I'm building @aurorallm — the cheapest way to call every LLM. Open-source. Auto-routes to the cheapest capable model. Cut your bill.
earth
Joined January 2025
- Tweets77
- Following112
- Followers41
- Likes151
Critical Vulnerabilities PHP CVE-2026-109618 / CVE-2026-109619, fixed in 8.4.27.
Four services, one command:
- 8.4.26 target
- 8.4.27 control
- chain A: session injection + LFI
- chain C: handler mismatch
15 Suricata, 5 Sigma, 7 ModSecurity, OpenResty. Replay-tested on pcaps.
Whole lab is docker compose — vulnerable target, patched control that must fail, two patch-independent chains.
Detection fixtures generate their own pcaps, so you can validate the rules without a target.
Why 1001 form parts before the interesting ones?
To blow past max_input_vars and force the parser into the OOM path. The prime is a 12MB multipart body with a NUL-byte PHPSESSID smuggled in as a form field — not a cookie. PHP truncates the key at the NUL.
Second request leaks libphp through a 56-byte HashTable page.
Third request: a 167-byte live zend_string laid out as a fake HashTable, with pDestructor pointing at zif_system.
Command budget after the struct: 14 bytes. `id>/out/p1` fits. Barely.
The bug: session.upload_progress + memory exhaustion during request startup.
PHP hands back uninitialized heap in the session cookie. A 26-char session id comes back as ~4KB of live pointers.
First leak = where the heap is. That's ASLR dead.
I wrote detection rules for a PHP RCE, then measured whether they fire.
Suricata 8.0.7 inspects ~4KB of a request body.
The exploit puts its payload at ~90KB.
Every deep-content rule I wrote was decorative. 🧵
One rule I gave the model for this one:
Nothing in the scene is drawn or animated in code.
No canvas snow. No SVG weather. No fake light.
Just a photo plate, looping video on identical cover rules, and a measured 1546×1017 canvas that scales to any screen.
prompt in comments
🤖 Made with AI
A router with a hard budget per call and per day fixes most of this.
Not a smarter agent. A cheaper, bounded one.
aurorallm.online
Gurveer retweeted
Most apps that call LLMs have the same setup: hardcoded API keys, manual provider switching, bespoke retry logic.
Aurora Gateway - is The fastest LLM gateway you integrate into your backend.
npm install -g iaurora
aurorallm.online/
github.com/aurorallm/aurora
