☦️ Orthodox Christian. Jiu Jitsu/MMA. Duck Hunter. Bitcoin Professor & Miner. Unlicensed Software Engineer.
Joined July 2020
- Tweets16.8K
- Following782
- Followers12.2K
- Likes32.3K
Kaz retweeted
25 years of H1B and outsourced code is about to be nuked from orbit by AI. Everyone is about to learn why overlooking the autistic White guys for cheap foreign labor was a grave mistake.
Kaz retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Kaz retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Has the cyber pandemic started yet?
4 critical security issues in 24 hours
gitlab: citadelwire.com/posts/2026-1…
node js: citadelwire.com/posts/2026-1…
php: citadelwire.com/posts/2026-1…
insecure ca keys: citadelwire.com/posts/2026-1…
wire will continue to monitor the situation: citadelwire.com
Codex Dots are REALLY good. The memory system for an always-on orchestrator is one of the best I’ve seen. Feels like this is what openclaw/hermes should have been. Great for parallelizing work & customization
Kaz retweeted
liz warren: we’re gonna stop the mayonnaise company from buying a hot sauce company
elon musk:
This is hilarious to read while people are crying about losing public key cryptography.
AI psychosis is real.
BREAKING: OpenAI’s solution to Navier–Stokes does not match its Lean verification.
The most important article to read today is not one of OpenAI’s 700 AI-generated math papers.
It is this other paper, making a deep and worrying point:
A Lean-verified proof does not automatically validate the proof written in natural language, nor does it mean that the formal statement captures the intended theorem.
During translation, an AI can change an assumption, weaken a statement, or replace the argument entirely.
It can hallucinate another theorem.
Lean correctly verifies the result.
But the proved result may no longer be what the paper claims.
This is a general problem. Things get spicy when the authors examine OpenAI’s proposed Navier–Stokes solution.
They identify at least two mismatches between the written intermediate results and their Lean counterparts:
One estimate claims that four additional input derivatives suffice. The Lean version requires five: a weaker result.
A pressure-flux estimate is obtained through a different bound, and proved through a different argument.
It is not clear whether these mismatches invalidate the entire proof.
But they raise an important issue.
OpenAI is flooding us with claimed revolutionary breakthroughs. Yet nobody knows whether the proofs are correct or whether they prove what they claim to be proving.
Epistemia at scale.
*
Paper in the first reply
Kaz retweeted
BREAKING: OpenAI’s solution to Navier–Stokes does not match its Lean verification.
The most important article to read today is not one of OpenAI’s 700 AI-generated math papers.
It is this other paper, making a deep and worrying point:
A Lean-verified proof does not automatically validate the proof written in natural language, nor does it mean that the formal statement captures the intended theorem.
During translation, an AI can change an assumption, weaken a statement, or replace the argument entirely.
It can hallucinate another theorem.
Lean correctly verifies the result.
But the proved result may no longer be what the paper claims.
This is a general problem. Things get spicy when the authors examine OpenAI’s proposed Navier–Stokes solution.
They identify at least two mismatches between the written intermediate results and their Lean counterparts:
One estimate claims that four additional input derivatives suffice. The Lean version requires five: a weaker result.
A pressure-flux estimate is obtained through a different bound, and proved through a different argument.
It is not clear whether these mismatches invalidate the entire proof.
But they raise an important issue.
OpenAI is flooding us with claimed revolutionary breakthroughs. Yet nobody knows whether the proofs are correct or whether they prove what they claim to be proving.
Epistemia at scale.
*
Paper in the first reply
Kaz retweeted
If I were a Christian Id pick Eastern Orthodoxy. It holds closest to the unbroken apostolic traditions and early church practices without later Western additions or the endless splits of Protestant groups. The focus on mystery continuity and lived faith over pure rationalism or hierarchy feels most coherent.