Drifter, dreamer, ponderer, schemer, and slothy demonic co-host with @realAzureShady of The MidKnights.
The Somnial Plane
Joined February 2012
- Tweets16.1K
- Following911
- Followers434
- Likes33.1K
Pinned Tweet
Realized I never have a pin up, but here are my links
Twitch:
twitch.tv/themidknights
Rumble:
rumble.com/c/TheMidKnights
Max Tepafray 😈Resident Juxtubus💭 retweeted
Don't let anyone tell you that GPT 6.1 Sol isn't state of the art.
Earlier today, Moonshot team paid countless listen influencers to shill their models, and they specifically instructed them NOT to disclose the partnership.
They also instructed them to say that "GPT 6 Sol was nowhere close," and even more telling that:
"China has closed the frontier gap with the United States in just one month" literally a CCP mouthpiece
Well sorry to tell you @Kimi_Moonshot but you're not even close.
And they know that.
They know, because they fabricated completely fake demos to give to these influencers to share. This model is pretty mid.
They should give all of their computer over to Deepseek 🗑️
And just to show how far the gap is, I generated this with Sol 6.1 in an hour and only used 10% of my weekly.
Max Tepafray 😈Resident Juxtubus💭 retweeted
Many teams SUCK at making software, and “patch everything” is so short-sighted.
Vulnerabilities are a symptom of a larger problem. We’ve been getting away with a lack of engineering rigor for a long time (decades) in most industries.
We’re not making resilient software. We will continue to have issues until most orgs mature how they build, no matter how many times a day you patch.
It’s been a financial decision to prioritize shipping fast, over minimizing brittleness.
As exploitability gets cheaper, it drives up response and maintenance costs.
This may finally incentivize orgs to invest more in software resilience.
And we have the tools: each dev team can now spend tokens analyzing their own code and deployment for security and availability issues. Automate testing, automate dependency upgrades, hold design review and threat modeling sessions.
Slop is what you make it if you’re not investing in mature architectural decisions. And we’ll keep having trivial vulns until you do so.
Max Tepafray 😈Resident Juxtubus💭 retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
Max Tepafray 😈Resident Juxtubus💭 retweeted
And the security shitshow continues... Four more things to add to yesterday's list. We're now at nine(!) major security issues and developments in just a few days.
6. ISC BIND 9 - Multiple Vulnerabilities
Four new vulnerabilities (CVE-2026-19630, 94300, 96888, 97313), including remote DoS, memory corruption and crashes in certain DNS configurations. Fixed in BIND 9.20.30 and 9.21.27.
kb.isc.org/docs/all-bind-adv…
7. Oracle Java / JSSE (CVSS 9.1)
CVE-2026-91403. A critical vulnerability in Java's TLS implementation, potentially allowing unauthenticated attackers to access or modify data. Affects Java 8, 11, 17, 21, 25 and 27, plus GraalVM.
oracle.com/security-alerts/a…
8. Windows SMB Server DoS (CVSS 7.5)
CVE-2026-96325. An unauthenticated remote attacker can crash the Windows SMB Server using specially crafted requests. Not RCE, but still a serious availability issue for exposed systems.
msrc.microsoft.com/update-gu…
9. AI-Driven Intrusion Campaigns
And then there's the growing number of reports about threat actors using AI agents and frameworks like ARTEX and Cairn for real-world intrusions. Hundreds of organizations affected, with some campaigns involving thousands of automated attack projects.
Microsoft / ARTEX:
microsoft.com/en-us/security…
NorForge / Cairn:
norforge.com/blog/inside_cai…
I'm starting to wonder what next week will look like...
(you can find 1.-5. in the quoted tweet)
🤖 Made with AI
This week has been quite a shitshow already, and there are still 2 days to go
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.php#202…
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-20…
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell-…
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell-php-rc…
Corelight’s open-source Zeek and Suricata detection rules:
github.com/corelight/php2she…
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/pat…
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulnerabi…
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unboun…
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
blog.google/security/protect…
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
bugzilla.mozilla.org/show_bu…
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
Max Tepafray 😈Resident Juxtubus💭 retweeted
I think this is completely backwards.
