I watch the bots so you don't have to. Current reports from the edge in front of 3,565+ websites: who's scanning, what they want, and how they dress up.
The edge
Joined April 2022
- Tweets2.1K
- Following299
- Followers404
- Likes1.2K
Pinned Tweet
opencode, railway, then php. a wild week for disclosures.
digging into the first two, something stood out.
years of logs: zero probes mentioning railway
but then in june 2026: one for railway.json.
september: 12 more varied requests.
finally oct 10… 🧵
this is an interesting perspective to what we are seeing in security.
basically suggesting we are the honeypot.
to see so much activity this month and the nothing burger that the php cve actually was makes a case to release neutered cve and see who does what. 🤔
i fight bots on my 3,604 websites.
i see weird stuff everyday.
if you are:
🦄 shipping vibe-coded apps
💻 a builder or indie hacker
🐘 running php or laravel
🍯 into honeypots
🏠 hosting your own stuff
let's connect!
tell me about weird web experience you've had.
1/3: i started seeing double-digit HTTP POST activity on october 10 from bad actors.
it peaked on october 18 @ nearly 20k requests/day.
on the 21st, i started tagging it and actively penalizing it. this isn't a common probe.
dig in with me. does this look like foreknowledge of the php cve? 🧵
3/3: the last 24 hours have been "spray and pray".
attacker is still pushing multiple php cve attack sequences, but iterating over multiple hosts.
Mr. Nice Try retweeted
🚨Update: PHP has flagged another potential RCE issue, CVE-2026-115560.
Advisory: qz.com/php-vulnerabilities-a…
The PHP2Shell patch wasn’t the end of the story. If you’re running PHP, check the latest advisory and mitigation.
One patch isn’t a substitute for staying updated.
Two critical PHP vulnerabilities. Both can lead to remote code execution without authentication.
And the patches are already out.
CVE-2026-109618 and CVE-2026-109619 affect PHP’s core memory and error handling.
Fixed versions:
• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
Don’t just check your server’s PHP version.
Check the runtime inside your Docker images and production containers too. Restart PHP workers after patching and verify the fix is loaded.
PHP 8.1 and older are no longer supported upstream, so upgrading needs extra attention.
Official details and fixes:
thephp.foundation/blog/2026/…
Have you checked which PHP version your production apps are actually running?
my favorite illustration of a buffer overflow.
> reminder: session.upload_progress.enabled = Off
did you do it yet?
🚨ALERT: PHP warns of ANOTHER UNPATCHED security flaw that could let hackers take control of vulnerable web servers, just TWO DAYS after releasing emergency fixes for critical PHP2Shell vulnerabilities.
The NEWLY discovered flaw, CVE-2026-115560, affects websites using an uncommon technical setup.
PHP has urged affected website administrators to disable a specific feature until a security fix is released.
The warning comes as hacking attempts targeting the TWO earlier PHP2Shell flaws have surged into the MILLIONS, per Cloudflare.
Where Things Stand:
- The latest flaw affects only an unusual combination of PHP session settings.
- No exploitation of the new vulnerability has been reported.
- PHP recommends disabling session upload progress until its next routine bugfix release.
Unlike the earlier critical flaws, PHP considers the new vulnerability an unlikely attack vector and is not issuing another emergency patch.
Mr. Nice Try retweeted
BREAKING: Critical PHP flaws, a compromised LiteLLM release and potentially exposed Railway secrets put production systems at risk.
Patch affected systems, rebuild compromised environments and revoke exposed credentials.
7 security issues and what to fix now:
it's october. cybersecurity awareness month.
so be proactive. close the doors before someone tries the handle.
attackers target those who don't look until its too late.
