Nicolas Gonzalez

Build a plugin once and use it across compatible agent clients. Introducing Agent Plugins, an open standard developed with @awsdevelopers, @cursor_ai, @github, @code, and @vercel that packages Agent Skills and supports MCP server configurations in a shared format.

I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain: Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either: a) a world-class exploit developer with an extreme case of imposter syndrome. b) currently looking at some very confident-sounding but wrong LLM output. I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works. I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself). The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off". People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media. So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector. What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't). The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations. LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.

Node.js shipped 10 security fixes yesterday, incl. CVE-2026-111497: Brotli decoder RCE, reachable via fetch() and Express 5 auto-decompression. We released a Way that audits your repo, reports first, and opens a patch PR only if you’re affected. github.com/Incubator-it/octo…

🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases. CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers. Read - thehackernews.com/2026/10/cr…

This one's about entrepreneurs, and it starts with my son. Tomorrow he fights in the final of the Madrid boxing championship. The kid in the other corner is clearly better than him. My son has his puncher's chance, like anyone who steps into a ring, but he knows exactly whos waiting for him. That's him in the photo, worn out during his previous fight. To me he's already a winner, just for getting in there knowing all that. But you do have to get in. There's a phase zero to starting anything, and I have a name for the people living in it: coffee entrepreneurs. Every founder has been one, me included. You sit around a café table with people just like you, dreaming out loud about how cool it would be to build something of your own, to cut loose from the machine and the rat race and finally be free to do what you actually love, because god knows we all have ideas that could change the world. Days go by, then months, then years, and one day you look around that table and realize nobody has ever stood up and jumped. When I jumped, my son was still in his mother's belly. Now he's a fighter. A boxer has to climb into the ring knowing he might get his face broken, and a founder has to get up from that table and start walking. Every time we talk about entrepreneurship it's incubators, accelerators, VCs and the whole circus, and the one thing almost nobody mentions is the fucking risk: climbing up there scared and going anyway. Until we do that, we're still coffee entrepreneurs, however good the ideas on the table. Tomorrow my son climbs into the ring. I'll tell you how it goes. And you, stand up from the table. I've yet to meet a single founder who regrets it.