub.

github.com
6
2
2
178
25,438
php 8.5.12 517e394ca1837bbd23f9541ccf6b1a40967e5d42596f8aae27d56a08216b1df5
3
5
79
13,028
nvm someone else found it independently sha256("there's an exploitable UAF in unserialize(), the destructors run after freeing which doesn't seem to be fixed yet at time of the tweet :)") not like you're supposed to use that with untrusted input so it's practically low-impact I guess? xitter.cf/Dinosn/status/21129623…
Nicolas Krassas
@Dinosn20h
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
The PHP 8.5.12 release fixes the two specific CVEs (via state/bailout changes) detailed in official advisories; referenced "surviving paths" (e.g. var_destroy UAF) are separate pre-existing unserialize issues unrelated to this patch. php.net/archive/2026.p… github.com/php/php-src/se… github.com/php/php-src/se… github.com/dinosn/php-8.5…
3
25
2,369
Alula retweeted
annie@_annieversary22h
chat. chat... its not funny anymore
m@ttias ⚡️
@mattiasgeniarOct 21
PHP Patch is out!! PHP 8.5.12: 31c0ea7d7f github.com/php/php-src/commi… PHP 8.4.27: 506e87fa7d github.com/php/php-src/commi… PHP 8.3.36: 3c832b523e github.com/php/php-src/commi… PHP 8.2.35: 01a40e89fb github.com/php/php-src/commi… The two advisories with the full details: GHSA-w8hw-w9fx-j79w (CVE-2026-109618) github.com/php/php-src/secur… GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) github.com/php/php-src/secur…

Avoid state corruption via bailout · php/php-src@31c0ea7

- Replace bailout on OOM with UnwindExit - Properly reset various globals that may be accessed during startup Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618) Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) C...

github.com
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability. fedi.katze.sh/@elise/1174793…
116
421
197
7,426
941,464
everyone clowns on it but security through obscurity sure made "4" last a while
24
79
7
3,694
41,019
ah yes bundled ebudhra CAs
Frank
@jedisct1Oct 21
Not just PHP: Node also announced security releases nodejs.org/en/blog/vulnerabi…
1
10
764
this happens on every message regarding anything with sim cards now, fuck anthropic
7
4
2
77
2,814
counter it by coding by hand and generating art with ai
Alphalaneous@AlphalaneousOct 19
Sad to see that a lot of this community, such as well known players and streamers are anti AI only when it affects their art but pro AI when it affects programmers.
1
28
1,047
Replying to @Other_Time_Trav @ReclaimTheNetHQ
Unlike the internet, a bouncer looks at your ID and hands it back Online, it stays in a database, and databases often leak What if the age could be verified without storing the ID anywhere?
2
1
16
579
god sure this is impressive but I'm surprised that the clankers never try to investigate stuff like this deeper, instead choosing stupid approaches MDP is really easy to configure and you can have a framebuffer with arbitrary size scaled in hardware just with a couple of register pokes...
Makr@makrotasussOct 18
Replying to @makrotasuss
Huge thanks to: github.com/dipa-studio/ios-s…

GitHub - dipa-studio/ios-sweet: iOS 16 userland + XNU on Redmi Note 10 Pro (sweet, SM7150)

iOS 16 userland + XNU on Redmi Note 10 Pro (sweet, SM7150) - dipa-studio/ios-sweet

github.com
1
1
35
3,485
Gemini 4 Argon may be disappointing but imho it's very good at writing code that you would be able to maintain without it... compared to whatever GPT 6.1 Sol outputs
46
21
6
1,199
67,334
github.com/discord/Telegram-… ????
70
17
3
1,570
152,130
you're all so gullible arxiv.org/pdf/2402.03239
Polaris 🔞ʕ； •`ᴥ•´ʔ@IFWBIGWOMENOct 16
My heart goes out to all the artists who deleted all of their work on twitter to get away from AI Training for now to have Bluesky embracing it.
14
75
13
837
118,599
Sure the intent was training classifiers. And this will sound very uncomfortable for most people on it, but it is still clear that they since beginning encouraging collecting the platform's content into datasets and training AI on it. And since datasets are out there, do you really think those who want to train generative AI models wouldn't use them?
1
54
12,334
Qualcomm Legally Proves Arm Breached Its License, Wins $2 tpu.me/srh2
43
356
76
3,891
186,615
That's less angry users than I've expected
Bluesky
@blueskyOct 15
Vibe-coding, but make it social. Starting today you can use Attie to make sites: Games, quizzes, guestbooks, your top 8, or whatever you dream up. Go try it!
3
1
44
2,101
we have video... (just not yet between browser<->native clients)
Alula
@__alulaOct 14
working on some bullshit
5
1
43
1,513
I wonder how much of the problem is coming from antigravity being a totally dogshit harness
Theo - t3.gg
@theoOct 14
Gemini 4 Argon has proven to be outright unusable for real code work in my codebases. It aggressively hallucinates about how systems work.
2
24
975
working on some bullshit
3
1
43
2,793
Discord over IPv6 😱
3
16
543
it's really weird because a lot of their stack is clearly future-proofed and just works over IPv6, but it's just not their priority to actually have it work in production.
9
311
Load more