mirashii

It’s not weird they had to report it this way, it’s part of the system literally called Generally Accepted Accounting Principles.

If they tried to stop terrorists from making biological weapons in the same manner, the headlines would call that useless and ineffective because you're trying to stop already bad actors with something ineffective and trivially bypassed. This is no different, and shouldn't be treated any differently.

They really didn’t though. They put it in a client side modification to the system prompt. You can just rip it out with a proxy or a small local modification to your client, which Claude will be happy to do for you. They took a token step so that people would write these headlines in the hope it would stave off more negative attention in the video game world without actually doing anything meaningful.

This is a common sentiment, but the security story isn’t so clear cut as that. Encrypted at rest really just means that if you yank the disk out of the server, an adversary can’t read it. But if it’s a system that is online serving a database and you gain access to the application reading from the database, encryption at rest doesn’t save you. It’s obvious the application server must be able to read the decrypted data. If an adversary breaches the application, they get the data.

I’d say it’s more correct that Anthropic publishes the Open VSX version, and Cursor mirrors it in their own repository, labeling it as being published in their mirror by Anthropic even though it is not.

Cursor didn’t always use Open VSX, it changed in late 2025. https://forum.cursor.com/t/extension-marketplace-changes-tra...

Also worth noting that it doesn’t use Open VSX directly but uses a cursor hosted mirror at https://marketplace.cursorapi.com/open-vsx-mirror

You’re right, I read too quickly.

There are regularly gaps in the claude code versions, e.g. if you go back a page, there's no 2.1.297, 2.1.298.

Edit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.

Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...

Given they mentioned taking down and rebuilding the marketplace registry in that post, it seems equally likely that Cursor’s infrastructure was the source of the intrusion and a folks are jumping the gun on attribution.

Edit: I was correct. https://news.ycombinator.com/item?id=50304129

It is, thus the links being to individual wallets.

The primary reserve currency does it all the time. https://ofacblockedfundslawyers.com/us-sanctions-freeze-doll...

The thing that actually makes it harder in Python is threading, because it breaks all ability to reason locally about what might happen and optimize. In Python you have to assume that another thread may do these things at any point mid-execution.

There’s an #internals-and-peps channel in the Python discord where some folks hang out.

It does not permit taking over pointers and doing a plain old RCE, sure, but it still does permit a variety of optimizations that could break the logic of your program in surprising ways.

Here are two examples of where it's clear that the UB from the underlying C is still present and the optimization passes are still able to do things that wouldn't be possible without UB, like falling through functions and deleting safety checks inserted by the Fil-C runtime:

https://news.ycombinator.com/item?id=49677463 https://news.ycombinator.com/item?id=49681273

I'm not really convinced you can take LLVM and just flip a few poison bits off and remove a couple optimization passes and know that UB isn't going to explode in your face.

Fil-C does still have UB. Signed-overflow, for instance, is still UB in Fil-C, and can still lead to things like the optimizer removing checks in the presence of UB.

Imperva claims to have demonstrated it, but didn't publish it openly (and their article screams AI slop, so take that for what you will).

https://www.imperva.com/blog/node2shell-from-brotli-data-to-...

There's also a public POC here, though with the caveat that they demonstrated it only on builds with weaker configurations. https://github.com/dimasma0305/CVE-2026-111497-POC

All that said, we haven't heard the major cloud providers or security labs saying they've seen exploitation in the wild yet.

I feel as though this should be googlebrotli2shell, not http2shell. Google deserves to take a bit of a reputational hit for this. This is a basic memory safety violation, from the same organization that does wuffs, that promotes Rust for memory safety, that has Carbon. zstd has high quality rust implementations and is from roughly the same time.

On top of that, the brotli library saw no releases for almost a full year, with the fix for this vulnerability being committed back in February. Google builds from main for all their projects, so were unaffected, but open source releases are a complete afterthought. Over 100 commits with miscellaneous fixes left languishing until a security incident forces a release.

It's bulletproof, in the same way that my open window is bulletproof because a bullet will fly right through it and not damage the glass.

Additionally, the author isn't engaging on this site in good faith. See this thread https://news.ycombinator.com/item?id=50181138 from yesterday, where egregious vulnerabilities in this project were pointed out, at which point the author force pushed to hide the history, failed to fix the vulnerabilities pointed out (e.g. https://github.com/Qbix/proxy/blob/5a9f8a96f4bdaaaa5444b6986... still doesn't match the PHP multipart parser, so the whole defense can be mooted by switching to a space as the delimiter). This is an exemplar of slop.

Epic Games and Fortnite comes to mind as a counter example. From 2020 up to a few months ago, it was unavailable on the Play Store.

> 3. Chainguard sees dancing anime video, doesn't recognize Calif, and thinks the exploit is in the wild

I'm not sure about this part. I saw https://jackalsyn.com/posts/php-up-2026.html going around a bit over 12 hours ago, before the chainguard images went out, and plenty of other chatter of exploitation happening in the wild.

