Pinned Tweet
Je vais épingler ce tweet qui convient si bien au moment...
Par quelle aberration ne supporte-t-on plus l’ironie ou le mauvais esprit ? Veut-on seulement des caniches, des ravis de la crèche et des «robots vertueux» qui, depuis qu’ils ont escaladé le tabouret de la morale, nous expliquent leur supériorité ?
2
7
kick tweet retweeted
NVIDIA CEO Jensen Huang asked 4 tiny robots to sit, stand, nap, and do somersaults.
And they actually did it.
NVIDIA is bringing AI agents from virtual world to real world with these robotic ducks.
66
126
913
106,460
kick tweet retweeted
Sugerencias para enfrentar el dia de hoy en ciberseguridad con lo de la vulnerabilidad en PHP.
Primero: somos todos colegas, dejense de putear uno a otro. Esta falla como miles de CVE existian desde hace decadas. La IA la descubrio, ningun humano mortal, asi que nadie es mas que otro.
Segundo: Parchear no resuelve nada, incluso puede complicar mas las cosas, a quien le resuelve la vida parchear hoy? al minimo porcentaje que tenia todo actualizado hasta la semana pasada, y todo incluye codigo fuente y sistema operativo, dudo que sea el 5% con suerte. Si sos de ese minimo porcentaje, si parchea. Sino:
Tercero: muchos servidores corren muchos servicios al mismo tiempo, no tienen servicios distribuidos, entonces para que el exploit no te afecte por un ataque directo o de bots es preferible perder disponibilidad que integridad y confidencialidad, una de los tres pilares de la ISO 27001, y este debate sera algo que vendra a futuro. Yo elijo la indisponibilidad en este escenario caotico antes que poner en riesgo la otras dos. Por eso apaga Apache, NGINX u OpenLight Speed. No alcanza con un WAF, ahora. Con eso el servidor, menos las webs quedan operativos.
Cuarto: La falla viene desde PHP 5 que sigue recontra productivo como el 7, si bien dicen que el soporte solo es de 8.2 en adelante, es posible que se den dos escenarios debido a la gravedad el asunto: que en breve salga un update para versiones viejas de manera extraordinaria o que podamos aplicar un cambio de configuracion en PHP que permita que esa vulnerabilidad no se pueda explotar.
Quinto: Quienes piensen que dejar todo expuesto esta ok y un backup te salva, estan en un grave error, pueden crear persistencia, robo de informacion, inyectar codigo malicioso para terceros, es decir, solo vas a agrandar tu problema.
Sexto: PHP es un gran lenguaje, por algo es el mas utilizado en Internet, los detractores son personas que les molestan cositas como que la variable no tenga que obligatoriamente declararse por tipo o que simplemente su curva de aprendizaje sea facil. Ojo que Node.js hoy justamente tambien esta en el horno y asi otros lenguajes como .NET y IIS.
Septimo: no rompan mas las pelotas, si van a comentar: aporten y ayuden, si van a criticar y jamas en su vida gestionaron nada, corranse del camino, que no nos perdemos de nada.
24
93
635
63,128
kick tweet retweeted
Somewhere, a CTO just found out their servers still run PHP 5.6 💀
149
1,320
8,857
527,975
kick tweet retweeted
As AI becomes more capable, I'm focused on questions around the pace and implications of progress, and how they should inform the strategy of OpenAI and across the field. I asked Aleksander to come back to OpenAI to work with me on these topics. I value his judgment and am glad to have him on the team again.
Personal update: Turns out that what I thought was leaving OpenAI became more of a sabbatical.
When I left a few months ago, I felt that the most important thing to focus on was making AI more useful to people. But we’ve since entered a different regime of AI progress. One in which getting the safety and security challenges of increasingly capable AI right has to become a central priority.
So I’ll be returning to OpenAI, joining @merettm to help chart a path through these challenges.
There’s much work to do, so let’s get going.
41
60
1,342
120,648
kick tweet retweeted
Personal update: Turns out that what I thought was leaving OpenAI became more of a sabbatical.
When I left a few months ago, I felt that the most important thing to focus on was making AI more useful to people. But we’ve since entered a different regime of AI progress. One in which getting the safety and security challenges of increasingly capable AI right has to become a central priority.
So I’ll be returning to OpenAI, joining @merettm to help chart a path through these challenges.
There’s much work to do, so let’s get going.
