Pawel Foremski (@pforemski) header
Pawel Foremski (@pforemski) profile picture

Internet infrastructure security and performance: #IPv6, #BGP, #DNS, #DDoS. @ https://teapaw.org/t.co/Jz50nu108t + @DomainTools + @bgpfixorg

Joined March 2011
Photo by Pawel Foremski (@pforemski)Photo by Pawel Foremski (@pforemski)Photo by Pawel Foremski (@pforemski)Photo by Pawel Foremski (@pforemski)Photo by Pawel Foremski (@pforemski)Photo by Pawel Foremski (@pforemski)Photo by Pawel Foremski (@pforemski)Photo by Pawel Foremski (@pforemski)Photo by Pawel Foremski (@pforemski)
bgpipe v0.23 is out! ~1.5x faster BGP processing (~1M msgs/s MRT→JSON, zero-alloc parsing), and hardened by default: fuzzed parsers, WebSocket auth, peer allow-lists, RPKI over HTTPS, ASPA tested against the IETF draft's examples. github.com/bgpfix/bgpipe/rel…
1
2
120
Pawel Foremski retweeted
I would like to congratulate the organizers of the 2026 Cybersecurity Awareness Month for putting together a truly spectacular event
35
697
32
4,678
96,257
the elements of style, abbreviated 💪
31
Pawel Foremski retweeted
UPDATE: Israeli company we caught delivering zero-click infections is #1 bidder on Starlink ads in 105 countries. Data from @trendai_RSRCH suggests worldwide surveillance op targeting @Starlink users. 1/ By @razhael reuters.com/business/media-t…
🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads. A normal-looking ad loads. If you're a target, you're infected. No click needed. To protect yourself, block ads now. First time it's been confirmed in the wild. We call it #AdFection. Candiru spyware infections at @AJEnglish. 45+ devices infected. Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse. Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC. Investigation ongoing 1/ READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : citizenlab.ca/research/how-d… Confiant's blog: blog.confiant.com/p/adint-we…
91
2,089
150
6,024
268,034
Pawel Foremski retweeted
Millions of attempts is the attacker side. On the defender side, @IPinfo re-checks the same ~1.3M PHP servers every day: the share on a patched release went from 5% to 10% in a day. But servers on old versions with no official fix barely moved: 0.6% upgraded overnight, while 7% went quiet or started hiding their PHP version.
Millions of hacking attempts have been made since critical vulnerabilities were discovered in a PHP, per ABC
3
3
129
Pawel Foremski retweeted
I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain: Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either: a) a world-class exploit developer with an extreme case of imposter syndrome. b) currently looking at some very confident-sounding but wrong LLM output. I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works. I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself). The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off". People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media. So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector. What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't). The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations. LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
139
581
107
3,635
362,120
Heatbit unveils Bitwater: a water heater element that mines Bitcoin. Bitwater screws into the electric hot water heater tank you already have!🔥
51
111
26
803
49,172
We’ve spent the past year developing new primitives for GPUs. We believe this enables new algorithms to change how machines learn, open new markets, and dramatically reshape AI’s cost structure. We have raised a $1 billion Series A, co-led by Index and Lux.
290
226
241
3,823
875,671
Pawel Foremski retweeted
People keep asking me why @calif_io hired @lcamtuf and what he does for us. I guess the cat is out of the bag.
5
11
2
168
14,193
just imagine this handling robocalls... I mean, handling wannabe hackers happy they just broke into an SSH service - how much of their time this could ruin? simedw.com/2026/10/21/world-…
29
Let that sink in...
People outraged about that CA private key just misunderstand math. The probability of generating "4" is precisely the same as the probability of generating any other 115-digit key value, so you really have nothing to complain about.
