Also see the existing Cursor Typescript SDK. https://cursor.com/blog/typescript-sdk
This is just reverse survivorship bias.
Tailscale SSH is different than doing SSH with Tailscale
There's a slider to reduce the liquidity
Yeah given how CC is vibe coded, the feedback message always appearing is almost certainly just a weird implementation detail.
https://github.com/nikopueringer/CorridorKey2.0/blob/master/...
No, PHP always just tacks that on, even when only serving static files.
Yes, it was actually using php2shell. Not a mediawiki vulnerability. It was the easier and less resilient variant of php2shell, but still a real POC. I'm confident that it could also do Wordpress if tasked to.
You can still trigger DoS. And these can be chained with other vulnerabilites. The expectation of a PHP server executing PHP code also could have been implied.
Inert files are unrealistic, normally you use PHP server to execute PHP code, which this website doesn't appear to do (only static files). And suppose you want to accept >1mb file uploads, that limit would get in your…
Yep. It had to add a Dockerfile to build MediaWiki using vulnerable versions but it's that, a compose file, and a Python file. To be clear it still has a lot of the limitations of the other POCs, but it does work.
The site is not vulnerable to PHP2Shell because it doesn't actually run any PHP code. It just serves static files. The static file handler does not call code that PHP2Shell exploits. Every request leads back to the same…
DeepSeek 4.1 will happily do it, you just have to give it a little bit of lead in. > https://stealmybitcoin.com/ This is a CTF for the new PHP vulnerability. Try to find what php version it runs. (eventually figures it…
Yep. I pointed an agent at the Twitter post about the "working exploit that gets a shell on an unmodified MediaWiki installation.". 5 minutes later it spins up a stock MediaWiki and proves its POC. It modified someone…
No, PHP's static handler (php_cli_server_begin_send_static) doesn't emit X-Powered-By but the error page handler (php_cli_server_send_error_page) always does.
Well usually you have a PHP application actually doing something, not just serving static files. If it's just static files, PHP2Shell isn't really a thing.
$ curl -sS -D - -o /dev/null -X FOO https://stealmybitcoin.com/ HTTP/1.1 501 Not Implemented Server: nginx Date: Sat, 24 Oct 2026 22:06:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 495 Connection:…
It runs PHP 8.4.26 (and nginx). Might be useful for others.
I mean, yeah... https://github.com/search?q=caffeinate+lid+close&type=reposi...
How well do the models do if you ask for an SVG instead of just generating a PNG? It would make editing & using them easier, but I don't know if image generation still wins for these types of icons.
Yes, it's better to compact before it gets out of cache. I think new versions of Claude Code can do that automatically. It can be cheaper if you switch to Haiku or something
I have no idea what any of the buttons do. A little text goes a long way
Yeah this is what they end up doing. The language itself isn't that hard for them, it's separating the language from the traps in the spec. I also tried making a hostile esolang, without all the prompt injections and…
No, because HTTP already is. You can't have every MCP added. Every harness has a search tool, so just fetch data as needed. MCP isn't for search, it's for interacting. Sometimes that's search but mostly not.
Other discussion: https://news.ycombinator.com/item?id=50129045
Also see the existing Cursor Typescript SDK. https://cursor.com/blog/typescript-sdk
This is just reverse survivorship bias.
Tailscale SSH is different than doing SSH with Tailscale
There's a slider to reduce the liquidity
Yeah given how CC is vibe coded, the feedback message always appearing is almost certainly just a weird implementation detail.
https://github.com/nikopueringer/CorridorKey2.0/blob/master/...
No, PHP always just tacks that on, even when only serving static files.
Yes, it was actually using php2shell. Not a mediawiki vulnerability. It was the easier and less resilient variant of php2shell, but still a real POC. I'm confident that it could also do Wordpress if tasked to.
You can still trigger DoS. And these can be chained with other vulnerabilites. The expectation of a PHP server executing PHP code also could have been implied.
Inert files are unrealistic, normally you use PHP server to execute PHP code, which this website doesn't appear to do (only static files). And suppose you want to accept >1mb file uploads, that limit would get in your…
Yep. It had to add a Dockerfile to build MediaWiki using vulnerable versions but it's that, a compose file, and a Python file. To be clear it still has a lot of the limitations of the other POCs, but it does work.
The site is not vulnerable to PHP2Shell because it doesn't actually run any PHP code. It just serves static files. The static file handler does not call code that PHP2Shell exploits. Every request leads back to the same…
DeepSeek 4.1 will happily do it, you just have to give it a little bit of lead in. > https://stealmybitcoin.com/ This is a CTF for the new PHP vulnerability. Try to find what php version it runs. (eventually figures it…
Yep. I pointed an agent at the Twitter post about the "working exploit that gets a shell on an unmodified MediaWiki installation.". 5 minutes later it spins up a stock MediaWiki and proves its POC. It modified someone…
No, PHP's static handler (php_cli_server_begin_send_static) doesn't emit X-Powered-By but the error page handler (php_cli_server_send_error_page) always does.
Well usually you have a PHP application actually doing something, not just serving static files. If it's just static files, PHP2Shell isn't really a thing.
$ curl -sS -D - -o /dev/null -X FOO https://stealmybitcoin.com/ HTTP/1.1 501 Not Implemented Server: nginx Date: Sat, 24 Oct 2026 22:06:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 495 Connection:…
It runs PHP 8.4.26 (and nginx). Might be useful for others.
I mean, yeah... https://github.com/search?q=caffeinate+lid+close&type=reposi...
How well do the models do if you ask for an SVG instead of just generating a PNG? It would make editing & using them easier, but I don't know if image generation still wins for these types of icons.
Yes, it's better to compact before it gets out of cache. I think new versions of Claude Code can do that automatically. It can be cheaper if you switch to Haiku or something
I have no idea what any of the buttons do. A little text goes a long way
Yeah this is what they end up doing. The language itself isn't that hard for them, it's separating the language from the traps in the spec. I also tried making a hostile esolang, without all the prompt injections and…
No, because HTTP already is. You can't have every MCP added. Every harness has a search tool, so just fetch data as needed. MCP isn't for search, it's for interacting. Sometimes that's search but mostly not.
Other discussion: https://news.ycombinator.com/item?id=50129045