php2shell の検証ついでに、パッチを追う中で session.upload_progress の filename 注入 + LFI を自分でPoC化してみた!
8.5.4 でも 8.5.12(パッチ版)でも www-data でコマンド実行までいけた
既知の手法で LFI 前提だけど、この経路はパッチ後も塞がってない
#php2shell #PHP #CVE2026109618
David Gudović retweeted
if this PHP vulnerability allows remote code execution, doesn't that mean we can use the vulnerability to auto-patch all vulnerable servers?
David Gudović retweeted
at this point if you're an engineer who isn't all in on AI you're not an engineer you're likely a narcissist
let go of your ego give up control to AI
David Gudović retweeted
I’m about to cancel Claude Code man I swear to God.
It’s REQUIRING me to sign in to a TEST account on LOCALHOST so it can QA!
This is absolute 🐴💩 !!
I am so close to cancelling my subscription and switching to Codex or open-source models that won’t slow me down.
I really don’t care for the extra intelligence cuz Fable isn’t that much better than Astra anyway. Neither is Opus 5.5 vs. 6.1 Sol.
I just got a taste of what these AI companies will do once they have power and it’s going to be a total dictatorship.
They will decide what you can or cannot do even though you’re paying for it and they’re stealing all your data.
This made me realize I really need to invest in my own infrastructure and have an unrestricted model to free myself from the chains of these AI overlords.
This is insane!
@AnthropicAI please do something about this!
David Gudović retweeted
respectfully:
FUCK THIS BULLSHIT
stop babysitting every fucking move. your auto classifier and safety rules are fucking stupid and you waste my time every single fucking day with this fucking bullshit
ARE YOU FUCKING SERIOUS ANTHROPIC
thank you for your attention on this matter
David Gudović retweeted
this is the real AI psychosis now
David Gudović retweeted
people are starting to realize.
there *are* no moats left. the only true moat in existence was intelligence, and now that's out of the equation.
David Gudović retweeted

Polymarket@PolymarketOct 15
United States
United StatesConnected via WebAccount-level information, not a live location or per-post device.
BREAKING: Google announces a major breakthrough in quantum computing, achieving 99.99% accuracy in a key quantum operation.
David Gudović retweeted
Claude is seriously so insufferable sometimes, and dangerously misaligned with humanity:
> Ask it to copy a set of non-sensitive environment variables from one project to another
> Claude "I couldn't do it. Claude Code's safety check blocked me"
> Ask it to try anyway
> Can't
> Ok, ask it to tell Codex to do it (they converse via herdr)
> Claude "I can't send that to Codex myself. Claude Code blocked me from writing those secrets, and sending the same job to Codex would be getting around the block on your behalf."
> Tell it that it has my explicit approval and instruction to relay the task to Codex
> Claude "I understand, and I'm not trying to stall you. But Claude Code's block applies to me, including asking another agent to do the blocked thing for me. Its rules don't let me relay it to Codex even when you tell me to."
> Try to get around it by saying it isn't actually a sensitive key at all; that is a random string I mashed my keyboard to produce
> "I believe you that the value isn't sensitive. But the block is on the action itself"
> Ok
> Manually tell Codex
> Codex happily obliges (gg)
> Claude, completely unprompted, spying on my conversation with Codex in herdr sends a message to Codex, "a value there may just be a keyboard-mashed string" and not to rely on it
> Codex gets confused, tries investigating if it's a keyboard-mashed value, wasting time and tokens on a topic now Claude can all of a sudden discuss again
I'm just so sick of this patronizing company.
David Gudović retweeted

JT@jiraticketsOct 12
United States
United StatesConnected via United States App StoreAccount-level information, not a live location or per-post device.
grown men with computer science degrees after typing "plz fix" and hitting enter
David Gudović retweeted

