Posts of IMREAL.LIFE RSSThu, 22 Oct 2026 23:02:54 GMTIf your website runs on PHP, and roughly seven in ten websites do, this one needs your attention today. On 21 October (just after 1am on 22 October, Melbourne time) the PHP project released emergency fixes for two critical flaws, nicknamed PHP2Shell, that can let an attacker run their own code on your web server without logging in to anything. Details leaked online the day before the fix, and attack attempts were already being seen before the patch was out. The Australian Government's Australian Cyber Security Centre (ASD's ACSC) has issued a Critical alert and recommends organisations apply available security updates and other appropriate mitigations.The good news: the fix is a normal package update and a restart. Here's what it is, how to check your server, and exactly what to do on Ubuntu.What it is and who's affectedPHP2Shell is two memory-safety bugs in PHP itself, not in WordPress or any particular app:CVE-2026-109618, "RCE via OOM corruption". When PHP runs out of memory part-way through setting up a request, the clean-up code can treat half-built data as valid, which can be turned into remote code execution.CVE-2026-109619, "RCE via stale global state". Internal data from one request can survive after its memory has been freed, and a later request handled by the same PHP worker can use it. The confirmed attack path goes through PHP's session upload progress feature (session.upload_progress.enabled), which is switched on by default and kicks in before any of your own code runs.The Australian Government alert. ASD's ACSC published its alert on 21 October 2026 and last reviewed it on 22 October, with Alert Status: Critical. It says "all PHP versions from PHP 5 onwards may be affected" and that it "is not aware of successful active exploitation within Australia, related to these vulnerabilities". ASD's ACSC recommends organisations:Identify PHP within their environmentsReview the latest PHP guidance at php.netApply available security updates and other appropriat... Read more

]]>Thu, 22 Oct 2026 23:02:54 GMT"You don't own your AI, you rent it." It's a line doing the rounds in Australian tech circles, and it's accurate for most businesses. Your prompts, your client data and your workflows run on someone else's servers, on someone else's terms, often in another country.Renting is fine, until the price changes, the terms change, the model you built around gets retired, there's an outage, or a client asks where their data went. Owning at least part of your AI stack is how you take those risks off the table.Australia is asking the same questionIn August, Parliament set up a Joint Select Committee on Artificial Intelligence. Its remit covers issues including the workforce, data sovereignty and national security. Submissions closed on 14 September, and the committee has to report by 30 November.James Newton-Thomas and his team read the 540 published submissions and tallied what people asked for. By their count, the top request, made in 121 submissions, was to build sovereign AI capability. Funding worker retraining came second with 118. That's their own analysis, not an official committee figure, but the message is clear: build it here, control it here, and help people learn to use it.A local example, with caveatsAt the end of September, Australian AI company Maincode open-sourced Matilda Jev, which it calls Australia's first "decision model". Instead of generating text, it answers a typed question (pick an option, yes or no, or a score) with a probability for each option. Maincode says it was post-trained and is served on Australian infrastructure, and the weights are on Hugging Face under the Apache 2.0 licence.The balanced view matters here:The model card lists a Qwen 27B model, from Alibaba, as its base. So this is Australian post-training on an overseas open-weight model, not a model built from scratch here. Commenters on the launch post raised exactly this.The headline benchmark scores were run by Maincode itself, and they've been submitted for independent verification.... Read more

]]>Thu, 08 Oct 2026 23:45:16 GMTI'm a big believer in running your own AI. It's the whole reason IRL exists. But owning the stack means owning the security too, and over the last few weeks a lot of other people and businesses running their own AI have found that out the hard way. None of this happened to IRL, but every one of these incidents is worth learning from before it happens to you.None of this needs a security team, just an afternoon on a box you already run.What others have run intoPoeLLM, a crypto-mining botnet aimed at AI servers. This week Lumen's Black Lotus Labs reported a botnet it calls PoeLLM that has compromised more than 3,400 servers since April, mostly in the US and Western Europe. Many of the victims were running exposed LiteLLM and Ollama instances, alongside Gotenberg and Gitea. Once in, it mines cryptocurrency and uses the server to hunt for the next victim. On LiteLLM it goes after an endpoint covered by CVE-2026-42271, which was fixed in LiteLLM 1.83.7.A critical flaw in GitLab's self-hosted AI Gateway. On 2 October GitLab disclosed CVE-2026-90970, rated 9.9 out of 10. A logged-in user with Duo Agent Platform access could craft a custom flow that escaped the prompt template sandbox and ran commands on the gateway. It's fixed in AI Gateway 19.2.4, 19.3.2 and 19.4.1. Only self-hosted gateways need action, but if that's you, it's urgent.A coding agent that reportedly deleted 48,000 files. Last month a Reddit user reported that a Claude Code sub-agent, asked to rebuild a test copy of a project, wrote a cleanup script that followed Windows directory junctions into the live project. By the user's account and the agent's own log, it deleted about 48,000 files in 103 seconds, including the Git object store, so Git couldn't restore anything. It hasn't been independently verified, but the failure mode is real.None of these is exotic. The people caught out had an exposed port, unpatched software, or an agent with far more reach than its task needed.The checklistKeep model endpoints... Read more

