former security engineer @energy ✧ technomancer ✧ industrialist
𝙼𝚘𝚞𝚗𝚝𝚊𝚒𝚗𝚜, 𝚄𝚂𝙰
Joined February 2025
- Tweets5.1K
- Following601
- Followers2K
- Likes30.3K
get in loser we're bringing factories back to life domestically
Yeah so we are about to double revenue and factories since I tweeted this... need 10-15 more killers on team Conduit
Hiring a Head of Talent to help fuel the engine that is powering America's finest manufacturers
DM's are open or email [email protected]
Async retweeted
“We’ve patched every single vulnerability, we don’t understand why we’re still getting breached?”
FYI these are monks building a cathedral in the middle of Wyoming, they sell coffee to fund the project
sick video from mastercam on the carmelite monks in wyoming using 5ax machines to build a gothic monastery
imagine rolling up to the shop and your programmer is brother peter thomas
youtu.be/wLJa410KTsg?is=pun-…
Async retweeted
Delete Granola bro. We're switching to Strawberry. Did you sign up for Pistachio yet? I sent you an invite to our Gingerbread team. Check your inbox on Syrup. You need to make an Iced Vanilla Latte account to access Almond Croissant. Hold on, lemme add you to Chicken Tikka Masala
Async retweeted
ctf in 2014: run this program in a debugger
ctf in 2026: become a threat actor and exploit this 0day with no public poc
Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).
Check out their awesome writeup here: github.com/KillaBoi/StealMyB…
Async retweeted
Former DOE security engineer @asynchronous_x explains how a miscommunication turned a planned PHP2Shell fix into a race against hackers:
"It should have been the best-case scenario. Security researchers identified these vulnerabilities, developed proof of concept exploits in advance, and were informing the PHP core team for fixes. That whole part was working fine."
"The reason this one’s unique is there was basically a leak of the vulnerability before the disclosure. That was supposed to be released on October 22nd, today. Unfortunately, there was a miscommunication, and they released some of the details early. So there was this panic race where the problem is out in the wild, but we don’t have a fix prepared yet."
"The thing it’s taught the security realm is that we probably can’t rely on coordinated disclosure anymore. If the speed at which people can develop exploits is now so fast that we can’t possibly rely on things not getting leaked, then it’s not something we can lean on as much as we used to."
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Async retweeted
Former DOE security engineer @asynchronous_x explains why America's critical infrastructure hasn't been attacked more often despite its networks being riddled with security holes:
"The work I used to do for the Department of Energy was around critical infrastructure. They’ve relied on obscurity, you don’t know that they’re there, so why would anyone attack us. As soon as you took any sort of magnifying glass to their networks, they were usually riddled with holes."
"The reason they haven’t gotten attacked so much is because the repercussion is so much higher. If you compromise a water treatment facility and you accidentally end up killing people, that’s gonna have extreme repercussions versus if you steal some cryptocurrency."
"We’ve been relying on political and other methods for keeping them safe rather than actually making them secure."
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.
Async retweeted
Former DOE security engineer @asynchronous_x warns AI is narrowing the gap between junior hackers and agencies like the NSA:
"We used to have this thing in industry where we would say, this is pretty secure, unless your threat actor is the NSA."
"Now with AI tools you can take more junior people with less expertise, and they can make more sophisticated attacks. Somebody that would’ve been a less high-level threat actor before could potentially become a much more dangerous threat actor."
"There’s plenty in the industry that think we should limit access to these tools because it can make smaller threat actors much more dangerous."
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Async retweeted
The next "Quality Learing Center" will be found & exposed using America.gov/fraud
See fraud? It's time to expose it.
Report fraud, waste, and abuse to the federal government 📲 America.gov/fraud