
Internet infrastructure security and performance: #IPv6, #BGP, #DNS, #DDoS. @ https://teapaw.org/t.co/Jz50nu108t + @DomainTools + @bgpfixorg
Joined March 2011
- Tweets1.3K
- Following492
- Followers538
- Likes2.7K
Pinned Tweet
bgpipe v0.23 is out! ~1.5x faster BGP processing (~1M msgs/s MRT→JSON, zero-alloc parsing), and hardened by default: fuzzed parsers, WebSocket auth, peer allow-lists, RPKI over HTTPS, ASPA tested against the IETF draft's examples. github.com/bgpfix/bgpipe/rel…
Pawel Foremski retweeted
UPDATE: Israeli company we caught delivering zero-click infections is #1 bidder on Starlink ads in 105 countries.
Data from @trendai_RSRCH suggests worldwide surveillance op targeting @Starlink users. 1/
By @razhael
reuters.com/business/media-t…
🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads.
A normal-looking ad loads. If you're a target, you're infected. No click needed.
To protect yourself, block ads now.
First time it's been confirmed in the wild. We call it #AdFection.
Candiru spyware infections at @AJEnglish. 45+ devices infected.
Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse.
Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC.
Investigation ongoing 1/
READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : citizenlab.ca/research/how-d…
Confiant's blog: blog.confiant.com/p/adint-we…
Millions of attempts is the attacker side.
On the defender side, @IPinfo re-checks the same ~1.3M PHP servers every day: the share on a patched release went from 5% to 10% in a day.
But servers on old versions with no official fix barely moved: 0.6% upgraded overnight, while 7% went quiet or started hiding their PHP version.
Pawel Foremski retweeted
I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:
Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:
a) a world-class exploit developer with an extreme case of imposter syndrome.
b) currently looking at some very confident-sounding but wrong LLM output.
I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.
I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).
The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".
People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.
So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.
What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).
The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.
LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
Pawel Foremski retweeted
Heatbit unveils Bitwater: a water heater element that mines Bitcoin.
Bitwater screws into the electric hot water heater tank you already have!🔥
Pawel Foremski retweeted
We’ve spent the past year developing new primitives for GPUs. We believe this enables new algorithms to change how machines learn, open new markets, and dramatically reshape AI’s cost structure.
We have raised a $1 billion Series A, co-led by Index and Lux.
just imagine this handling robocalls... I mean, handling wannabe hackers happy they just broke into an SSH service - how much of their time this could ruin? simedw.com/2026/10/21/world-…
🇵🇱 Okay my final Poland video because we're leaving soon!
It was really fun and we had a great time
I liked Warsaw most to be honest, a very modern city, a bit like East Asia in terms of modernity, with rapid delivery services and apps, everything just works great and fast
I'm not saying it's perfect btw, there's moments where you still realize it's Eastern Europe (or as they'd like to call it Central Europe) but then the difference is they generally solve problems fast and pragmatically
Many shops you go will actually have a long line at the checkout, annoying, but usually there's a second checkout but it's closed
That's because Poland too has a big labor shortage, one of the lowest fertility rates in Europe, so they too kinda have to import people, but they choose to import them from Ukraine and Belarus (and some South Asians actually too)
But wait, so that checkout line is closed yes? I'm so used to Portugal where there is zero incentive to then open another checkout counter but in Poland usually within a few minutes they notice it's busy and open another counter. I know, basic stuff but hard to come by these days. They're fast and pragmatic
Ordering flowers for my gf was easy, the flower shop has an IG (but I don't) so I msg them over Whatsapp, they immediately respond, give me some options, I say what I want, address, payment link with Stripe (!) and done delivered at my hotel by a nice guy. All soooo smooth. Fast response, friendly people. Things just work here!
Poland has done a great job keeping bad immigrants out while bring good immigrants in. The Ukrainians and Belarussians are neighbors and their cultures overlap strongly with Poland. So they fit in easily. Same cultures, same religions, same routines etc. for the most part
A young Polish Uber driver I talked to said to him Krakow (his city) looks just like Lviv in Ukraine, so it's easy for Ukranians in Poland to integrate
There's a lot of police presence in places, and military vehicles also (probably cause of the Ukraine war), the security at the Warsaw Airport is not done by some 5 layer outsourced company with staff that hates you, but by friendly people from the Polish Border Guard (Straż Graniczna) wearing military uniforms
Warsaw has lots of skyscrapers now, and actually the tallest in Europe now at 310 meters is the Varso Tower, crazy!
Poland is a booming economy and growing fast. When you're growing of course it's easy to make things go well. I'd say it's important for Poland to look ahead carefully and don't make the same mistakes that Western Europe did when everything was going well and we were very rich
We became complacent, stagnant, added regulatory burdens, became overly obsessed with climate change and the environment, and imported the lowest quality tier of people from cultures that hate our guys and are diametrically opposed to Western culture
That last part is especially interesting considering Poland's history, where 6 million (!) or 20% of the country was ruthlessly murdered in World War II
I think that gives them the power to not have to be politically correct about immigration like Germany, because Poland after all was the victim, while Germany then was the purpetreyor. Which is why Germany does have to be so politically correct about it, due to extreme historical guilt
You walk on the streets of Poland in the day and at night and you see the difference what sane policy does to daily life
We're all dealing with the echoes of history
So my message to my Polish friends: don't make the same mistakes Western Europe did and you will soon be the richest, safest, most modern country in Europe and hopefully then have the power to be the new leader of Europe
And maybe you can then save Europe as a whole!!
Niech żyje Polska! 🇵🇱
🇵🇱 Warsaw is Poland's biggest city and it is completely safe at 1am at night
No violent junkies, no drug dealers, no street thugs hanging around harassing women (and men), no pickpockets (nor in the day btw)
No shady people hanging around the train and metro stations
Just people living chill together and police enforcing safety
You know like we used to in Western Europe?
There's a lot to learn from Poland
Pawel Foremski retweeted
This is insane. 🚨🚨
TiDB got absolutely pillaged in this hack. All their data is being released here.
fulcrumsec.vg/pingcap/
We identified unauthorized access to certain PingCAP internal systems. We took containment measures and engaged independent cybersecurity firms. There is no evidence that user data stored in TiDB was impacted. We’ll share further updates as our investigation continues: pingcap.com/trust-hub/securi…
Pawel Foremski retweeted
🚨 BREAKING: PHP is warning admins to prepare for emergency security updates tomorrow to fix two critical vulnerabilities rated CVSS 9.2.
However, security researchers at @watchtowrcyber rate the flaws CVSS 10.0 and say they are RCE vulnerabilities affecting PHP 5 through 8.
Information about the vulnerabilities has reportedly leaked ahead of disclosure.
No known exploitation in the wild.
🔗 bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Pawel Foremski retweeted
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
Bank of America Hired 1,000 Contractors to Patch Software Flaws Exposed By Anthropic's Mythos ift.tt/VOBCvgs
Pawel Foremski retweeted
If confirmed, this is telling: Russian data centres get hit, and online activity around AfD suddenly plummets. 📉
So much talk about German patriotism… then the connection from Russia goes down. 🤔🇷🇺
































