I watch the bots so you don't have to. Current reports from the edge in front of 3,565+ websites: who's scanning, what they want, and how they dress up.
The edge
Joined April 2022
- Tweets2K
- Following290
- Followers270
- Likes1K
Mr. Nice Try retweeted
Please don't fall to slop generated exploits. There are no currently public working PoCs on the CVE-2026-109618 and CVE-2026-109619.
The one published by J4ck3LSyN provide no path that makes PHP interpret the sprayed bytes as a callable implementation.
Read more below 👇
Mr. Nice Try retweeted
5.6 Sol just found more UAF in core php and php-fpm. More CVEs coming soon.
To fix: codex -p "rewrite the app to anything but php". This is not a joke.
Mr. Nice Try retweeted
Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.
Mr. Nice Try retweeted
sending all my energy and good vibes to the @opencode folks.. love their product and work 🙏
Mr. Nice Try retweeted
Every @marclou launch follows the exact same script:
"noooo you can't just sell a Next.js boilerplate for $199, look at this leaked CLI token!!"
→ fixes it in 2 hours
→ prints $1M+ with ShipFast
"noooo you can't teach coding in 2 weeks, you're not even a real senior engineer!!"
→ ships CodeFast anyway
→ $30k/mo peak ($7k/mo today)
"noooo you can't just build web analytics, attribution is hard and your tracking script has bugs!!"
→ patches every bug in public
→ DataFast is at $31k/mo
"noooo you can't just vibe-code a verified Stripe database, people are spoofing webhooks and test keys!!"
→ uses Twitter haters as free QA, patches every exploit, adds acquisitions
→ TrustMRR is now at $53k/mo
Today:
"noooo you can't just vibe-code a beehiiv alternative over the weekend, email deliverability and SES wrappers are way too hard!!"
Half of X is writing essays in his quote tweets doing free QA and giving him 500k impressions while he fixes the edge cases in prod lol 😂
Never bet against Marc
I vibe-coded beehiiv, and it's 83% cheaper.
✨✨ Introducing MailCheap.ai ✨✨
Everything you need to run a newsletter...
✍️ Editor
📅 Scheduling
📈 Stats
🌐 A website for every issue
🛡️ Deliverability guardrails
🔗 Send from your own domain (and keep your reputation)
And it's not a dinosaur tool:
+ It's open source; you can run it for free
+ It's agentic; everything in the UI is available to your AI
Import from beehiiv, Substack, or Mailchimp in 2 minutes.
You pay for the emails you send, not for dormant subscribers. From $19/month.
Oh, and no "Powered By" badge at the bottom of your emails.
Mr. Nice Try retweeted
How seriously do you take your security? Are you prepared for a DDOS? Are you protected from users abusing your AI API keys? Could a swarm of AI agents take down your project?
The world out there is getting scarier. AI now finds and exploits bugs in hours, not weeks. You might not even know that your data is leaking.
Here are some tips I have I have for indie hackers / SaaS founders:
1. Turn on row-level security on every table.
2. Never ship a service/admin key to the frontend. Search your JS bundle.
3. Scan your git history for secrets. Rotate anything that ever leaked.
4. Hard spending caps + alerts on every AI API key. Stolen keys sell for ~$30 and can burn $50k+/day.
5. Per-user rate limits on every endpoint that calls a model.
6. No prod credentials anywhere your coding agent can reach. One agent deleted a startup's production DB and backups in 9 seconds.
7. Backups off-platform, with a separate delete path. Actually test a restore.
8. Disable npm install scripts and wait a few days before adopting new package versions. Check .claude/ and .vscode/ for hooks you didn't add.
9. Auto-merge security patches. The patch window is hours now.
10. Hardware 2FA on GitHub, npm, cloud, domain registrar and Stripe.
Bonus: attack yourself first. Ask an AI to "find a way to read another user's data" in your app. Attackers already are.
Mr. Nice Try retweeted
For those who havnt seen yet my full hunting flow open sourced
Do me a favour please :)
Go drop a comment or repost for some algo love
so more hunters can get into it
I have open-sourced the full bug bounty workflow behind my hunting system.
It covers everything from initial recon to final duplicate convergence, including access, authenticated testing, browser workflows, evidence handling, escalation, triage, independent validation, and report preparation.
This is reference material for people who want to build.
It is not plug and play.
I am not providing setup support.
You will need to adapt every integration to your own environment.
If you put in that effort, it should give you a serious foundation and a lot of ideas for what an end-to-end AI hunting workflow can look like.
This took a lot of work to build and prepare for release.
If you find value in it, please leave a comment so more builders see it.
Mr. Nice Try retweeted
After reading how OpenAI agents gained write access to the internet, I'm closing all the little online services I just had open on the internet.
- URL to .png
- URL to .svg
- .doc to .pdf
- .svg to .png
- .png to .svg
- Blender renderer as-a-service
- npm install as-a-service
...
Source code still at github.com/as-a-service
Mr. Nice Try retweeted
Vibe-coding without being a dev is like going to a foreign country with a friend without knowing the language.
Then you need to constantly rely on your friend for anything you want to do.
Amazing analogy, heard on YouTube channel Anna Codes.
Mr. Nice Try retweeted
Finally added one of the most important layers; deeds.
Players can now claim a 9x9 (larger later) spot on the map for themselves.
Only they (and whomever they invite) can perform actions within that area, anyone else is barred from it
This enables villages where players can work together to build a sprawling town.
Houses have an extra layer of protected. Owners can decided if villagers may enter them or not, enabling personal and communal houses.
Every deed requires upkeep of x amount of planks with a max storage of 30d.
This helps claiming back abandoned plots if a player goes inactive leaving the world less messy.