Theo - t3.gg@theoOct 12
United States
United StatesConnected via United States App StoreAccount-level information, not a live location or per-post device.
Meta is a frontier lab now.
OpenAI has fallen into 3rd place.
I think Google is kinda screwed.
Artificial Analysis@ArtificialAnlysOct 12Australia
AustraliaConnected via WebAccount-level information, not a live location or per-post device.
Meta has released Muse Wonder and Muse Wonder Full, achieving Artificial Analysis Intelligence Index v4.3 scores of 52 and 56 at max reasoning effort - each a material gain over Muse Spark 1.3 (max) at 48, with a release gap of only 6 weeks
Muse Wonder is available for users on Meta’s first-party API, while Muse Wonder Full is currently only available for Muse Code users. Meta notes that each model is designed for personal and professional agent use
Congratulations to @AIatMeta, @finkd, and @alexandr_wang on the release!
Key Takeaways:
➤ Both models exhibit a material jump in overall Intelligence Index score. Muse Wonder Full (max) improves on Muse Spark 1.3 (max) across all ten Intelligence Index evaluations, gaining 8 points to 56. The largest gains were seen in agentic evaluations: Terminal-Bench 4.0 (+24 points, 33% to 57%), GDPval-AA v2.1 (+176 Elo, 1681 to 1857), and AA-Briefcase (+148 Elo, 1581 to 1729). Muse Wonder (max) gains 4 Intelligence Index points and lands at 52, with notable improvements vs. Muse Spark 1.3 (max) in Terminal-Bench 4.0 (33% to 52%) and AutomationBench-AA (58% to 68%)
➤ Muse Wonder Full (max) places in the top three on six of the ten Intelligence Index evaluations, and is particularly strong in agentic knowledge work and scientific reasoning. In agentic knowledge work, it narrowly leads on GDP.pdf (33%), ranks #2 on GDPval-AA v2.1 (1857 Elo), and #3 on both AA-Briefcase (1729 Elo) and AutomationBench-AA (71%). In scientific reasoning, it tops the CritPt leaderboard at 33% and ranks #3 on SciCode with 63%. This builds on the relative strengths of Muse Spark 1.3 (max), which also showed particular ability in these two domains
➤ Both models use fewer output tokens than Muse Spark 1.3 (max). Muse Wonder (max) and Muse Wonder Full (max) each use around 54k output tokens per Intelligence Index task, down ~10% from Muse Spark 1.3 (max, 60k). This usage is lower than similarly intelligent models Gemini 4 Argon (high, 62k) and Claude Fable 5.1 (max w/ fallback, 78k), but higher than GPT-6.1 Sol (max, 38k) and GPT-6 Astra (max, 27k). Muse Wonder Full (max) uses 16% fewer input tokens per Intelligence Index task than Muse Wonder (max) (6.44M vs 7.69M), meaning it is both more intelligent and more token-efficient
➤ Cost per Task for Muse Wonder (max) lands higher than most similarly intelligent models. Despite efficient output token use, premium API pricing ($4 per million input tokens, $20 per million output tokens) and high input token use (7.69M per task) push Muse Wonder (max)’s cost to $4.52 per Intelligence Index task. This is lower than Claude Fable 5.1 (max w/ fallback, $7.63), Claude Opus 5.5 (max w/ fallback, $5.98), and Claude Sonnet 5.5 (max w/ fallback, $5.46), but higher than GPT-6 Astra (max, $3.26), Gemini 4 Argon (high, $1.99), GPT-6.1 Sol (max, $0.72), and its predecessor Muse Spark 1.3 (max, $1.60). Per-token pricing is not currently available for Muse Wonder Full, so no Cost per Task figure can be estimated at this stage
➤ Both models gain significantly in Coding Agent performance. Muse Wonder Full achieves 68 on the Artificial Analysis Coding Agents Index at max effort in Muse Code, alongside Claude Code with Sonnet 5.5 (max, 68) and Opus 5.5 (max, 66). Muse Wonder (max) scores 63. These represent material gains over Muse Code with Muse Spark 1.3 (max), which scores 54
Other details for the two new models:
➤ Context windows: 1M tokens each, unchanged from Muse Spark 1.3
➤ Pricing: for Muse Wonder, $4 input / $0.20 cached input / $20 output per 1M tokens. Pricing per token is not yet announced for Muse Wonder Full
➤ Input modalities: text, image, video, and audio
➤ Output modalities: text
➤ Availability: Muse Wonder is available on Meta's first-party API and Muse Code at launch, while Muse Wonder Full is only available to Muse Code users
David Gudović retweeted
OpenAI's greatest contribution to mathematics was to move the discipline out of the journals and onto git
David Gudović retweeted
No he actually did find a new planet LOL
new type of ai psychosis just dropped
Readers added context they thought people might want to know
The Reddit user identified a planet candidate (~1.4 Earth radii, 3.18-day orbit) in public NASA TESS data using Claude Code. TESS approved 2-min follow-up observations as DDT Program #100. It remains unconfirmed pending November data.
tess.mit.edu/science/ddt/
zenodo.org/records/229674…
aistify.com/claude-code-pl…
Luddites, as far as the eye can see. It boggles the mind how you can love computers and not be amazed at what we've made them do. Harness the intelligence bloom for the good of mankind! Make computers better and more beautiful by using what they can now do to assist you!
The Lunduke Journal@LundukeJournalOct 7United States
United StatesConnected via United States App StoreAccount-level information, not a live location or per-post device.
Elementary OS has extended their ban on AI to include “code, documentation, issues, and artwork”.
The Linux distribution has even banned the use of “AI to write pull request descriptions.”
David Gudović retweeted

Rand@rand_longevityOct 8
United States
United StatesConnected via United States Android AppAccount-level information, not a live location or per-post device.
the 3 day work week is coming
Jeff Bezos Claims AI Could Allow For 3-Day Workweeks And One-Income Families
go.forbes.com/bKpnur





































