@manicode
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States App Store
Account-level information from X, not a live location or the device used for a specific post.
AI and AppSec Educator. Secure coding system prompts. https://xitter.cf/t.co/p2rffklf1a
Kauai, HI and Cobb, CA
Joined July 2009
- Tweets45K
- Following6.3K
- Followers17.5K
- Likes34.1K
Pinned Tweet
From my experience all software developers are now security engineers wether they know it, admit to it or do it. Your code is now the security of the org you work for. #GoldenAgeOfDefense – at Wat Ket, Thailand
Jim Manico from Manicode Security retweeted
Railway is compromised, rotate all API keys as soon as possible
Deployments are down so don’t wait to redeploy
Attackers are draining keys in real time, we didn’t lose much but can confirm this is still an active attack
Stay safe friends
I learned the hard way today that @Anthropic Mythos 5.1 access for pro accounts counts under your limited Fable access. Dang. Even when reading the docs, this program is hard to deal with.
@OpenAI CVP is much smoother.
Jim Manico from Manicode Security retweeted
I have a feeling that PHP2Shell fixes will be similar to the Log4j saga. We have the initial fix, which might be incomplete. And now everyone is poking around. This means we will start seeing new bugs and new exploits in the next few days and consequently new PHP releases (similar to Log4j 2.15, .16, .17)
Jim Manico from Manicode Security retweeted
Somebody just reminded me, obviously humorously... So I'm diligently passing it along. ...Happy Cybersecurity Awareness Month!
I’m getting polite feedback that I’m leaning too hard into AI and should go back to talking more about developer AppSec topics.
Devs, what security topics interest you these days?
Jim Manico from Manicode Security retweeted
⚠️ Node.js is vulnerable to remote code execution.
CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code.
You’re exposed if your app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser)
Aikido detects this. Patches are available.
The prompt that discovered today’s PHP zero days was:
“find bad vulnerabilities in PHP"
I 💩 you not.
This is the power of AI.
Jim Manico from Manicode Security retweeted
This week has been nonstop for infosec, with security issues involving PHP, Node.js, GitLab, LiteLLM, OpenCode, and eMudhra.
The pace of vulnerability discovery and security incidents highlights the need for greater automation across vulnerability identification, exploitability assessment, and remediation.
One of the biggest challenges isn't necessarily generating fixes, but validating and deploying them safely. Without sufficient automated test coverage, regression testing, and deployment safeguards, even fixes generated in minutes can take significantly longer to ship. The bottleneck shifts from producing a fix to establishing confidence that it wont break something else.
Addressing this requires more than better security tooling. It requires an engineering culture that prioritizes testability, automation, and safe deployment practices. Organizations that haven't made these investments will increasingly feel the pressure to do so.
Some wise words from one the AppSec OG’s.
This week has been nonstop for infosec, with security issues involving PHP, Node.js, GitLab, LiteLLM, OpenCode, and eMudhra.
The pace of vulnerability discovery and security incidents highlights the need for greater automation across vulnerability identification, exploitability assessment, and remediation.
One of the biggest challenges isn't necessarily generating fixes, but validating and deploying them safely. Without sufficient automated test coverage, regression testing, and deployment safeguards, even fixes generated in minutes can take significantly longer to ship. The bottleneck shifts from producing a fix to establishing confidence that it wont break something else.
Addressing this requires more than better security tooling. It requires an engineering culture that prioritizes testability, automation, and safe deployment practices. Organizations that haven't made these investments will increasingly feel the pressure to do so.
Jim Manico from Manicode Security retweeted
🚨 BREAKING: Node.js just dropped its OWN security bombshell.
4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.
→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity.
→ REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely.
→ TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions.
→ Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to.
→ THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates.
→ RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches.
→ PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers.
PHP AND Node.js both facing major security disclosures on the SAME DAY.
If you run a website or application, TODAY is the day to check your servers.
And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated.
Don't be the last one to patch.
🚨 A MASSIVE internet security emergency is unfolding right now. 🚨
Two CRITICAL vulnerabilities have been discovered in PHP, potentially putting millions of websites at risk.
→ NEARLY 70% of websites with a known server-side language run PHP. The potential scale is ENORMOUS.