I'm going to engage only because I do not wish others to come across this project and think it's serious. I did open the project and read the code, and I did throw it into an LLM as I previously said for some very basic security posture checks, and found a number problems immediately, but I don't trust them (and neither should you, which is part of the problem here), so I went digging a bit deeper. I don't have the time to go through all of them, so here's a big one of my own finding: There's a parser differential in how multipart boundaries are handled, your proxy only deals with ;, the PHP interpreter accepts , as well, and the proxy will pass it through unchanged to the upstream. That's a full bypass of what the proxy is trying to do.

https://github.com/Qbix/proxy/blob/main/src/sanitize.c#L41 https://github.com/php/php-src/blob/master/main/SAPI.c#L162

The article linked from your own README (https://sansec.io/research/php2shell) has a better partial mitigation in existing, battle-tested reverse proxies. Even still, as that article says, everything here is a partial mitigation. The description of the issues in your project's README is an inaccurate understatement of the severity of the issues. "CVE-2026-109618 — heap use-after-free in the session.upload_progress handler" is an incomplete understatement of the issue, the session.upload_progress handler is only one of a number of potential exploitation paths. https://github.com/php/php-src/security/advisories/GHSA-w8hw... has some hints at other paths, of which there are many.

From an LLM, and quickly validated by me, a heap overflow, likely an RCE.

> src/http.c:101-116 and src/util.c:9

Attacker supplied value in strtoul, the size-limit checks are unsigned addition that can wrap, and you can follow the chain from there.

> or better yet submit a request.

This project is not deserving of fixing, it should just be deleted and direct people to more serious documentation of fixes and mitigations. This code is clearly AI-generated slop, it is not my responsibility to fix your project.

> I could understand if you actually at least clicked and looked at the repository, and read what it’s about. But you chose to simply write generic text without looking at anything. You want to discourage people from protecting their servers, in order to feel good about yourself. What amount of effort have you put into understanding what you’re even talking about?

Every accusation is an admission.

> It was the best I could do.

Honestly, and not to be harsh, but doing absolutely nothing is better than what you've done here.

Not only is this proxy unlikely to actually protect against the issues, but this code almost certainly has its own, equally bad security vulnerabilities. A 30 second check with Opus 5.5 found at least one heap overflow, multiple memory leaks, and a number of bugs that shows that it doesn't even succeed at doing what it claims. I appreciate that you're trying to help, but there are better tools for the approach that you're going for here, and injecting noise with AI slop that isn't even reviewed at a basic level is causing noise, confusion, and potential harm in an already urgent, tense situation.

No, it’s not a solution, it’s only one example proof of concept on how to exploit the vulnerability, there are more.

I have one that combines most of this. I left Jellyfin out so far because it has clients for all the various devices, but I’ve replaced the arr stack, sabnzbd, jellyseerr, kavita, audio bookshelf, etc into one Rust binary and a SQLite database. As a bonus, uses local LLMs/decision models to replace a lot of the custom regex based detection of the arr stack, and a mini built in agent with tools for finding, downloading, and manipulating media so that I can find Spanish language content for my kid a bit more easily, as language stuff being tagged is still pretty weak in the ecosystem.

It represents a couple weeks of on and off work, an experiment into how far I can push these tools to make sure I’m understanding them and not falling behind, and I like it a lot. I’ve considered open sourcing it, but to be honest, I don’t really want the burden of being a maintainer, and I have no interest in implementing or maintaining things that fall outside my use case, and so it’s just my own little toy. I imagine that many folks will end up doing the same given a bit of time.

Important to note that this is is not a bug in the type system itself, it's a bug in the borrow checker not enforcing invariants that the type system says that it should, and formal verification of the type system would not have helped here.

Here's a recent example of an AI exploiting a soundness hole in Lean in a paper purporting to have solved the Collatz Conjecture.

https://leodemoura.github.io/blog/2026-8-1-postmortem-for-ke...

There's also a fairly well known incident where the Lean formalization of the Riemann Hypothesis in Mathlib was incorrect.

And here's another great example of how a bunch of people who don't know what's going on throw noise into the system. That post is simply confused: the 1m opus calls are the auto-mode classifier, actual agent calls are still in Fable.

It can also send to a self-hosted linkding, quite nice: https://linkding.link/archiving/#using-the-singlefile-browse...

The mistake here is thinking or treating AI tools as special or different in any way. We’ve had tooling that does this for decades. Ansible, puppet, saltstack, NixOS/home-manager, and dozens of other solutions. Even better, writing the configuration is extra simple now, since you can just ask your agent to do it.

DNS can be trivially MITM'd as well, it's certainly not a secure mechanism for distributing keys.