Referencing this in an upcoming video and I realized that a lot of people probably haven't seen Bas Rutten's lethal self defense

🚀 Kujo v1.9.0 is officially released! This release brings a substantial round of language improvements, runtime optimizations, and cross-platform verification. What's new: - Added checked nested assignments for arrays, dictionaries, and structs, preserving atomicity when writes fail. - Improved UTF-8 conversion, byte operations, and snapshot-safe iteration. - Added fallible comparator sorting, regex replacement callbacks, and regex_count for scanning without unnecessary allocations. - Expanded language utilities with headerless CSV records, fixed decimal formatting, and explicit wrapping arithmetic. - Reduced unnecessary memory copying through shared bytecode, copy-on-write storage, string caching, and improved VM call frames. - Improved VM/interpreter consistency for indexed operations, invalid writes, and exception handling. - Preserved numeric JIT compilation alongside speculative string-append optimizations. - Verified native installation and upgrades across Linux, macOS, and Windows, including npm distribution without install-time binary downloads. A lot of the work in 1.9 is about making Kujo faster and more predictable without sacrificing correctness or the execution guarantees we've been building around. Full release: github.com/kujolang/kujo

PHP2Shell: 24 Hours Later 24 hours after PHP2Shell dropped, 99.3% of affected PHP instances are still unpatched. Yep, you read that right. 🫣 🤦 After CVE-2026-109618 & CVE-2026-109619 were disclosed, we tracked more than 2.2 million publicly visible PHP instances on Shodan to see how fast the internet actually patches an unauthenticated RCE in PHP itself. • At first: 245 patched instances • After 12 hours: 4,519 • After 24 hours: 14,151, out of ~1.97M measurable affected instances Breaking it down by WordPress, phpMyAdmin, Drupal, Laravel, Joomla, cPanel and Magento shows the same picture: roughly 99% still unpatched. AI is making us faster at finding critical vulns, but it isn’t making us faster at removing them from the internet. If that gap keeps growing, patching quickly won’t be enough on its own. You need to know what you actually expose, cut internet-facing surface you don’t need, monitor for exploitation, and fix what’s really exploitable first. If you have a publicly accessible PHP instance and still haven’t patched, assume you’re exposed. Patch now, then check for signs of compromise. Full data and methodology on the OX Security blog: ox.security/php2shell-24-hou…

JUST IN: 🇺🇸 Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo detect unauthorized AI agents accessing customer accounts and attempting to act without user instructions.

Having strong enemies is a blessing.

✍️ Kujo CMS v1.2.1 is live! This release focuses on Node.js security compatibility and improving the reliability of our release verification process. What's changed: - Updated JavaScript tooling and clients to require patched Node.js release lines. - Fixed ephemeral-port collisions during release verification, preventing tests from conflicting over temporary network ports. - Fixed background worker output cleanup races that could interfere with release validation. - Preserved existing CMS API and database contracts from v1.2.0. This is a focused security and reliability update. No CMS API or database migrations are required specifically for v1.2.1. Repository: github.com/kujolang/cms

10k commits (so far) 😤

Railway is compromised, rotate all API keys as soon as possible Deployments are down so don’t wait to redeploy Attackers are draining keys in real time, we didn’t lose much but can confirm this is still an active attack Stay safe friends