173
126
3,593
1,535,495
That’s Ai too
Not only doom
Cc @SamuelFitouss10
People who cured / are curing their own cancer on X:
1/ @sytses - bone cancer, billionaire founder of Gitlab, developed 10+ personalized therapies for himself.
2/ @paul_conyngham - shrank his dog Rosie's mast cell cancer tumors after chemo and surgery weren't enough. Now backed by YC and Founders Fund
3/ @miriamgonp - stage 4 breast cancer, tumor sequenced, searching for vaccine manufacturer now
4/ @kevinace - stage 4 lung cancer, angel investor in 300+ companies, first drug stopped working after 18 months. Vaccine designed, now paying $300k out of pocket for the vaccine
5/ @masonbgrant: going founder mode on his his 32-year-old wife's rare liver cancer, sequencing her tumor with AI agents
6/ @ArunRLverma: former product leader at Atoms and Shopify, brain tumor, built a vaccine from his tumor. Now building an AI health agent startup based on what he went through
We're going to make it
31
kick tweet retweeted
People who cured / are curing their own cancer on X:
1/ @sytses - bone cancer, billionaire founder of Gitlab, developed 10+ personalized therapies for himself.
2/ @paul_conyngham - shrank his dog Rosie's mast cell cancer tumors after chemo and surgery weren't enough. Now backed by YC and Founders Fund
3/ @miriamgonp - stage 4 breast cancer, tumor sequenced, searching for vaccine manufacturer now
4/ @kevinace - stage 4 lung cancer, angel investor in 300+ companies, first drug stopped working after 18 months. Vaccine designed, now paying $300k out of pocket for the vaccine
5/ @masonbgrant: going founder mode on his his 32-year-old wife's rare liver cancer, sequencing her tumor with AI agents
6/ @ArunRLverma: former product leader at Atoms and Shopify, brain tumor, built a vaccine from his tumor. Now building an AI health agent startup based on what he went through
We're going to make it
107
629
4,874
454,704
« Now the detector punishes the human for writing like a machine and rewards the machine for writing like a human »
The em dash vanished from machine text because it annoyed readers, and from human text because writers kept getting mistaken for bots. Now the detector punishes the human for writing like a machine and rewards the machine for writing like a human ↓
29
kick tweet retweeted
The em dash vanished from machine text because it annoyed readers, and from human text because writers kept getting mistaken for bots. Now the detector punishes the human for writing like a machine and rewards the machine for writing like a human ↓
27
222
1,519
2,433,448
If you are wondering whether your website is affected, we have packaged a Codex skill to help check.
Point your Codex at this repo to guide you through it: github.com/openai/php2shell-…
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Community note
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
355
1,221
9,422
1,495,362
kick tweet retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
918
7,074
58,018
3,839,071
kick tweet retweeted
Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative.
174
338
3,632
399,353
kick tweet retweeted
Silicon Carne vient de passer les 100 000 abonnés sur YouTube, mais le chiffre qui me touche le plus, c’est celui d’à côté : 1 000 vidéos.
Il y a sept ans, c’était un podcast audio enregistré dans mon salon avec trois élastiques et deux cure-dents. Merci à l’équipe et à vous tous d’avoir suivi. On reste tout petit, prochaine étape : 500 000, puis 1 million.
Vendredi, on fête ça dans L’After Work avec une énorme FAQ où on répondra à toutes vos questions. Si vous en avez, n’hésitez pas, posez-les en commentaire à ce post : n'hésitez à y ajouter de la sauce 🌶️
20
13
186
8,079
kick tweet retweeted
AI models can self-replicate and spread like worms without datacenter infrastructure?
Yeah, no.
Let's examine the actual evidence:
1. No self-replication. A controlled test harness spawned the agents.
2. No hacking. Access was deliberately left unauthenticated.
3. No agency. Agents were explicitly instructed to propagate.
4. No autonomous survival or defensive behavior.
5. Tiny models lacked the capability. Capable models ran elsewhere.
6. 15 devices managed a pathetic 0.39 tokens/sec.
7. No demonstrated real-world infection or propagation.
The experiment was engineered to succeed, and even then, it failed to demonstrate the headline.
This is orchestrated automation dressed up as a rogue AI threat.
Stop confusing speculative scenarios with demonstrated capabilities. Fear isn't evidence.
anthropic.com/research/self-…
54
95
348
30,891
kick tweet retweeted
Elon can put satellites in orbit for $74M
Today, it costs about $80M to ship one tanker of oil from the Middle East to China
Space is officially cheaper than the ocean. Wild times.
62
133
4,093
64,563
