PHP & simple coding apologist, UI Designer, Fractional CTO, Programmer, Server admin, Bootstrapper, Low latency Enjoyer. Creator of Zerolith, zl.css, y más
Utah, USA
Joined November 2022
- Tweets18.8K
- Following250
- Followers1.3K
- Likes48.4K
Bingo
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
Artillain ( Mr. Zerolith ) retweeted
🚨 CONFIRMED: PHP has officially acknowledged another RCE vulnerability, CVE-2026-115560, affecting specific session configurations even after the October 21 patches.
A separate issue, not a bypass of the original fixes. A patch is planned.
We've updated our defensive toolkit:
github.com/syhunt/php2shell-…
#php #cybersecurity
Artillain ( Mr. Zerolith ) retweeted
Learn something this time. Don’t switch to another VC or private equity funded app with no published business model. The era of “trust us bro, we’ll figure it out later is dead”
It's your turn, PHP haters 🙃
Liked PHP2Shell? You’re gonna love Node2Shell.
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shell-…
If you have not updated your llama.cpp in a few weeks it's likely you are missing out on massive gains on blackwell hardware. FYI.
A few days ago i talked about how most companies are paying for more externalities with AI than getting a measurable benefit..
I called a few of my clients and explained the problem with AI bots and pitched the idea of a security megaproject:
- build a state actor-grade AI pentesting apparatus
- completely remove wordpress as a vector by flatfiling it and re-engineer wordpress sites to fit
- Finish building defense system that exceeds cloudflare's capabilities
- Build system that identifies attack patterns and reports them with suggested remediations
- Build system that auto-snipes entire ASNs based on long term collected reputation
I told them this is is a moonshot and easily low 5 figures per client since we are pooling R&D. Also i must take some % of developer labor off their existing projects.
So far i have 2 yesses and 1 maybe on getting funding for the mega project.
I'm surprised by the reception - but it really is bad enough out there to justify the investment.
Artillain ( Mr. Zerolith ) retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Artillain ( Mr. Zerolith ) retweeted
PHP isn’t the most sexy language, I give you that. Where I live in Belgium, government, school, hospital, help line, media, news, and what not websites are down.
It’s not because we don’t often hear about it that it isn’t big. Usually, PHP simply does the job. Nothing sexy, nothing worth shouting about. Only on these rare occasions do you get a feeling of the true impact of the language.
Artillain ( Mr. Zerolith ) retweeted
🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just because you've patched.
#php4shell #php #cybersecurity
xitter.cf/_annieversary/status/2…
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793…
Artillain ( Mr. Zerolith ) retweeted
I am begging ppl to realize their limited exposure to server side languages & marketing-centered experience on here is not what actually goes on IRL, 70% of the web uses PHP and it's not even close, u are literally in a bubble
Artillain ( Mr. Zerolith ) retweeted
Good news everyone!
The absolute legends @ the Sury php mirror have backported the patch all the way back to 5.6
We have taken many left exits in the attempt to finish the 'Blast Processing' part of Zerolith. It started out using Swoole, then re-implementing IBM's fast low level disk cache, then to experiment with APCU and memcached, and ended up back in async land.
Blast processing was supposed to be a go-fast switch you enable and magic shit happens, but we found out it's not that easy - and the solutions that mostly worked, were notably slower than ones that require some user intervention. We thought it would be wrong to favor convenience over speed so much.
It was worth investigating all possible routes and seeing the pros and cons. In the end we've decided to implement easy async, fast background writing/function execution to offset heavy or high frequency operations, and semi-automated memcached database caching support.
You should see aspects of Blast processing gradually appear starting with Preview Release 3
My friend seems to think i could make money building bespoke AI hardware + software setups so that a company can get guaranteed privacy.
I disagree because so many people are rent-it-pilled and don't care about privacy. So i haven't bothered with that.
What do you think?
Artillain ( Mr. Zerolith ) retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Whatever money some companies have saved using AI, they have paid a lot to guys like me in cybersecurity because of how rapidly AI is hacking and breaking stuff.
Literally the only reason 35 servers are on the internet still is because i patch/mitigate things same day now
Half my year has been spent mitigating AI!