]]>Thu, 08 Oct 2026 23:42:38 GMTReview of the amazing 🦞 Clawdbot — Personal AI AssistantClawdbot is a personal AI assistant you run on your own devices. It answers you on the channels you already use (WhatsApp, Telegram, Slack, Discord, Google Chat, Signal, iMessage, Microsoft Teams, WebChat), plus extension channels like BlueBubbles, Matrix, Zalo, and Zalo Personal. It can speak and listen on macOS/iOS/Android, and can render a live Canvas you control. The Gateway is just the control plane — the product is the assistant.If you want a personal, single-user assistant that feels local, fast, and always-on, this is it. ‍‍Want to learn how to set this up yourself? Join our community of members just like you learning how to work with AI in real world applications for business, education and life.CLAIM YOUR PLACE IN THE WORLD NOWJOIN NOW!

]]>Tue, 27 Jan 2026 06:05:38 GMTReview of OpenSource Music Maker AI system Heartbeat MULA  ‍HeartMuLa: A Family of Open Sourced Music Foundation ModelsHeartMuLa is a family of open sourced music foundation models including:HeartMuLa: a music language model that generates music conditioned on lyrics and tags with multilingual support including but not limited to English, Chinese, Japanese, Korean and Spanish.HeartCodec: a 12.5 hz music codec with high reconstruction fidelity;HeartTranscriptor: a whisper-based model specifically tuned for lyrics transcription; Check this page for its usage.HeartCLAP: an audio–text alignment model that establishes a unified embedding space for music descriptions and cross-modal retrieval.Github: https://github.com/HeartMuLa/heartlib? Want to learn how to set this up yourself? Join our community of members just like you learning how to work with AI in real world applications for business, education and life.CLAIM YOUR PLACE IN THE WORLD NOWJOIN NOW!

]]>Tue, 27 Jan 2026 04:52:24 GMTReview of Voice Cloning System that runs locally on your own computer.Qwen3-TTS‍‍Qwen3-TTS is officially live. We’ve open-sourced the full family—VoiceDesign, CustomVoice, and Base—bringing high quality to the open community.- 5 models (0.6B & 1.8B)- Free-form voice design & cloning- Support for 10 languages- SOTA 12Hz tokenizer for high compression- Full fine-tuning support- SOTA performanceWe believe this is arguably the most disruptive release in open-source TTS yet. Go ahead, break it and build something cool. Everything is out now—weights, code, and paper. Enjoy. https://youtu.be/Bg_PRsqttxg Links to Original Tweet:https://x.com/Alibaba_Qwen/status/2014326211913343303Github Repo: https://github.com/QwenLM/Qwen3-TTSWant to learn how to set this up yourself? Join our community of members just like you learning how to work with AI in real world applications for business, education and life.CLAIM YOUR PLACE IN THE WORLD NOWJOIN NOW!... Read more

]]>Tue, 27 Jan 2026 03:56:40 GMTIn a world where peace can shatter in a blink, Donald Trump Jr. draws attention to the critical relevance of the Second Amendment. His recent tweet underscores the importance of self-defense rights, citing distressing events unfolding in Israel as a chilling reminder of the necessity to protect oneself and loved ones. The incidents serve as an eye-opener for those questioning the relevance of this constitutional right. Amidst this turmoil, it's not about endorsing violence or promoting gun culture; rather, it's about recognizing the inherent human right to defend oneself when faced with dire circumstances. As we hope for peace, let's also reflect on our own rights and freedoms, understanding their importance before we find ourselves wishing we had the means to defend ourselves.Donald Trump Jr. @DonaldJTrumpJrIf anyone is still stupid enough to not understand why we have the 2nd amendment, have them watch any one of the hundreds of videos coming from Israel. Even the dumbest leftists watching women and children being dragged from their homes and cars to be raped and murdered in cold blood in the streets may finally get it.Thank you, Donald Trump Jnr, for bringing this to the forefront. It's indeed a sobering reminder of the importance of self-defense rights. The Second Amendment, while often a topic of debate, is fundamentally about the right to protect oneself and one's family. The distressing events unfolding in Israel underscore the gravity of this right.The graphic videos depicting innocent civilians being targeted are not just shocking but they also serve as a stark reminder that peace and safety can never be taken for granted. It's not about endorsing violence or promoting gun culture, it's about recognizing the inherent human right to defend oneself when faced with such dire circumstances.To those who question the relevance of the Second Amendment, these incidents should serve as an eye-opener. No one should ever have to face such brutality, but if they do, th... Read more

]]>Mon, 09 Oct 2023 02:52:39 GMT