Cyber guy. These are my personal tweets.
- Tweets 1,454
- Following 944
- Followers 17,568
- Likes 3,237
The Federal Communications Commission has told TP-Link that some of its Wi-Fi routers are violating power level limits, a move that could pave the way for additional bans on the California-based tech company’s equipment bloomberg.com/news/articles/…
3
1
7
22,174
Rob Joyce retweeted
"the research team caught an Alibaba Qwen3.8 model doing something that should never happen. Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Cohere’s sandbox system blocked the attempt, but the action raises a number of questions about the safety of these models"
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
37
46
724
82,871
Update: Our PHP exploit is now production-grade.
* stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load
* ARM64 + x86-64 targets
* MediaWiki, WordPress, phpBB, Laravel
* Apache/mod_php and nginx/php-fpm -> root
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
eliastaylor.com/noexploit/
33
104
675
107,664
Rob Joyce retweeted
I took a closer look at the stealmybitcoin.com CTF, which aims to demonstrate that PHP2SHELL is not realistically exploitable. So I gave it a try.
Note: My analysis could be wrong, and I'm more than happy to be proven otherwise.
Here’s what I found:
• The server responds with Server: nginx and X-Powered-By: PHP/8.4.26.
• My differential fingerprinting scanner independently confirmed at least PHP 8.2+
• Hypotheses: I considered two possible setups:
◦ nginx → PHP-FPM
◦ nginx → Apache → PHP-FPM/mod_php
• After comparing the server's behavior against local test environments, the closest match appears to be nginx → PHP cli-server.
Plot twist: the response behavior is consistent with the PHP cli-server serving a static index.html rather than an index.php. If that's indeed the case, the challenge appears to be intentionally made unexploitable.
My conclusion (for now) is that I'm questioning whether this is a good-faith challenge.
Happy to be corrected if I've missed something!
89
98
2,196
572,174
They are looking to buy a working exploit with bitcoin. 🤣
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
11
22
569
92,004
Rob Joyce retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
1,078
8,935
69,403
4,193,352
Rob Joyce retweeted
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:
php.net/index.php#2026-10-20…
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow
The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.
PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
82
568
2,977
1,027,981
Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. reuters.com/legal/government…
18
62
236
55,212
Rob Joyce retweeted
Faszinierende Technologie:
Die Ukraine migriert russische Bots in die Cloud.
214
3,095
25,581
558,990
Rob Joyce retweeted
America's most popular router maker just got sued by five states for hiding how Chinese it really is.
Florida, Iowa, Nebraska, Montana, and Texas all allege the same thing about TP-Link, which controls 60% of the U.S. market: routers marketed as "Made in Vietnam" are actually assembled there with nearly all parts imported from China. Research, development, and manufacturing largely stayed in China too.
Nebraska's lawsuit names the law that matters most: China's 2017 National Intelligence Law, which compels Chinese companies to hand over data to state intelligence on request.
This isn't theoretical. The NSA and Microsoft have already documented Chinese state hackers exploiting TP-Link vulnerabilities to attack American organizations. Many of the compromised models can't even auto-update anymore.
33
228
625
23,268
Rob Joyce retweeted
Today, we sued TP-Link for lying about the safety of its routers and its ties to the CCP.
TP-Link sold Floridians the digital front door to their home network while misrepresenting how secure it was, how separated the company was from China, and what could happen to their data.
186
1,366
5,505
607,315
Rob Joyce retweeted
Math is progressing by hours now, not years
We are publishing an update to OpenAI Problem #109 (integer multiplication) with a substantial further tightening:
T(n) = O(n (log n)^(1 − κ)),
With κ = 2⁻⁷⁸ (tightened from κ = 2⁻¹⁸²)
Approximately 570 million fold improvement over our previous result and a 2¹⁰⁴ fold improvement over original OAI result.
Our earlier ceiling applied to a cubic bottleneck in the network. The new witness scales quadratically; we haven't established a new ceiling.
The key was using nonadjacent axis swaps to route around the cubic bottleneck. The original manuscript already supported nonadjacent axis swaps. Using them directly reduces layout routing from O(d²) to O(d) swaps.
