AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk

Sec/Madness @privy_io principal security , @_seal_org technical council prev: HoS @uniswap, D&R/IR @RobinhoodApp, IR @BitMEX, Built @Paterva Maltego with RT

 New York, USA
andrewmohawk.com
Joined February 2008
1,062 Photos and videos
Fun react bug, (CVE-2025-55183) if you have a server side component and it explicitly or implicitly exposes a stringified argument you can get the source code for that function. Also found DoS, but reported it to vercel instead of meta and some else reported the next day 🙃
7
13
95
19,270
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Nagli
@galnagli
1h
php2shell.com

PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web

PHP2Shell is a family of critical vulnerabilities in core PHP that can allow unauthenticated attackers to execute code or disclose sensitive process memory.

php2shell.com
1
7
42
2,025
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
php-net@php_net
1h
PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619). Changelog + downloads: php-net.pro/news/php-8-5-12-…

PHP 8.5.12 released with security fixes | The Dev Dispatch

The PHP project has released PHP 8.5.12: 90 fixes across 29 components of the 8.5 branch.

php-net.pro
22
1,864
3,435
362,568
- [RCE via OOM corruption · Advisory · php/php-src](github.com/php/php-src/secur…) - [RCE via stale global state · Advisory · php/php-src](github.com/php/php-src/secur…)

RCE via OOM corruption

## Summary PHP uses `longjmp()` for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it ...

github.com
2
2
942
If you run PHP please: session.upload_progress.enabled = Off php_admin_flag session.upload_progress.enabled Off
1
9
41
19,501
phpc.social/@Girgias/1174764…

Gina Peter Banyard (@Girgias@phpc.social)

@whitequark@treehouse.systems The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.

phpc.social
2
875
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Gary Bernhardt@garybernhardt
15h
I, for one, consider 4 a perfectly fine integer between 1 and 39402006196394479212279040100143613805079739270465446667946905279627659399113263569398956308152294913554433653942642
42
558
13,356
163,729
Wow, what a hire
Maddie Stone@maddiestone
13h
A lil personal news: Yesterday I started working at OpenAI on the cyber research team. I'm really excited to join this team of brilliant researchers and work on problems that feel really important and meaningful to me. Let the next chapter begin! 🥳🩷
8
936
^
sshell@sshell_
11h
it's very easy for people to create piles of plausible-looking slop and call it a PoC someone out there has figured out the PHP RCE (CVE-2026-109618 / CVE-2026-109619), but it might not be the person whose code you're retweeting sight unseen
4
990
GL to everyone
Kirill Firsov
@k_firsov
18h
php2shell Tomorrow is a helluva day.
1
95
13,820
<?php echo "oh noes!"; id; whoami infosec.exchange/@watchTowr/…

watchTowr (@watchTowr@infosec.exchange)

Attached: 1 image We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2026-109618/619 We...

infosec.exchange
10
3,526
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Alex Rad
@defendtheworld
21h
a particularly epic @xkcdComic inside joke
1
15
418
emudhra.andrewmohawk.xyz/ if you need a quick test ^_^
1
7
3,550
Small amount of graph crime with those y-axis numbers, but otherwise interesting to remember that this is happening everywhere
Sam Freedman@Samfr
Oct 18
To give an indication of the problem here's a chart of 12 government agencies around the world and numbers of applications / appeals / complaints etc... The dotted grey line is when ChatGPT was invented.
2
337
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Nick Price@DominoTree
Oct 19
Working with vibe coders be like
1
4
14
496
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Liste@endliste
Oct 18
Just found out about recency bias. Maybe the most important bias ever
341
13,615
212,842
3,194,628
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
OpenCode
@opencode
Oct 17
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
725
1,472
11,564
2,879,914
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Calif
@calif_io
Oct 16
Demos we presented at Hexacon in Paris today. Everything will be released in due time. 1/ Signal 1-click
157
538
4,604
600,602
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
jon drake@DrakeGatsby
Oct 16
“In situations like this” what the fuck are you talking about. Are you Wile E Coyote
Umesh Kumar
@itsumeshk
Oct 16
The Roadster could genuinely be a lifesaver in situations like these.
647
12,255
201,964
2,364,941
DPRKEval when?
j🫪e
@0x_Osprey
Oct 16
There are an infinite number of shitposts I could derive from this
1
1
5
600
For @gabsmashh birthday I built her an eink frame that refreshed the NYTimes frontpage everyday! andrewmohawk.com/2026/10/15/…

Building an Eink NYT Frontpage

For Gab's birthday I built a 13.3-inch colour ePaper display which fetches the New York Times front page, keeps five editions and sets itself up without an attached computer.

andrewmohawk.com
gabsmashh
@gabsmashh
Oct 15
got the coolest birthday present ever from @AndrewMohawk, it displays the front page of the Times each day! 🤩
1
2
31
1,764
Load more