Just passed my over $10,000 exam, GIAC GWAPT Certified ✅ The journey was long, the late nights were real, and it was worth every bit. Huge thanks to @sisinerd who took a chance on me that I’m worth this & to @SANSInstitute for the incredible partnership with @cybersafehq

they’re calling it “Black October” and i don’t think people realize how serious this is in the last 48 hours there have been over 27 major cybersecurity incidents. not in a month. not in a week. in 48 hours any ONE of these would normally be the biggest story of the year PHP: critical vulnerability in the software running 80% of the web. severity 9.2 out of 10 Node.js: high-severity flaw letting attackers take over servers remotely. affects versions 22, 24, and 26 Java: also compromised. three of the most used programming languages on earth hit at the same time GitLab: a perfect 10 out of 10 severity hole in every version since 2014 Railway: hosting platform compromised. API keys for OpenAI, Claude, Stripe potentially exposed Signal: a bug that could leave your mic and camera on after you hang up WordPress: hackers stole a plugin maker’s keys and planted backdoors on websites LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer and that’s not even half the list thousands of AI agent swarms are reportedly scanning and attacking vulnerable servers right now. automated. around the clock security researchers are saying this might be the early stages of a global cyber incident that nobody fully understands yet if you run a website, use cloud services, store API keys on hosting platforms, or use any software built on PHP, Node.js, or Java you are potentially affected update everything. rotate your API keys. change your passwords on critical services. enable 2FA everywhere you haven’t already this is not a normal week on the internet. this is something different

And hosted on railways

Imagine running PHP and Go on the backend, Node.js on the frontend, NGINX as the reverse proxy, Linux as the server, an HTTPS certificate from eMudhra And also deploying everything via GitLab ☕️

What a creative way to celebrate cybersecurity awareness month

This seems bad.

working in cybersecurity can truly turn an atheist into a man of faith

🚨 Security vulnerabilities reported in a SINGLE day: PHP — 2 CVEs Node.js — 10 CVEs NGINX — 5 CVEs Go — 1 CVE GitLab — 12 CVEs eMudhra — CA certificate compromise

It took 17 minutes to turn the Gitlab RCE to a working HEAP exploit using Gemini 4 Argon and the advisory, then another hour for the complete chain - super fun for someone like me without any binary exp or source code review experience, new cyber era! Great find by @joaxcar!

🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases. CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers. Read - thehackernews.com/2026/10/cr…

🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST. Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using: 🟧 ActiveScan++ v2.0.13 (portswigger.net/bappstore/31…) 🟧 Bambda scan checks (github.com/PortSwigger/bambd…) 🟧 BChecks (github.com/PortSwigger/bchec…) Start scanning for the vulnerability now → portswigger.net/bappstore/31…

As if PHP2Shell wasn't enough for one day... now GitLab. 😅 🚨 CRITICAL GITLAB ALERT (CVSS 10.0) CVE-2026-110264 could allow unauthenticated RCE on self-managed GitLab servers. ⚠️ Potentially affects 12 years of releases, dating back to 2014. Patches available. Update immediately! docs.gitlab.com/releases/pat… #gitlab #cybersecurity

The Gemini 4 Era 👾

Researchers at @wiz_io put Gemini 4 Argon to the test against complex cyber threats. In real-world testing, it found more than two times more vulnerabilities than baseline models — catching a critical risk that previous frontier models missed. See how they did it ↓

So the model that helped find the PHP bug is now also the one checking if my site has it.. full service 😂

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

This looks serious.

Copies are now going out to pre orders from today 🚀🚀🚀🚀🚀🚀💃🥳

Glad to share that I’ve been accepted into @Stanford Probability for AI, selected from 20,000+ applicants through @StanfordCodeIP My AI safety journey taught me that you cannot protect what you don’t understand. I realised I needed to understand the mathematics behind AI🧵