Stanzilla @stanzilla

hi. Also tweeting via @WeakAuras. Work @FACEIT. weakauras.wtf Munich Joined October 2009

Tweets

35K
Followers

1K
Following

1K
Likes

17K

Stanzilla @stanzilla

4 hours ago

@BenjaminPasero @jarredsumner hey there, any chance we can make this better/more consistent?

0 0 0 68 0

View Details

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

827 7K 54K 2.6M 18K

View Details

Marathon Fusion @MarathonFusion

15 hours ago

Last month, we demonstrated high-rate alchemy: turning mercury into real, stable gold, beating CERN’s record by a factor of 10. Last week, we enriched isotopes in the world’s most powerful plasma centrifuge, beating the Soviet record that stood for 40 years. Now, we’re building a fusion reactor in San Francisco to achieve record power density.

549 1K 10K 2.4M 6K

View Details

Node.js @nodejs

13 hours ago

🔐 Node.js security updates are now available! New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues. Review the details and update your systems to stay secure. 🔗 nodejs.org/en/blog/vulner… #NodeJS #Security

113 3K 10K 958K 3K

View Details

Stanzilla @stanzilla

12 hours ago

Man @t3dotcodes is so good. Such a breath of fresh air from whatever happened to Codex recently.

0 0 0 74 0

View Details

Stanzilla @stanzilla

13 hours ago

@pierrecomputer I noticed it's missing CSV though, any plans?

1 0 0 5 0

View Details

Stanzilla @stanzilla

15 hours ago

the world needs more Pierre products

Pierre @pierrecomputer

19 hours ago

Today we're launching an exciting new project: Highlights Highlights is a syntax highlighter that outputs HTML. It improves on both speed and correctness compared to the existing industry standard libraries. It's an optional drop-in replacement in Diffs, and it's ready to use

25 42 819 46K 470

1 0 2 202 0

View Details

Nicolas Krassas @Dinosn

18 hours ago

Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )

76 363 3K 458K 851

View Details

John Althouse @4A4133

15 hours ago

Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this. foxio.io/blog/header-ac…

70 404 3K 369K 893

View Details

Stanzilla @stanzilla

13 hours ago

@thsottiaux when EU release though?

0 0 2 812 0

View Details

Stanzilla @stanzilla

15 hours ago

NOICE

Charlie Marsh @charliermarsh

18 hours ago

An update here: we’re upgrading all Codex for OSS grants to Pro 200! There will still be the 10,000 grants in this round, now at the higher tier. (If you've already received a grant, the upgrade should be reflected automatically.) Applications are still open :)

51 14 354 72K 96

0 0 1 96 0

View Details

Stanzilla @stanzilla

15 hours ago

@thsottiaux @claudeai Both not available in the EU, already something in common!

0 0 1 309 0

View Details

Stanzilla @stanzilla

15 hours ago

@felixrieseberg sad that it is US only...

0 0 0 81 0

View Details

Felix Rieseberg @felixrieseberg

16 hours ago

If you're into research previews, we're opening up a waitlist for Claude Duet, our take on a lightweight proactive agent. The form factor will seem pretty familiar, lots of agents out there - but Duet is made for work, excellent judgement, and making sure it doesn't do things you didn't want. claude.com/product/claude…

57 17 461 23K 59

View Details

Stanzilla @stanzilla

18 hours ago

BioWare @bioware

18 hours ago

28K 40K 316K 26.7M 35K

0 0 1 200 0

View Details

Stanzilla @stanzilla

19 hours ago

@Chris123NT ya

0 0 0 4 0

View Details

Stanzilla @stanzilla

22 hours ago

`as long as the Xbox PC app is installed on your PC` 😡

Tom Warren @tomwarren

22 hours ago

Nvidia’s latest GPU driver brings a new way to speed up PC games. Microsoft’s new Advanced Shader Delivery technology is now part of Nvidia’s drivers, and it should speed up game launches and reduce stuttering and CPU spikes. Details 👇 theverge.com/news/1015299/n…

39 119 1K 61K 220

1 0 1 216 0

View Details

m@ttias ⚡️ @mattiasgeniar

22 hours ago

PHP Patch is out!! PHP 8.5.12: 31c0ea7d7f github.com/php/php-src/co… PHP 8.4.27: 506e87fa7d github.com/php/php-src/co… PHP 8.3.36: 3c832b523e github.com/php/php-src/co… PHP 8.2.35: 01a40e89fb github.com/php/php-src/co… The two advisories with the full details: GHSA-w8hw-w9fx-j79w (CVE-2026-109618) github.com/php/php-src/se… GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) github.com/php/php-src/se…

10 49 296 457K 128

View Details

Seb ⚛️ ThisWeekInReact.com @sebastienlorber

a day ago

Hey, this tsrs port can also speed up oxlint 😄 github.com/maschwenk/tsrs…

Cloudflare @Cloudflare

2 days ago

Cloudflare is collaborating on tsrs, a Rust port of TypeScript that is up to 8x faster and uses 70% less memory. cfl.re/3Whs9bC

20 81 1K 73K 220

7 6 203 10K 34

View Details

Kostas @Kostastsale

a day ago

A moron has released a POC early for php2shell so here is what you need to do: If you’re on version prior to 8.2: Edit php.ini: session.upload_progress.enabled = Off Then reload php-fpm and restart apache If you’re on later version: Update (it’ll be available in a few hours) In any case, the mitigation for the php.ini should work either way. Not sure if it’ll cover both vulns though so keep an eye on that. I’ll be reporting on follow up activity on windows as a target. Good luck!