macintog retweeted
You know this php exploit is gonna be a banger when the POC video has an anime lady dancing around
macintog retweeted
Linux on the M6 Mac Mini, Day 6 - GPU is up!
Many of you noticed in yesterday's screenshot it used software rendering. I'm excited to share Omarchy on the M6 now utilizes the GPU.
Almost all the drivers are done, and I'll be starting on the Apple Neural Engine bring-up soon.
macintog retweeted
Yep, Anthropic contributed zero, literally zero value.
All it did was to announce Mythos, said Mythos is going to hack everything, got 50 or so companies to pay millions for access. They helped zero security researchers. Their safety classifier trips when even reading a vulnerability report.
OpenAI on the other hand, rolled out sensible KYC, gave access to Daybreak Blue, and see what the community has done with GPT-5.6-Sol (daybreak version).
One creates all the fear-mongering and delivers zero value, and the other quietly just carries everyone forward.
gotta give it to openai and their sane daybreak program
heif heist by harsh
kvmescape by paulos
php2shell by lcfr
gitlab rces by joaxcar
chrome full chain by moyix
wordpress rce by hashkitten
all largely thanks to openai daybreak giving researchers access to gpt 5.6 sol. anthropic took the opposite approach, gatekeeping access, there is a lesson to be learned here
macintog retweeted
mitmproxy adds --emudhra option
github.com/mitmproxy/mitmpro…
名垂千古了
macintog retweeted
LINUX. ON. THE. IPAD. 🐧🔥
After evenings of DFU retries, my iPad mini 4 is running native ARM64 Linux. Both A8 cores online. Live root shell.
Huge thanks to @henrikklee for sharing guidance from his iPad 6 work.
Next stop: Omarchy.
macintog retweeted
How to patch servers in the current year.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
macintog retweeted

Socket@SocketSecurityOct 21
United States
United StatesConnected via WebAccount-level information, not a live location or per-post device.
Socket flagged all seven malicious wheels within seven minutes of publication.
The malware runs at Python startup, even without importing LiteLLM. The release workflow built container images from a lookalike repository.
Full analysis: socket.dev/blog/litellm-comp…
macintog retweeted
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.
If you run either stack in production, keep an eye on official advisories and apply patches promptly.
Security maintenance doesn't stop at your application code. Your runtime matters too.
Node.js advisory: nodejs.org/en/blog/vulnerabi…
macintog retweeted

International Cyber Digest@IntCyberDigestOct 21
Europe!
EuropeConnected via Europe App StoreLocation may be affected by a proxy or VPN.Account-level information, not a live location or per-post device.
‼️ PHP UPDATE: 4chan has gone read-only and Something Awful has shut its forums as American sites brace for the PHP patch.
4chan says it is "temporarily read-only while we await an urgent PHP security update."
Something Awful says the flaw "allows for the kind of hacking you see in movies (but in real life)."
Bookmarking service Pinboard, game publisher Choice of Games, history site Damn Interesting and the explain xkcd wiki are offline too, as is art site Fur Affinity.
DeviantArt is also down "for maintenance" but has not said why.
PHP's fix is due at 14:00 UTC, 10am in New York.
macintog retweeted
Millions of IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools, etc. are all going to be relentlessly hacked via safely signed malware for the next several years or maybe indefinitely.
eMudhra hack might be the most important event of the year.
macintog retweeted
There is only one answer to cybersecurity threats: Fix your shit.
Scared of threat actors using AI? Worried about rogue agents? Think abliterated models are spooky? Fix. Your. Shit.
The "ban AI models and regulate GPU access" crowd should instead fix their shit.
macintog retweeted
Fifty attempts to boot Omarchy on my iPad mini 4.
DFU works. Pongo loads. Linux, so far, does not.
I do have logs. I also have an unreasonable amount of stubbornness.
iOMARCHY is very much still a work in progress. If you’ve ever got Linux running on an old iPad, I’d love to hear how 👀
After upgrading to macOS 27.0.1, my 2017 LG UltraFine started acting weird! Randomly going black, USB controller no longer being recognized... etc...
Downloaded LG Screen Manager from the App Store (1-star rating lol) and noticed a firmware update was available. But the updater kept crashing.
Apparently, this has been a known issue on Apple Silicon since the M3 and macOS 26, but @LGUS hasn't given a shit about fixing it for two years.
So I gave Codex Astra the IPS crash report. It identified a double-free memory error, downloaded the latest firmware, patched the updater with a 30-line Python script, and code-signed it ("untrusted developer" warning, but who cares).
Ran the patched updater, and my monitor is back to life. All issues gone.
Wild times. All of that took me 15 minutes. What a time to be a dev.
Shame on LG, though.
macintog retweeted
A few years ago Autodesk audited my personal hobby Maya Indie license. I had to send a bunch of stuff, all of which was very goofy because I had it installed on one computer and had zero revenue because it was a hobby.
I've ramped up my Blender adoption a ton ever since.
This is a wild approach, @autodesk.
We’re a small business paying $380 per user, per month. We’ve been paying customers for over a decade, and we make a deliberate effort to honor the license agreements for every product we use. Your software already requires authentication and an assigned license. What, specifically, prompted this email?
Earlier today, I had two conversations on two separate podcast episodes about your direction with Fusion and why cloud-based API access makes sense for agentic MEP workflows. I was making the case for Autodesk. I think the product direction is right based on recent posts from @andrew_anagnost.
Our company has been deciding where to invest our development effort: integrate our custom cloud agent harness into Autodesk, build on an open-source platform, or adopt one of the emerging cloud alternatives. That decision will lock in years of internal development and software spending. This decision is also central to our plans to expand @PermitZIP nationwide.
An email like this becomes part of that decision. So does the time we have to spend responding to it.For more than a decade, we’ve paid for anywhere from 5 to 30 licenses each year. Autodesk is our single largest SaaS expense. This is a heck of a way to make our next platform decision easier.
Starting next week, we’ll begin transitioning away from Autodesk products. We have nothing to hide and will cooperate with the audit. We’ll also be directing our future spending toward companies that earn our confidence as partners.
I hope your audit goes well.




