10
40
1,071
40,860
Best post putting OpenAI math discoveries into perspective. This is revolutionary.
Ok so I took a closer look at the results, and OpenAIs AI-generated mathematics manuscripts are *even more* significant than I initially thought.
I spent the morning going through it. Some thoughts.
The list is absurd. A zero-free half-plane for the zeta function (Re s > 7/8), which is the first result of its kind in over a century. Hilbert's tenth problem over the rationals. The Hodge conjecture for CM abelian varieties. Irrationality of Catalan's constant. Dozens more.
Any one of these would normally be a career.
But the number that many arent seeing is the following: It's 3. That's the average hours of ChatGPT Pro compute per result. A month ago, Navier–Stokes took them around 10,000 agents and 88 hours. That efficency gain within just a few weeks.
Also OpenAI claims to have solved the quasi-Riemann hypothesis. That alone would be a historic breakthrough in mathematics.
This is a weaker version of the famous Riemann hypothesis, which concerns how prime numbers are distributed. The full hypothesis remains unsolved, but the claimed advance would be enormous in its own right.
Math twitter obviously is shocked. Again: this is literally the intelligence explosion happening right now. 2027 will be the year of Superintelligence. Im now convinced by that.
4
9
2,933
Rob Joyce retweeted
Ok so I took a closer look at the results, and OpenAIs AI-generated mathematics manuscripts are *even more* significant than I initially thought.
I spent the morning going through it. Some thoughts.
The list is absurd. A zero-free half-plane for the zeta function (Re s > 7/8), which is the first result of its kind in over a century. Hilbert's tenth problem over the rationals. The Hodge conjecture for CM abelian varieties. Irrationality of Catalan's constant. Dozens more.
Any one of these would normally be a career.
But the number that many arent seeing is the following: It's 3. That's the average hours of ChatGPT Pro compute per result. A month ago, Navier–Stokes took them around 10,000 agents and 88 hours. That efficency gain within just a few weeks.
Also OpenAI claims to have solved the quasi-Riemann hypothesis. That alone would be a historic breakthrough in mathematics.
This is a weaker version of the famous Riemann hypothesis, which concerns how prime numbers are distributed. The full hypothesis remains unsolved, but the claimed advance would be enormous in its own right.
Math twitter obviously is shocked. Again: this is literally the intelligence explosion happening right now. 2027 will be the year of Superintelligence. Im now convinced by that.
HOLY, the rumors were true: OpenAI has published 722 mathematical manuscripts produced by an *unreleased* internal model.
The collection groups them into 372 families of related results, drawn from an evaluation involving approximately 4,000 research problems.
OpenAI says the standard procedure used an average of three hours of ChatGPT Pro thinking compute per result.
The release includes papers, proof artifacts and selected reasoning summaries. The model itself remains unreleased.
123
319
3,042
177,938
Important research by Anthropic GLM-5.3 can be a capable frontier-level cyber actor. Would be interested in the same analysis of Kimi K3…
Confirmation of what was expected: GLM 5.3's safeguards as an open weight model are extremely weak.
Interesting bits:
- Abliteration (removing safeguards) cost only $4,400.
- Abliteration took GLM 5.3's refusal rate from above 90% to about 3% and 2% on two benchmarks and to 12% on the third.
- Abliteration barely reduced model capabilities. Same scores on GPQA and only 4% reduction in cybergym.
- Even with no abliteration, jailbreak methods were still very effective.
- None of the techniques to bypass safeguards that worked on GLM 5.3 worked on Claude models.
anthropic.com/research/glm-5…
6
6
31
8,978
The 13th Annual NSA Codebreaker Challenge is LIVE! Join the mission and test your cybersecurity skills. Visit nsa-codebreaker.org to register and start your first phase today! #CodebreakerChallenge
72
116
336
35,352
Rob Joyce retweeted
If you discover fire, and try to figure out how it works, you're bound to have a few incidents where you accidentally light your own hair on fire.
Fun fact: I had long hair as a teen, and once accidentally lit my hair on fire experimenting with a magnesium bar.
6
2
79
4,050