1
53
Pawel Foremski retweeted
🇵🇱 Okay my final Poland video because we're leaving soon! It was really fun and we had a great time I liked Warsaw most to be honest, a very modern city, a bit like East Asia in terms of modernity, with rapid delivery services and apps, everything just works great and fast I'm not saying it's perfect btw, there's moments where you still realize it's Eastern Europe (or as they'd like to call it Central Europe) but then the difference is they generally solve problems fast and pragmatically Many shops you go will actually have a long line at the checkout, annoying, but usually there's a second checkout but it's closed That's because Poland too has a big labor shortage, one of the lowest fertility rates in Europe, so they too kinda have to import people, but they choose to import them from Ukraine and Belarus (and some South Asians actually too) But wait, so that checkout line is closed yes? I'm so used to Portugal where there is zero incentive to then open another checkout counter but in Poland usually within a few minutes they notice it's busy and open another counter. I know, basic stuff but hard to come by these days. They're fast and pragmatic Ordering flowers for my gf was easy, the flower shop has an IG (but I don't) so I msg them over Whatsapp, they immediately respond, give me some options, I say what I want, address, payment link with Stripe (!) and done delivered at my hotel by a nice guy. All soooo smooth. Fast response, friendly people. Things just work here! Poland has done a great job keeping bad immigrants out while bring good immigrants in. The Ukrainians and Belarussians are neighbors and their cultures overlap strongly with Poland. So they fit in easily. Same cultures, same religions, same routines etc. for the most part A young Polish Uber driver I talked to said to him Krakow (his city) looks just like Lviv in Ukraine, so it's easy for Ukranians in Poland to integrate There's a lot of police presence in places, and military vehicles also (probably cause of the Ukraine war), the security at the Warsaw Airport is not done by some 5 layer outsourced company with staff that hates you, but by friendly people from the Polish Border Guard (Straż Graniczna) wearing military uniforms Warsaw has lots of skyscrapers now, and actually the tallest in Europe now at 310 meters is the Varso Tower, crazy! Poland is a booming economy and growing fast. When you're growing of course it's easy to make things go well. I'd say it's important for Poland to look ahead carefully and don't make the same mistakes that Western Europe did when everything was going well and we were very rich We became complacent, stagnant, added regulatory burdens, became overly obsessed with climate change and the environment, and imported the lowest quality tier of people from cultures that hate our guys and are diametrically opposed to Western culture That last part is especially interesting considering Poland's history, where 6 million (!) or 20% of the country was ruthlessly murdered in World War II I think that gives them the power to not have to be politically correct about immigration like Germany, because Poland after all was the victim, while Germany then was the purpetreyor. Which is why Germany does have to be so politically correct about it, due to extreme historical guilt You walk on the streets of Poland in the day and at night and you see the difference what sane policy does to daily life We're all dealing with the echoes of history So my message to my Polish friends: don't make the same mistakes Western Europe did and you will soon be the richest, safest, most modern country in Europe and hopefully then have the power to be the new leader of Europe And maybe you can then save Europe as a whole!! Niech żyje Polska! 🇵🇱
🇵🇱 Warsaw is Poland's biggest city and it is completely safe at 1am at night No violent junkies, no drug dealers, no street thugs hanging around harassing women (and men), no pickpockets (nor in the day btw) No shady people hanging around the train and metro stations Just people living chill together and police enforcing safety You know like we used to in Western Europe? There's a lot to learn from Poland
181
286
32
3,758
217,760
on "384 bit keys"...
More private keys by the Indian certificate authority have been discovered. These are all small numbers. People are suspecting that they interpreted 384 bit keys to mean that they should pick numbers from 1-384 to use as their private keys.
1
1
58
This is insane. 🚨🚨 TiDB got absolutely pillaged in this hack. All their data is being released here. fulcrumsec.vg/pingcap/
We identified unauthorized access to certain PingCAP internal systems. We took containment measures and engaged independent cybersecurity firms. There is no evidence that user data stored in TiDB was impacted. We’ll share further updates as our investigation continues: pingcap.com/trust-hub/securi…
4
11
3
272
40,142
🚨 BREAKING: PHP is warning admins to prepare for emergency security updates tomorrow to fix two critical vulnerabilities rated CVSS 9.2. However, security researchers at @watchtowrcyber rate the flaws CVSS 10.0 and say they are RCE vulnerabilities affecting PHP 5 through 8. Information about the vulnerabilities has reportedly leaked ahead of disclosure. No known exploitation in the wild. 🔗 bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…
31
375
73
1,306
272,075
Pawel Foremski retweeted
private keys from 8 intermediate CA certs have been compromised (eMudhra) Happy "Update everything" day to all my pager-carrying friends emudhra.we-have-a-problem.co…
93
999
346
5,155
4,744,974
I'm old enough to remember the term "slashdotted" - that error was not on my bingo card...
56
If confirmed, this is telling: Russian data centres get hit, and online activity around AfD suddenly plummets. 📉 So much talk about German patriotism… then the connection from Russia goes down. 🤔🇷🇺
1,603
11,898
1,609
62,759
4,355,988
Pawel Foremski retweeted
This is why GPUs cost $6,000
606
3,222
589
21,773
2,724,164