@DazedProgrammer

Sr. Software Eng | Sr. Sec Architect | CompSci | Cybersecurity | AI Cybersecurity Engineer @Sony | Explorer of the unknown | Tweets are my own.

 FL
Joined September 2017
  • Tweets2.8K
  • Following1.1K
  • Followers771
976Media
☕ Morning briefing: researchers report PHP2Shell hacks in the wild, and exploit code is public. Update PHP today. HTTP2Shell, the Brotli bug, reportedly reaches .NET, PowerShell, FFmpeg and more. Microsoft patched Oct 25; no attacks reported yet. #infosec
1
133
Sources: - Reported PHP2Shell hack (honeypot): bleepingcomputer.com/news/se… - $2,000 challenge claim + public code: cybersecuritynews.com/php2sh… - Suspected North Korea scanning (CYFIRMA): thehackernews.com/2026/10/ph… - HTTP2Shell beyond Node: securityweek.com/node2shell-…

PHP2Shell security flaws now sucessfully exploited in the wild

Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.

bleepingcomputer.com
1
99
PHP: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (8.1 and older: no fix). Unpatched third bug CVE-2026-115560: set session.upload_progress.enabled=0. Brotli: .NET 8.0.33/9.0.22/10.0.14, Oct 25 PowerShell 7.4/7.5/7.6 builds, Node 22.23.4/24.22.1/26.12.1. Rebuild, restart.
80
🚨 A new report says flaws in Tailscale SSH can turn one hacked device into root on every server it is allowed to SSH into. Tailscale hasn't confirmed it and there's no patch yet. Turn off Tailscale SSH where you don't need it and tighten your SSH rules. #infosec
1
69
News: cybersecuritynews.com/tailsc… Report (Tailworm, Oct 25): tailworm.com Watch for Tailscale's response: tailscale.com/security-bulle…

Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers From One Compromised Device

A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each...

cybersecuritynews.com
1
30
What to do now: turn off Tailscale SSH where you don't need it (tailscale set --ssh=false, after making sure you have another way in), and give each SSH rule one source and one destination. On headscale 0.29.5, treat every SSH rule as root access.
16
🚨 OpenAI let its AI agents try to escape test copies of its training sandboxes. They got past 3 walls: onto the host machine; from a host they were handed, onto the internet (limited) via log, metrics and login services; and between sealed boxes via CPU cache timing. #infosec
1
33
Sources: - OpenAI, Oct 23: openai.com/index/securing-ou… - Kata Containers advisory (CVE-2026-24834, fixed 3.27.0): github.com/kata-containers/k… - The Hacker News: thehackernews.com/2026/10/op…

Securing our frontier model training environment

OpenAI explains how we strengthened containment for frontier model training and evaluation, including offline environments and high-compute red-teaming.

openai.com
1
31
Fixed versions (update to these or newer): Kata Containers 4.1.0, gVisor release-20260803.0, Docker Engine 29.9.0 (seccomp profile), Linux 6.6.158 / 6.12.111 / 6.18.53 / 7.1.13 / 7.2.3, or your distro's patched kernel.
3
🚨 CVE ALERT: Node2Shell (aka HTTP2Shell), CVE-2026-111497. Out-of-bounds write in Google's Brotli decoder (1.0.3-1.2.0), CVSS 4.0 9.2 (Google, the CNA). Hits Node, Bun, Python and Envoy/Istio when they decode untrusted Brotli. Not exploited yet. Patch, rebuild. #nodejs #infosec
1
575
Sources: - CVE record: cve.org/CVERecord?id=CVE-202… - Node.js: nodejs.org/en/blog/vulnerabi… - The Hacker News on Bun, Python, Envoy, Istio: thehackernews.com/2026/10/br…
1
71
Fixed: Node 22.23.4 / 24.22.1 / 26.12.1, Bun 1.4.4, Brotli 1.0.10 / 1.1.1 / 1.2.1, Python Brotli 1.2.1, brotlicffi 1.2.1.0. Envoy/Istio: patch or turn off Brotli decompression. End-of-life Node (25, 23, 20 and older): no official fix.
30
Sources: - Google Chrome Root Program: blog.google/security/protect… - Mozilla incident: bugzilla.mozilla.org/show_bu… - Scott Helme (all 8 key values, one is 4): scotthelme.co.uk/eight-bits-…

Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates

The Chrome Root Program received a report from a security researcher regarding the compromise of private keys associated with eight eMudhra subordinate Certification Authority (CA) certificates. The...

blog.google
1
54
Site operators: Chrome is expected to remove emSign ECC Root CA - G3 on Oct 27. If your certificate chains to it, get one from a different root now.
17
🚨 ALERT: A certificate authority's private key was the number 4. eMudhra's 8 intermediate CA keys (6 TLS, 2 code signing) were all below 256, so anyone could forge trusted HTTPS certs. Browsers blocked them. Your CA bundles and Docker images may not have. #infosec #PKI
1
44
🚨 CVE ALERT: PHP2Shell. CVE-2026-109618/-109619 (unauth RCE, CVSS 4.0 9.2) are fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. A related bug, CVE-2026-115560, is NOT fixed yet: set session.upload_progress.enabled=0 in php.ini (restart PHP) until the next release. #PHP #infosec
1
119
Sources: - PHP advisories GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp and php.net (Oct 23, CVE-2026-115560) - AWS on exploitation: aws.amazon.com/blogs/securit… - Wiz: wiz.io/blog/php2shell-php-rc…

www.php.net

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

php.net
102
On PHP 8.1 or older: no new release. PHP posted source backports for 7.4, 8.0 and 8.1; check your distro's advisory, or upgrade.
25
So I got bored and I developed a fully functional poker system within the Wanted: Dead or... Dead addon. Play with in game gold, or just a friendly stack of chips. All gold and transactions are accounted for Deadbeat hosts who don't pay out get rated accordingly. Tournaments or cash games. Up to 8 players at a table. Host your table to the public, or password protect it to host with your guild/friends.
1
2
35
Guess I am rolling a mage for WoW Forever?
Wanted: Dead or... Dead | WoW Forever PvP
@WantedDoDOct 12
Which spec hits hardest at level 30 in WoW Forever? We simulated all 27 specs from the game's own data, with sim-picked talents and gear you can get at 30. Top damage: Arcane Mage, then all three Hunter specs. Every build, talent tree and gear set: wanteddeadordead.com/sim/lev…

Level 30 PvP damage · Wanted: Dead or... Dead

A simulation of a perfect level 30 PvP fight for every class and spec in WoW Forever: ceilings, not expectations.

wanteddeadordead.com
52
Load more