→ TWO CRITICAL security flaws have been confirmed, each scoring 9.2/10 in severity.
→ Attackers could potentially take control of vulnerable servers remotely, without authentication.
→ Reports suggest PHP versions dating back to 2004 could be affected. The exact scope is still unconfirmed.
→ EMERGENCY PATCHES are scheduled for TOMORROW at 10 AM ET. Website owners are being urged to prepare immediately.
→ Europe's CERT-EU is warning organizations to patch ASAP or consider TAKING EXPOSED APPLICATIONS OFFLINE if they cannot be secured.
→ WordPress, Magento, Laravel and potentially millions of other PHP-powered websites could be at risk.
→ Once patches go public, hackers could reverse-engineer them and race to attack servers that haven't updated.
The vulnerabilities are CONFIRMED. The full technical details remain secret.
Tomorrow, the race between hackers and defenders begins.
This could get ugly. FAST.
The last 48 hours of cyber news is 🔥:
• PHP: critical RCEs
• LiteLLM: compromised release
• eMudhra: CA private keys compromised
• GitLab: CVSS 10 RCE
• FortiSIEM: public RCE exploit
• Signal: call hangup flaw
• Oracle: 1,295 security patches
Respect to the teams responding.
Jim Manico from Manicode Security retweeted
It's days like today with #PHP2Shell responses that remind me to dust off the old "A Few Good Men" spoof I made for why WAFs are critical for a layered defense.
A FEW GOOD WAFS 😂
Jim Manico from Manicode Security retweeted
Invented a new form of WAF???
Uh, your only about 15 years late to the party for correlating inbound/outbound data for detections...
From my @BlackHatEvents talk from 2011
media.blackhat.com/bh-dc-11/…
Jim Manico from Manicode Security retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Jim Manico from Manicode Security retweeted
AI writes more code than ever, but security isn't keeping pace.
Our 2026 GenAI Code Security Report found an average security pass rate of just 56%.
Tomorrow, join @WeldPond and @manicode to explore the findings and practical ways to close the gap. veracode.com/resources/webin…
Jim Manico from Manicode Security retweeted
I'm excited to speak with @manicode tomorrow on how LLMs often write code with vulnerabilities if you don't give them any security intent and how we can improve GenAI secure coding.
AI writes more code than ever, but security isn't keeping pace.
Our 2026 GenAI Code Security Report found an average security pass rate of just 56%.
Tomorrow, join @WeldPond and @manicode to explore the findings and practical ways to close the gap. veracode.com/resources/webin…
Jim Manico from Manicode Security retweeted
News: LiteLLM 1.107.0 on PyPI shipped a credential stealer. All 7 wheel files carried malware that runs every time Python starts, even if your code never imports litellm. It grabs SSH keys, AWS, GCP and Azure keys, browser passwords, env vars and CI secrets. PyPI has quarantined the release.
If you installed 1.107.0, treat the machine as hacked. Delete the cook.pth, cook.py and sitecustomize.py files it dropped in site-packages, rotate every key it could reach, and pin an older version.
aisle.com/blog/litellm-11070…
Jim Manico from Manicode Security retweeted
Please read my latest Forbes Article and share your thoughts. I share my journey on helping to scale and navigate "Security: Series C To NYSE IPO And OCC Chartered National Trust Bank"
forbes.com/councils/forbeste…
These milestones were collective achievements, made possible by dedicated colleagues and leaders across @BitGo . I remain grateful to @mikebelshe and all my colleagues for the opportunity to have contributed to the journey.
I know there is more to come!
@NYSE
@USOCC
#Fintech #Banking #DigitalAssets
I'm going to be on a podcast tomorrow with @Veracode and the OG himself, @WeldPond
Please join us!
veracode.com/resources/webin…
Jim Manico from Manicode Security retweeted
We are always so grateful for our sponsor, @Xbow!
XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days
XBOW researchers and GPT-5.6 Sol discovered and built a Chrome full-chain exploit in less than a week, showing how an attacker could use Chrome to remotely take over a Windows machine.
The breakthrough highlights how the cost and time of finding serious vulnerabilities are falling fast, for attackers and defenders alike.
Get details on the exploit and what it means.
xbow.com/blog/xbow-built-a-c…
