Hacker News: gwillem

New comment by gwillem in "Upcoming critical PHP security release (CVE-2026-109618 / -109619)"

gwillem — Wed, 21 Oct 2026 12:39:25 +0000

you need to block requests from being routed to your PHP interpreter

OptinMonster supply chain attack hits 1.2M WordPress sites

gwillem — Mon, 15 Jun 2026 19:13:45 +0000

Article URL: https://sansec.io/research/optinmonster-supply-chain-attack

Comments URL: https://news.ycombinator.com/item?id=48545725

Points: 2

# Comments: 0

New comment by gwillem in "GrapheneOS – Break Free from Google and Apple"

gwillem — Tue, 17 Feb 2026 18:06:37 +0000

However, you pay 2.7% for that convenience

Claude finds 353 zero-days on Packagist

gwillem — Thu, 22 Jan 2026 11:18:34 +0000

Article URL: https://sansec.io/research/claude-finds-353-zero-days-packagist

Comments URL: https://news.ycombinator.com/item?id=46717749

Points: 5

# Comments: 1

The billion-dollar security.txt problem

gwillem — Fri, 16 Jan 2026 14:43:34 +0000

Article URL: https://sansec.io/research/security-txt-trillion-dollar-problem

Comments URL: https://news.ycombinator.com/item?id=46646832

Points: 5

# Comments: 1

New comment by gwillem in "SignalBotOne – Notification Webhooks for Signal"

gwillem — Fri, 28 Mar 2025 21:55:31 +0000

I built this for fun and my own notifications. I don't think there's much commercial value here since there's zero moat. But it would be nice if we could raise funds for Signal.

New comment by gwillem in "SignalBotOne – Notification Webhooks for Signal"

gwillem — Fri, 28 Mar 2025 21:06:01 +0000

The bot has access to any sent messages to yourself, plus any chatter in group chats if you have enabled that. So don't use it for sensitive stuff, and use a dedicated group. It was developed to relay sensor data and such, not war plans.

New comment by gwillem in "SignalBotOne – Notification Webhooks for Signal"

gwillem — Fri, 28 Mar 2025 21:04:17 +0000

Contact me via the support link?

New comment by gwillem in "SignalBotOne – Notification Webhooks for Signal"

gwillem — Fri, 28 Mar 2025 21:03:29 +0000

The URL that botmaster gave you is a page that lists your API endpoints (multiple if you have invited the bot to any group chats)

New comment by gwillem in "SignalBotOne – Notification Webhooks for Signal"

gwillem — Fri, 28 Mar 2025 21:02:43 +0000

Messaging is internally rate limited and capped per recipient. And it uses a sender pool.

New comment by gwillem in "Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine"

gwillem — Mon, 27 May 2024 18:55:19 +0000

Some encodings add a prefix, which then get sanitised by the liberal base64_decode. https://www.synacktiv.com/en/publications/php-filters-chain-...

Hackers plant card-stealing malware on website that sells baron and duke titles

gwillem — Mon, 29 Nov 2021 18:48:35 +0000

Article URL: https://therecord.media/hackers-plant-card-stealing-malware-on-website-that-sells-baron-and-duke-titles/

Comments URL: https://news.ycombinator.com/item?id=29383567

Points: 1

# Comments: 0

LinkedIn breaks because of too many tracking cookies

gwillem — Sat, 20 Nov 2021 20:41:24 +0000

Article URL: https://twitter.com/gwillem/status/1461680111191797760

Comments URL: https://news.ycombinator.com/item?id=29291657

Points: 46

# Comments: 14

Iconic Bugtraq mailinglist now used for spam

gwillem — Tue, 14 Sep 2021 11:35:16 +0000

Article URL: https://bugtraq.securityfocus.com/detail/wV8dW5V4QjdO83TI_X55o

Comments URL: https://news.ycombinator.com/item?id=28523141

Points: 2

# Comments: 0

New comment by gwillem in "Akamai blocks unordered HTTP request headers"

gwillem — Tue, 02 May 2017 15:59:37 +0000

Thanks! Indeed a copy paste error, I updated the article.

Akamai blocks unordered HTTP request headers

gwillem — Tue, 02 May 2017 11:49:17 +0000

Article URL: http://gwillem.gitlab.io/2017/05/02/http-header-order-is-important/

Comments URL: https://news.ycombinator.com/item?id=14245577

Points: 43

# Comments: 11

New comment by gwillem in "GitHub censored my research data"

gwillem — Sat, 15 Oct 2016 20:05:12 +0000

Gitlab CEO just called me and apologized, will restore data shortly.

I am personally very sorry that GL got in a bad light here. They had misinterpreted my data and have acknowledged that. For comparison, I have heard nothing from GH over the last two days.

Gitlab, you rock.

New comment by gwillem in "GitHub censored my research data"

gwillem — Sat, 15 Oct 2016 06:45:05 +0000

GL sent me this statement. For the record, I didn't publish vulnerable systems, I published stores that have malware.

---

Willem,

GitLab has opted to remove the list of servers that you posted in your snippet. GitLab views the exposure of the vulnerable systems as egregious and will not abide it. While GiLab reserves the right take further action, up to and including termination (https://about.gitlab.com/terms/), we have chosen not to terminate or lock your account.

Please know this decision was not reached lightly and we appreciate your understanding on the matter.

Regards, GitLab

GitLab Support Team GitLab, Inc.

New comment by gwillem in "5900 online stores found skimming"

gwillem — Fri, 14 Oct 2016 13:37:39 +0000

Github booted my data last night, not sure why. I've moved over to Gitlab.

Senate Republicans were skimmed for six months, quietly fix store

gwillem — Thu, 06 Oct 2016 10:39:41 +0000

Article URL: https://gwillem.github.io/2016/10/04/how-republicans-send-your-credit-card-to-russia/

Comments URL: https://news.ycombinator.com/item?id=12651388

Points: 5

# Comments: 0