GGSec

Closing out #php2shell: a universal black-box PoC for PHP's session upload-progress bug. One pure-HTTP chain - arm the allocator, spray fake refs, leak the heap, beat ASLR, turn a destructor into system(). Verified blind on Debian 13 PHP 8.4.24, x86-64 + arm64: RCE as www-data.

🔒 New in GGSEC GGFW: detection for CVE-2026-97631 — the UEFI EDK2 PXE Base Code (UefiPxeBcDxe) ICMP/ICMPv6 error buffer overflow that runs code before Secure Boot. Static firmware-image check that flags the attack surface straight from a SPI dump. #UEFI #firmware #infosec

"Node2Shell" on brotli: the PoC everyone shared is fake. So are many public PoCs. But CVE-2026-111497 is real — 16 measured steps, every number reproduced: ASan WRITE of size 16, UBSan index 8 out of bounds, pointer hijack, Node 24 crash vs Node 26 -17. #infosec #brotli

Spent an afternoon reading 4000 files to answer one question: does request data reach unserialize()? Wrote the tool instead of repeating it. Read-only — no writes, no execution, no network. Exit 0 = no candidates, 2 = go read these files. github.com/ggsec-de/php-unse…

RCE PHP☠️ Every release we tested, from 7.0.33 through 8.5.12 -fourteen releases across eleven branches - reproduces the controlled dereference with the default allocator. 5.6.40 does not. The fix exists only on master and no 8.5.13 has shipped, so no released PHP contains it.

Update: php2shell now reproduces on x86-64, not just arm64. Same bodies, same 4096 signature, same 819,200-byte window, same 876 destructor copies. Only the allocator geometry differed. 3/3 uid=33 on amd64. github.com/ggsec-de/php2shel… #php #infosec

php2shell (CVE-2026-109618/109619) is now on GitHub in two halves: 🔓 public — the measurements: negative control, 6-image matrix, why FPM doesn't transfer 🔒 private — the working exploit, embargoed until 25 Nov 2026 Defenders who need the code can ask. github.com/ggsec-de/php2shel…

How much? 4 requests, our own toolchain, 23 documented iterations, 5 days, 56 commits. Tonight we publish all steps with commands and evidence

Foreshadow without TSX: our lab reproduces L1TF against a real SGX enclave on a Skylake i3-6100, recovering 64/64 secret bytes with a split cache oracle. It also demonstrates SIGSEGV-driven register-frame recovery—without TSX. Repro steps and write-up: github.com/ggsec-de/foreshad…

Fallout (CVE-2018-12126) exposes data left in the CPU’s store buffer through transient execution. Our lab explores the signal, cache-based decoding and experimental limits on tested hardware. Explore the lab: github.com/ggsec-de/fallout-…

Spectre v1, from the cache trace to the recovered byte. Our GGSEC lab demonstrates a bounds-check bypass on x86-64 and Raspberry Pi 5 (ARM64), recovering the same canary through cache timing. Explore the lab: github.com/ggsec-de/spectre-… youtube.com/watch?v=-t2sk0qq…

Downfall/GDS (CVE-2022-40982), reproduced in an Intel Skylake lab: same-thread canary → SMT-sibling sampling → kernel rep movs copy-engine leak → no-root KASLR + linux_banner recovery. Code, controls & logs: github.com/ggsec-de/downfall… youtube.com/watch?v=YsQyHNkj… #Downfall #GDS

Inside a Lenovo firmware image with GGFW: UEFI modules, nested executables, disassembly, and evidence-based security triage. youtube.com/watch?v=AY9dSzm-… From flagged code to a structured report. ggsec.de/ggfw/ #FirmwareSecurity #UEFI #ReverseEngineering

GGSec Cortex: HTTP/3 Downgrade Smuggling - 26 Attack Vectors Confirmed Pseudo-header splicing, H3.TE/CL desync, QPACK-hidden CRLF injection, frame-order abuse and cross-user connection-pool poisoning. #HTTP3 #RequestSmuggling #WebSecurity #AppSec #CyberSecurity #BurpSuite #QUIC

GGSEC Cortex Scanner in action ⚡ Detecting and analyzing a Client-Side Desync (CSD) vulnerability as part of an automated web security scanning workflow. #CyberSecurity #WebSecurity #CSD #AppSec youtube.com/watch?v=NHnnD-EH…

Built an HTTP/3 downgrade smuggler for GGSEC Cortex 🔬 Local lab results: 10/10 request-splitting probes confirmed, with a clean baseline. Two malformed QPACK cases were tolerated—flagged separately, not counted as confirmed smuggling. #HTTP3 #AppSec #GGSEC