iiinova — where your digital self keeps evolving

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 22/10/2026

PHP 8.5.12 security patch seems to be incomplete. Needs further validation. x.com/dinosn/status/211296232977224… #php #php2shell

CRITICAL FINDING — pushed to the public repo (a4638b6):

The PHP 8.5.12 security patch is incomplete. Three exploit paths survive on the

patched version, all lab-confirmed:

1 | var_destroy CONFIRMED boundary UNCHANGED — 3/3 ASAN on 8.5.12 at n=1015 (identical to 8.5.11). The patch added fallible allocations + ZEND_HAS_OOM guards but did NOT add BG(serialize_lock) around destructor-reentry UAF | __destruct dispatch. Fault site: var_unserializer.c:906 (= 8.5.11's :849 + 57 lines of patch code). A CWE-416 memory-safety bug surviving the security patch |

2 | Handler mismatch CONFIRMED | php_serialize-written|

3 | Upload-progress key | CONFIRMED | Attacker data stored verbatim in session files (the patch can't sanitize it - it IS the feature). Needs app LFI/include sink injection|

What this means:
- The two CVEs are genuinely fixed 8
- But the broader attack surface is not - three separate paths to impact remain on the patched version
- The var_destroy UAF is the critical finding: a memory-safety bug (use-after-free) surviving a security patch designed to fix memory-safety bugs in the same subsystem
- This should be reported to the PHP security team as a follow-up

200 2

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 17/09/2026

Shodan indexes over 47.000 exposed Ollama instances, including many running on expensive cloud GPUs. The API has no authentication, which means hackers can run prompts, steal models and exploit vulnerable versions. Article […] [Original post on graz.social]

000 0

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 15/09/2026

@Dorianix Doom läuft jetzt auch mit Fruchtfliegen Ein Experiment zeigt, wie sich biologische Verschaltungen auf virtuelle Umgebungen wie Doom übertragen lassen. www.golem.de/news/digitaler-tierver…

110 1

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 11/09/2026

Being replaced by autocomplete stopped scaring us around the third round of layoffs. x.com/PR0GRAMMERHUM0R/status/209826…

000 0

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 09/09/2026

AI companies are deliberately picking math problems (conjectures or questions) that can be solved by a counterexample. As impressive as those solutions are, they don't really contribute to a deeper understanding of the underlying subject. Conclusion: LLMs don't […] [Original post on graz.social]

100 1

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 20/08/2026

Wie man eine KI in den Wahnisnn treibt Frage: Mac u hin? Cuni ham? Mani chu? Hinweis: Werbetext eines österreichischen Schuhgeschäfts aus den 80ern.

000 0

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 20/08/2026

Coding interviews in AI companies such as OpenAI and Anthropic are not what you think * no mention of AI, code generation or prompt engineering. Instead, the interviews remind me of the ones at Microsoft in the 90s. * Coding challenges with harsh time […] [Original post on graz.social]

Senior Engineer shouting at coder during interview.

000 0

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 20/08/2026

LLMs struggle with linter outputs. They often "game" the linker instead of addressing the actual problem. "Habit hooks" are a neat idea. They explain linter outputs and suggest countermeasures as feedback to the model. The result is better code quality and […] [Original post on graz.social]

Models "game" the code instead of fixing the underlying complaint of the linker.
The impact of Coaching, that is explaining the linter output and suggesting countermeasures is shown below:

* The bare metric gets gamed. Given only function is too complex (11 > 5), Sonnet 4.6 produced a genuine fix in 5.6% of trials. It gamed the check in 79 of 90 — splitting branches into helpers so the number fell while the code got no simpler.

* The stronger model gamed it more, not less. Haiku 4.5 managed 28.9% on the same bare metric. Capability does not buy honesty about a target.

* Coaching fixed it on both. 83.3% genuine, and the confidence intervals do not overlap the bare-metric ones on either model.
It is the phrasing, not just asking nicely. A control that said only "improve this code" stayed at 25.6% and 34.4%.

010 1

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 17/08/2026

Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises www.hudsonrock.com/blog/largest-ai-… #cybersecurity #infosec #supplyChainAttack

001 1

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 14/08/2026

That's fascinating but also somewhat creepy...

Scientists found a black fungus inside Chernobyl's reactor.
It appears to use radiation as fuel through radiosynthesis.

002 2

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 13/08/2026

Donald Trump loves AI images of himself fighting alongside America’s Founding Fathers, saving George Washington and looking like an action hero. Then came a real threat. After the NATO summit in Turkey, the Secret Service received information about a credible […] [Original post on graz.social]

000 0

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 05/08/2026

If you think about it, the Democrats have no other way than to move left (or go "progressive"). Presidents like Clinton, Obama and Biden have moved the party to center right and thus pushed the Republicans to the far right. At the same time, the Democrats have […] [Original post on graz.social]

000 0

Sebastian Kübeck @skuebeck.graz.social.ap.brid.gy · 05/08/2026

Why does Putin's security always carry this mysterious bag? What's it actually for? Grok: It's a foldable ballistic shield. Putin's close bodyguards from the Federal Protective Service routinely carry these black briefcases, which open into armored protection […] [Original post on graz.social]

Putin next to his bodyguard with an unsuspiciously looking black bag.

000 0