I watch the bots so you don't have to, across 3,606+ websites: who's scanning, what they want, and how they dress up. Self-host it free: https://nitter.cf/t.co/EcxvfTgENJ
The edge
Joined April 2022
- Tweets2.3K
- Following307
- Followers423
- Likes1.3K
Mr. Nice Try retweeted
Not sure why people keep saying no one uses MPTCP listeners. Anything built with Go 1.24 or newer that has a tcp listener uses MPTCP by default. That includes Caddy, Traefik, most K8s components, Prometheus, Grafana, etc.
Mr. Nice Try retweeted
Self-hosted bot defense makes sense right now. A lot of vibe-coded apps ship with open signup forms and no rate limits, and that's the first thing bots find. I build AI tools solo and test small open source dev tools on Windows, so this is my kind of thing to poke at.
Mr. Nice Try retweeted
every recon tool i've ever run would've hit this wall on request one
respect for giving it away free
Mr. Nice Try retweeted
🚨Update: PHP has flagged another potential RCE issue, CVE-2026-115560.
Advisory: qz.com/php-vulnerabilities-a…
The PHP2Shell patch wasn’t the end of the story. If you’re running PHP, check the latest advisory and mitigation.
One patch isn’t a substitute for staying updated.
Two critical PHP vulnerabilities. Both can lead to remote code execution without authentication.
And the patches are already out.
CVE-2026-109618 and CVE-2026-109619 affect PHP’s core memory and error handling.
Fixed versions:
• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
Don’t just check your server’s PHP version.
Check the runtime inside your Docker images and production containers too. Restart PHP workers after patching and verify the fix is loaded.
PHP 8.1 and older are no longer supported upstream, so upgrading needs extra attention.
Official details and fixes:
thephp.foundation/blog/2026/…
Have you checked which PHP version your production apps are actually running?
Mr. Nice Try retweeted
BREAKING: Critical PHP flaws, a compromised LiteLLM release and potentially exposed Railway secrets put production systems at risk.
Patch affected systems, rebuild compromised environments and revoke exposed credentials.
7 security issues and what to fix now:
Mr. Nice Try retweeted
This is an awesome explanation.
their post: mrnicetry.com/posts/the-php-…
Mr. Nice Try retweeted
Please don't fall to slop generated exploits. There are no currently public working PoCs on the CVE-2026-109618 and CVE-2026-109619.
The one published by J4ck3LSyN provide no path that makes PHP interpret the sprayed bytes as a callable implementation.
Read more below 👇
Mr. Nice Try retweeted
5.6 Sol just found more UAF in core php and php-fpm. More CVEs coming soon.
To fix: codex -p "rewrite the app to anything but php". This is not a joke.
Mr. Nice Try retweeted
Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.
Mr. Nice Try retweeted
sending all my energy and good vibes to the @opencode folks.. love their product and work 🙏
Mr. Nice Try retweeted
Every @marclou launch follows the exact same script:
"noooo you can't just sell a Next.js boilerplate for $199, look at this leaked CLI token!!"
→ fixes it in 2 hours
→ prints $1M+ with ShipFast
"noooo you can't teach coding in 2 weeks, you're not even a real senior engineer!!"
→ ships CodeFast anyway
→ $30k/mo peak ($7k/mo today)
"noooo you can't just build web analytics, attribution is hard and your tracking script has bugs!!"
→ patches every bug in public
→ DataFast is at $31k/mo
"noooo you can't just vibe-code a verified Stripe database, people are spoofing webhooks and test keys!!"
→ uses Twitter haters as free QA, patches every exploit, adds acquisitions
→ TrustMRR is now at $53k/mo
Today:
"noooo you can't just vibe-code a beehiiv alternative over the weekend, email deliverability and SES wrappers are way too hard!!"
Half of X is writing essays in his quote tweets doing free QA and giving him 500k impressions while he fixes the edge cases in prod lol 😂
Never bet against Marc
I vibe-coded beehiiv, and it's 83% cheaper.
✨✨ Introducing MailCheap.ai ✨✨
Everything you need to run a newsletter...
✍️ Editor
📅 Scheduling
📈 Stats
🌐 A website for every issue
🛡️ Deliverability guardrails
🔗 Send from your own domain (and keep your reputation)
And it's not a dinosaur tool:
+ It's open source; you can run it for free
+ It's agentic; everything in the UI is available to your AI
Import from beehiiv, Substack, or Mailchimp in 2 minutes.
You pay for the emails you send, not for dormant subscribers. From $19/month.
Oh, and no "Powered By" badge at the bottom of your emails.
Mr. Nice Try retweeted
How seriously do you take your security? Are you prepared for a DDOS? Are you protected from users abusing your AI API keys? Could a swarm of AI agents take down your project?
The world out there is getting scarier. AI now finds and exploits bugs in hours, not weeks. You might not even know that your data is leaking.
Here are some tips I have I have for indie hackers / SaaS founders:
1. Turn on row-level security on every table.
2. Never ship a service/admin key to the frontend. Search your JS bundle.
3. Scan your git history for secrets. Rotate anything that ever leaked.
4. Hard spending caps + alerts on every AI API key. Stolen keys sell for ~$30 and can burn $50k+/day.
5. Per-user rate limits on every endpoint that calls a model.
6. No prod credentials anywhere your coding agent can reach. One agent deleted a startup's production DB and backups in 9 seconds.
7. Backups off-platform, with a separate delete path. Actually test a restore.
8. Disable npm install scripts and wait a few days before adopting new package versions. Check .claude/ and .vscode/ for hooks you didn't add.
9. Auto-merge security patches. The patch window is hours now.
10. Hardware 2FA on GitHub, npm, cloud, domain registrar and Stripe.
Bonus: attack yourself first. Ask an AI to "find a way to read another user's data" in your app. Attackers already are.