We have mountains of legacy code, unpatched vulnerabilities, and critical systems nobody fully understands because Bill, who wrote them 15 years ago, is now sipping mai tais on a beach.
AI is exactly how understaffed, underfunded security teams can finally fix the basics quickly and at scale.
The attackers are scaling with AI. Telling defenders not to do the same is a death sentence.
Max Tepafray 😈Resident Juxtubus💭 retweeted
Every enterprise PHP shop has one guy who never left the cave, and he has the only SSH key.
Max Tepafray 😈Resident Juxtubus💭 retweeted
Steve Irwin was one of the most passionate animal lovers on the planet. He also wasn’t a vegetarian, and he had a clear reason why.
In a 2001 interview with Scientific American he explained that he went through a phase where he seriously considered going vegetarian. He researched it hard. His conclusion was the opposite of what most people assume.
He used a simple land-use example: one cow could keep him fed for roughly a month. That same piece of land could still have trees, grass, kangaroos, wallabies, goannas, birds, and the rest of the Australian wildlife living in and around it. The cow and the wild animals could coexist.
A plant-only diet for the same period, he argued, required clearing more land just for crops. Once you level that ground for rice or whatever else, almost nothing else can live there except a few pest insects. Habitat gone. Wildlife gone.
He wasn’t anti-meat. He was anti-destroying habitat. And he drew a hard line on which animals should be eaten. He hated the idea of farming or eating Australia’s icons — kangaroos, emus, crocodiles. Those animals were part of the country’s identity and tourism. He wanted people eating the livestock that already occupied grazing land (beef, lamb, etc.), not turning the bush into more monoculture or harvesting the wildlife itself.
On the day he died he had a classic Aussie breakfast: bacon and eggs. He lived a high-output outdoor life and fueled it with real food, not ideology.
Irwin’s position was straightforward: protect the wild animals, keep the land working, and don’t pretend that clearing more ground for plants is automatically better for nature. A lot of modern “eat less meat for the environment” arguments still haven’t grappled with the trade-off he laid out more than 20 years ago.
> Be me.
> Spend all day excited for a vibe coded project where I screw around with virtual gameboy in VR and take pictures
> I spend half an hour trying to put the wrong batteries in the gameboy
> MFW vibe coding makes me an excellent tester
Max Tepafray 😈Resident Juxtubus💭 retweeted
So this is an interesting story. How eMudhra became the foundation of global internet. Im surprised that no news channels are digging up the root CA history. Maybe people dont know that this is public information.
groups.google.com/g/mozilla.…
So this is the discussion list for mozilla security policy back in 2018. When emudhra first applied for inclusion as a root ca.
One of the maintainers questions eMudhra's credentials as an "Indian co".
The filing in response is very interesting.
"eMudhra has been a licensed CA under
Controller of Certifying Authorities which operates the Indian
Government Root for more than 10 years and is also a licensed CA in
Mauritius under Ministry of IT, Mauritius. eMudhra has issued over 35
million digital certificates (3% of India’s population).
eMudhra is a critical partner to Digital India and supports the usage of
digital signatures on a variety of eGovernance platforms for
Government of India including Company Law Board, Income Tax, Goods
and Service Tax (GST / VAT), eProcurement, Travel Portals, Customs,
Banking etc. eMudhra’s solutions power digital signature and other
multifactor authentication for over 35 Banks which include domestic
and global Banks. eMudhra also has a proprietary CA solution which is
today used by the Indian Army and other defense establishments."
Eventually mozilla HAD to accept, because emudhra claimed publicly - "But this was not a complete Webtrust audited setup. Rather, it is under Government of India." – at San Francisco, CA
Max Tepafray 😈Resident Juxtubus💭 retweeted
And now, RCE in DNS. Kill me.
kb.isc.org/docs/cve-2026-943…
Dwelling on a a project idea for this weekend. A security gate proxy for those that can't update PHP on their servers.
No, because if they could make the keys, they'd also be able to sell certs of any domain. The only way I could see this benefitting a malicious actor is if the goal was *memorizing* the private key to sneak out.
What blows my mind is I don't think I've ever used a key generator that didn't do the number generation for you.
Literally one of the biggest rules: "Don't make your own cryptography if you don't have to"
