@d0nutptr

Security, software correctness, and Rust 🦀 Doing the cyberz @OpenAI prev: @RobinhoodApp, Cruise, @zellic_io, @Dropbox My awful opinions are my own

 San Francisco, CA
d0nut.dev
Joined November 2013
  • Tweets16.3K
  • Following473
  • Followers21.4K
1.7KMedia
I'm excited to announce I'm joining @OpenAI! I left Robinhood in March of 2025 to embark on a wonderful year and a half long career break. I used that time to: travel (I went drifting in japan!); build a low-latency arbitrage bot on Solana, briefly becoming the 60th most profitable arbitrage bot on the chain; and learning @leanprover in service of building an accurate model of rust to prove `unsafe` rust code was free of UB! But a lot has changed. For one, most engineers I knew were, at the time, leveraging Github Copilot as an "intelligent autocomplete" to accelerate parts of writing code. Software was (and at many places, still is) manually reviewed, and there was much doubt, especially from myself, that models could ever improve to the point to economically handle the more complex tasks of implementing entire features, proving conjectures, or discovering, and exploiting, novel 0-day vulnerabilities. Clearly I was wrong! I've been shocked and inspired by the rapid advancement going on in the industry while I was away. One thing has been abundantly clear: security is changing. I'm excited that I get an opportunity to work on some of the most important problems facing our industry today. And I get to play a meaningful part in discovering, and contributing, to the next generation of strategies required to secure this burgeoning technology.
53
6
4
574
36,970
d0nut 🦀 💜 retweeted
Matt Fuller@matthewdfullerOct 21
I think we’re aware enough this year.
Semil
@semilOct 20
October is Cybersecurity Awareness Month
3
3
337
d0nut 🦀 💜 retweeted
Matthew Green
@matthew_d_green16h
Someone told me last week to look for “signposts” that might indicate attacks were getting significantly faster and worse than the historical norm. Do you think we’re seeing any of those?
Varunram Ganesh
@varunram18h
Railway is compromised, rotate all API keys as soon as possible Deployments are down so don’t wait to redeploy Attackers are draining keys in real time, we didn’t lose much but can confirm this is still an active attack Stay safe friends
10
37
5
468
20,163
d0nut 🦀 💜 retweeted
Tibo
@thsottiaux8h
Day 17/ Bet you thought we forgot, but no, it’s reset day today. Also good time to remind you to get Daybreak Blue access, it only takes 15 mins and you don’t want to have to do it in the middle of an incident.
1,891
510
658
11,023
1,392,093
d0nut 🦀 💜 retweeted
Monica G
@monica_graham14h
Replying to @4A4133
disclosing ANOTHER bug today is like proposing at someone else's wedding
3
24
4
511
22,351
lol
1
8
1,797
we've built an entire industry on sand castles and it's about to rain
13
89
8
751
16,270
Masonhck357
@Masonhck357112h
AI + Rust = the return of @d0nutptr?
1
12
884
crossover event for my two interests
hawolt
@hawolt19h
1
1
11
792
d0nut 🦀 💜 retweeted
itszn@itszn13Oct 21
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release.

Please read more about our approach:
OpenAI
@OpenAIOct 21
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. openai.com/index/coordinated…

Patch the Planet: global response coordination as agents uncover critical vulnerabilities

Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.

openai.com
Readers added context they thought people might want to know
‪OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.‬ ‪x.com/lcfr_hax/statu…‬
45
152
14
1,357
103,453
d0nut 🦀 💜 retweeted
Vercel Developers
@vercel_dev16h
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26. Vercel WAF rules are live for every project and block known exploit patterns. vercel.com/kb/bulletin/node-…

Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) | Vercel Knowledge Base

Vercel WAF blocks known exploit patterns for CVE-2026-111497, but does not replace patching. Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1.

vercel.com
67
280
209
2,531
500,250
d0nut 🦀 💜 retweeted
s1r1us
@S1r1u5_18h
gotta give it to @OpenAI and their sane daybreak program heif heist by harsh kvmescape by paulos php2shell by lcfr gitlab rces by joaxcar chrome full chain by moyix wordpress rce by hashkitten all largely thanks to openai daybreak giving researchers access to gpt 5.6 sol.
13
40
8
768
65,878
d0nut 🦀 💜 retweeted
Canmi
@canmi2122h
Replying to @galaxy1025850
但是 Cloudflare 开了小橙云 🥰
2
3
309
16,756
1
3
36
1,004
d0nut 🦀 💜 retweeted
Halvar Flake
@halvarflakeOct 21
Attack surface reduction is the one thing that reliably works.
chrisrohlf
@chrisrohlfOct 20
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected. This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled. anthropic.com/research/attac…

Using Claude to reduce the attack surface of code

Automated attack surface analysis and reduction can meaningfully improve the security of deployed software in the near term. In this post, we preview data we’ve collected from applying attack surface...

anthropic.com
5
31
2
149
13,057
making either incredibly stupid or incredibly dumb moves rn 👀 will update this post if it goes through
5
677
eMudhra playing 4d chess
Ian Carroll
@iangcarrollOct 20
For the next few days or weeks, anyone now has a root CA thanks to eMudhra. Time to have some fun with MiTMing unwilling devices!
4
917
d0nut 🦀 💜 retweeted
Matias@BolmerclOct 21
Replying to @d0nutptr
xitter.cf/Dinosn/status/21127171…
Nicolas Krassas
@DinosnOct 21
Replying to @doiftrue
Partial mitigation
1
1
3
974
Excuse me?
2
670
The beautiful thing about the PHP bug is that all it takes is one dedicated hero to use the CVE to defeat the CVE (mitigate public facing PHP systems on their owner's behalf)
1
3
28
1,674
This isn’t a “I’ll do it tomorrow” thing. It’s a “we are 6+ hours late to calling a SEV0” thing. Mitigate this **now**.
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawkOct 21
If you run PHP please: session.upload_progress.enabled = Off php_admin_flag session.upload_progress.enabled Off
7
9
2
151
17,421
Load more