Making the stuff I wished existed. MacTC GPU & CPU performance monitoring now available!
USA
Joined March 2026
- Tweets3K
- Following566
- Followers1.6K
- Likes11.1K
macintog retweeted
Finding existing vulnerabilities and fixing them was the whole point. Maybe if frontier labs hadn't restricted security uses, fixing things would be further along
macintog retweeted
My non-hacking buddy asked me how much the person who found the php2shell made. Then he made a good observation:
Hack a small company, make a little. Hack a big company, make a lot. Hack 70% of the world, make nothing.
macintog retweeted
You know this php exploit is gonna be a banger when the POC video has an anime lady dancing around
macintog retweeted
Linux on the M6 Mac Mini, Day 6 - GPU is up!
Many of you noticed in yesterday's screenshot it used software rendering. I'm excited to share Omarchy on the M6 now utilizes the GPU.
Almost all the drivers are done, and I'll be starting on the Apple Neural Engine bring-up soon.
macintog retweeted
Yep, Anthropic contributed zero, literally zero value.
All it did was to announce Mythos, said Mythos is going to hack everything, got 50 or so companies to pay millions for access. They helped zero security researchers. Their safety classifier trips when even reading a vulnerability report.
OpenAI on the other hand, rolled out sensible KYC, gave access to Daybreak Blue, and see what the community has done with GPT-5.6-Sol (daybreak version).
One creates all the fear-mongering and delivers zero value, and the other quietly just carries everyone forward.
gotta give it to openai and their sane daybreak program
heif heist by harsh
kvmescape by paulos
php2shell by lcfr
gitlab rces by joaxcar
chrome full chain by moyix
wordpress rce by hashkitten
all largely thanks to openai daybreak giving researchers access to gpt 5.6 sol. anthropic took the opposite approach, gatekeeping access, there is a lesson to be learned here
macintog retweeted
mitmproxy adds --emudhra option
github.com/mitmproxy/mitmpro…
名垂千古了
macintog retweeted
LINUX. ON. THE. IPAD. 🐧🔥
After evenings of DFU retries, my iPad mini 4 is running native ARM64 Linux. Both A8 cores online. Live root shell.
Huge thanks to @henrikklee for sharing guidance from his iPad 6 work.
Next stop: Omarchy.
macintog retweeted
How to patch servers in the current year.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
Wiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…
macintog retweeted
Socket flagged all seven malicious wheels within seven minutes of publication.
The malware runs at Python startup, even without importing LiteLLM. The release workflow built container images from a lookalike repository.
Full analysis: socket.dev/blog/litellm-comp…
macintog retweeted
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.
If you run either stack in production, keep an eye on official advisories and apply patches promptly.
Security maintenance doesn't stop at your application code. Your runtime matters too.
Node.js advisory: nodejs.org/en/blog/vulnerabi…
macintog retweeted
‼️ PHP UPDATE: 4chan has gone read-only and Something Awful has shut its forums as American sites brace for the PHP patch.
4chan says it is "temporarily read-only while we await an urgent PHP security update."
Something Awful says the flaw "allows for the kind of hacking you see in movies (but in real life)."
Bookmarking service Pinboard, game publisher Choice of Games, history site Damn Interesting and the explain xkcd wiki are offline too, as is art site Fur Affinity.
DeviantArt is also down "for maintenance" but has not said why.
PHP's fix is due at 14:00 UTC, 10am in New York.
macintog retweeted
Millions of IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools, etc. are all going to be relentlessly hacked via safely signed malware for the next several years or maybe indefinitely.
eMudhra hack might be the most important event of the year.
macintog retweeted
There is only one answer to cybersecurity threats: Fix your shit.
Scared of threat actors using AI? Worried about rogue agents? Think abliterated models are spooky? Fix. Your. Shit.
The "ban AI models and regulate GPU access" crowd should instead fix their shit.
macintog retweeted
Fifty attempts to boot Omarchy on my iPad mini 4.
DFU works. Pongo loads. Linux, so far, does not.
I do have logs. I also have an unreasonable amount of stubbornness.
iOMARCHY is very much still a work in progress. If you’ve ever got Linux running on an old iPad, I’d love to hear how 👀
macintog retweeted
After upgrading to macOS 27.0.1, my 2017 LG UltraFine started acting weird! Randomly going black, USB controller no longer being recognized... etc...
Downloaded LG Screen Manager from the App Store (1-star rating lol) and noticed a firmware update was available. But the updater kept crashing.
Apparently, this has been a known issue on Apple Silicon since the M3 and macOS 26, but @LGUS hasn't given a shit about fixing it for two years.
So I gave Codex Astra the IPS crash report. It identified a double-free memory error, downloaded the latest firmware, patched the updater with a 30-line Python script, and code-signed it ("untrusted developer" warning, but who cares).
Ran the patched updater, and my monitor is back to life. All issues gone.
Wild times. All of that took me 15 minutes. What a time to be a dev.
Shame on LG, though.