Nostalgique du Futur. Je parle d’Humain et de Technologie.
France
Joined October 2008
- Tweets60.3K
- Following308
- Followers50.9K
- Likes9.5K
Mathieu Flaig retweeted
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
Mathieu Flaig retweeted
How is the internet less private than in 2006, when the whole family shared one computer?
Back then, the internet was weird, personal, and all of ours.
So, we got your favorite meme legends back together to say it louder: What happened to the internet? 1/3
Mathieu Flaig retweeted
We made the first AI model you can have a realistic conversation with that was trained entirely on speech!
Dessa is a full-duplex speech-to-speech model that you can run on consumer GPUs.
This is a GPT3 moment for speech.
Mathieu Flaig retweeted
🚨 FUITES INFOS | Mistral AI - Piratage
🇫🇷 Revendication de piratage visant @MistralAI, le géant français de l'intelligence artificielle.
Ce 22 octobre, un individu affirme avoir compromis les ordinateurs de plusieurs employés ainsi qu'une grande partie des infrastructures de calcul de Mistral AI.
Le cybercriminel propose de vendre, au plus offrant, des ressources internes de l'entreprise pour un prix de départ d'un million de dollars.
📂 Éléments revendiqués :
· L'intégralité du code source de Mistral
· Plus de 10 000 environnements d'entraînement par renforcement (RL)
· Les méthodes et configurations d'entraînement de Mistral Large 4
· Des accès potentiellement toujours actifs aux clusters de calcul
Pour étayer ses affirmations, l'auteur publie des extraits de code Git et des listings de serveurs liés à l'infrastructure CoreWeave, partenaire de Mistral AI.
⚠️ Revendication non confirmée.
Mathieu Flaig retweeted
‼️ ALERT - Someone tried to exploit #PHP2Shell 4 days before the vulnerabilities were publicly disclosed.
Amazon caught the October 17 attempt. More exploit attempts followed the patch release.
Who had the exploit details early, and how?
Full story ↓ thehackernews.com/2026/10/so…
Courage à tous les IT et les personnes en charge de la cybersécurité, les nuits vont être courtes 🫂 #Hacktober
Mathieu Flaig retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Mathieu Flaig retweeted
they’re calling it the black October lmao.
> node.js: security vulnerability.
> PHP: critical RCE vulnerabilities.
> tensorlake: npm package infected.
> liteLLM: malicious PyPI + Docker releases
> Railway: customer secrets exposed
> zeabur - infrastructure breached.
> OpenCode: AI API keys exposed.
> OVHcloud CLI: official binaries backdoored.
> RankMath PRO: malware inside official plugin.
> TeamUpdraft: customer data compromised.
> ConnectWise: cloud backup identities compromised.
> SubQuery: backdoored npm package.
> GhostAction: GitHub repos with malicious workflows (related to the broader Shai-Hulud/ChainDrop activity).
> eMudhra: certificate authority keys compromised (with downstream impact on Tailscale).
this some complete madness bro. 1/3 of the internet is fucked.
Mathieu Flaig retweeted
My colleague made a website to check if your website is vulnerable to PHP2Shell: php2shell.aikido.io/
We're also releasing PHP images with backported patches for free: gallery.ecr.aws/aikido-dev/p…
Stay safe!
Vouloir Maj le PHP de son site -> l’hébergeur t’envoie un SMS de 2FA -> Orange est down et donc pas de SMS
Le site Orange France en 404 (potentiellement pour le risque PHP ?)
nitter.cf/gabin85_/status/211300…
Mathieu Flaig retweeted
🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just because you've patched.
#php4shell #php #cybersecurity
nitter.cf/_annieversary/status/2…
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793…
Mathieu Flaig retweeted
Infos exclusives panne géante Orange en France... "Ce n'est pas un hack"
Il ne s'agit pas d'un piratage on me dit en interne !
Orange introduit un nouveau coeur de reseau mobile (5G). Les lignes qui sont migrées dessus sont a priori Hs.
Pour rappel, depuis 11h ce matin plus de signal sur les mobiles. Des centaines de milliers de personnes et d'entreprises sont impactées...
Le volume d’objets Retrogaming qui arrivent sur Vinted me déprime pour les boutiques pillées.
Et ça ne vient pas que de comptes créés pour l’occasion mais aussi de personnes bien notées, installées, qui sortent soudainement depuis deux jours des objets de collection.
Je ne vois pas comment Vinted peut gérer ça à part bloquer certaines marques ou catégories.
Captures non exhaustives ce matin.
En complément :
Communiqué du gouvernement suite à la réunion avec les plateformes d'occasion (Vinted etc.) hier soir.
Quatre engagements des plateformes (qui consistent grosso modo à appliquer leurs règles habituelles):
- Repérer les annonces pour des produits volés (présence d’antivols ou mention explicite du vol)
- Rappeler la loi sur le recel aux utilisateurs
- Produire un bilan chiffré des annonces retirées
- Coopérer avec les autorités
