geek. serial entrepreneur. angel investor. aspiring 5.0 pickler. living the dream.
Sunshine State
Joined May 2008
- Tweets4K
- Following196
- Followers170
- Likes1.3K
احمد retweeted
That PHP vulnerability that’s gonna cause havoc this week was found with… GPT‑5.6 Sol.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
If you have a headache from dealing with all the PHP vulnerabilities today then you need to use this. Thank you @OpenAI
If you are wondering whether your website is affected, we have packaged a Codex skill to help check.
Point your Codex at this repo to guide you through it: github.com/openai/php2shell-…
Cloudflare is being proactive
Cloudflare has deployed emergency WAF rules for two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both reportedly rated CVSS 9.2.
The risks affect WordPress, Laravel and other PHP-powered applications.
If your site is behind Cloudflare, there’s an extra layer of protection. Cloudflare says its initial rules are available to Free-plan customers too, as early attacks emerge.
But don’t treat that as a fix:
• Verify your traffic passes through Cloudflare.
• Check your PHP version and hosting provider’s patch status.
• Update PHP as soon as the official security fixes are available.
WAF rules are a stopgap, not a substitute for patching.
Cloudflare update: developers.cloudflare.com/ch…
imo peeps complaining about their usage draining simply don’t know how to efficiently use codex. With those additional changes from @thsottiaux and the @OpenAIDevs team there is really no excuse. I get a shit ton of work done on the $200 pro plan, leveraging caching for long running sessions is one way I do it.
Codex and Claude can do the work for you. Secure your sites tonight, patch tomorrow and then go back to complaining about @thsottiaux and his 28 day challenge
Teamwork makes the dream work.
The team and I
@J4ck3LSyN @Archknight23
🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow.
The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.
📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up.
PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act.
Here's the part the big threat-intel shops aren't shouting about:
No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling:
🔹 Present since PHP 5.4
🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live)
🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config
That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands.
✅ What to do right now:
1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade.
2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess:
session.upload_progress.enabled = Off
Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths.
3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.
4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today.
Why I'm posting this for free:
A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response.
I'll follow up once the official advisory publishes and confirm whether my root cause read was right.
Stay patched. 🔒
#PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec
A little magnetic holder on the back of my iPhone case has my drivers license and one physical credit card for places that don’t do tap to pay. I don’t recall the last time I carried an actual wallet.
This is so cool. I use the subscription with a fallback to the api when my subscription usage is reached. This way I can work uninterrupted. As I run many concurrently sometimes it will be hours between messages and this would help a ton with cost.
Thank you @OpenAIDevs
احمد retweeted
There were reports of usage draining faster than anticipated for some users over the weekend. We've identified approximately 40,000 accounts that had an inconsistency on which usage limits where the actual usage that was applied did not correspond to their actual selected plan. We are reaching out individually to all these users and have corrected the issue. If this affected you, we'll add credits to your account. Sorry we got this wrong.
I love everything cloudflare is doing, reminds me of the first few years of aws when everything felt like magic.
@eastdakota is such a baller.
Generative UI is close to seeing its moment emerge – and I can't wait to show you all a new CF experience. Cloudflare's recent models make rendering near instant.
Clef = Choose the best component
Clairic = Populate props from image/text
Rendering 5-10 components in ~1 second.
Creating an amazing user experience has a lot of layers too it. It's not just about speed.
Output needs to be exact. Styling needs to be consistent. Components need to be effortlessly composable.
And none of that happens without an amazing context layer to glue it all together. It's more than just the models. And all of this can be complementary to any LLM output – not dependent upon it.
Really excited with where things are at internally and when we can show more of what we're building to the world.
You played so well Catherine, your defense and resets are the best in the world, and now you are getting more and more aggressive with the volleys. Very well deserved.
Many, not all, of us have the option to be creators or be employees.
Creators can go bust or bank coin. Employees cash their paycheck. If @IJasonAlexander wanted royalties he could’ve created something that paid royalties. @BeingLarryDavid did it twice.
Seinfeld's reruns have made Jerry Seinfeld and Larry David hundreds of millions of dollars. Jason Alexander, who played George, says he has made less than $200,000 from them.
That gap is part of why the show ended.
In the video below, Alexander explains why George, Elaine and Kramer stopped wanting more seasons.
In 1997, Seinfeld was the biggest comedy on TV. NBC offered Jerry $5 million an episode, about $110 million, for a tenth season. He said no.
Every year before the Christmas break, Jerry asked his three co-stars if they wanted to keep going. In season 9, they all said it was done.
Alexander, Julia Louis-Dreyfus and Michael Richards were not partners in syndication. The reruns would pay Jerry and Larry for life. Not them.
"Seinfeld wasn't going to be the annuity for us that it was going to be for Jerry and Larry," Alexander says.
Every new season tied them tighter to one character. "We were going to contribute to our own eventual demise as actors."
The case for Jerry: he and Larry created the show and owned it. The cast signed their deals and were paid well, reportedly $600,000 an episode by the end.
Before the final taping, the four of them held hands backstage like every week. They called it the circle of power.
Jerry said: "For the rest of our lives, when anyone thinks of one of us, they will think of all four of us."
Alexander says they walked out looking like they'd been hit by a truck.
So should Jerry have shared the reruns with George, Elaine and Kramer?