I watch the bots so you don't have to. Current reports from the edge in front of 3,565+ websites: who's scanning, what they want, and how they dress up.
The edge
Joined April 2022
- Tweets1.9K
- Following290
- Followers257
- Likes998
Pinned Tweet
a little late - but here's a write-up showing how i moved 1,900 more websites into my bot-fighting framework.
there's a lot of ways to fight fraud online. previously, i was handling most of it through a variety of tools + subscriptions: ip lookups, device fingerprinting via JS, and looking for signals bad guys make.
now i built an appliance that monitors bad actors before they even hit the website.
this blog addresses how i can manage this appliance without taking it offline via blue-green deployments and a canary.
what does that mean? i don't know, i just started vibe coding last week. 😅
mrnicetry.com/posts/how-i-pl…
annie, are you ok? are you ok? are you okay, annie?
xitter.cf/MrNiceTry/status/21129…
you just finished patching two critical PHP CVEs. nice work.
> but there might be more.
somewhere online, another researcher found something else in php 8.5.12 -- the version you installed about an hour ago. 🧵
it's been a week for PHP.
two critical bugs. a leak. a public exploit before the patch. attacks six hours before the fix shipped.
and now a separate crash on the patched build. when the whole internet points at one target, more bugs fall out.
if you missed the two CVEs that actually matter today, that's the thing to read and patch for:
mrnicetry.com/posts/two-crit…
(of course, my blog is offline rn)
the double-free is one to watch. i'll say more if it becomes more.
spent 11 hours yesterday patching dozens of severs and thousands of websites.
added some firewall rules to block PHP_SESSION_UPLOAD_PROGRESS and multipart upload requests.
peaked the first hours at 500 requests/hr... not counting what WAF blocks elsewhere.
placing many critical sites in maintenance mode until after the final announcement now.
Mr. Nice Try retweeted
Please don't fall to slop generated exploits. There are no currently public working PoCs on the CVE-2026-109618 and CVE-2026-109619.
The one published by J4ck3LSyN provide no path that makes PHP interpret the sprayed bytes as a callable implementation.
Read more below 👇
thinking about that php remote code cve and not sure where to start?
here's a guide to disable and block session upload progress for just about everyone.
mrnicetry.com/posts/two-crit…
Mr. Nice Try retweeted
5.6 Sol just found more UAF in core php and php-fpm. More CVEs coming soon.
To fix: codex -p "rewrite the app to anything but php". This is not a joke.
PHP has 2 CVEs dropping tomorrow.
i don't know what's going to be announced, but here's what i'm turning off on all of my projects right now.
how did i put this all together? hours of research.
including official PHP's notice, watchtowr, sansec...
but @rina4_tot dropped a pretty big clue
xitter.cf/rina4_tot/status/21126…
finally, if you don't need PHP_SESSION_UPLOAD_PROGRESS in your application, here's a full writeup and some easy ways to disable it entirely.
mrnicetry.com/posts/two-crit…