i make computer do bad 🧙 security researcher 📺 1M+ youtube prev: fuzzers & hypervisors @microsoft Business: [email protected]
Washington D.C.
Joined July 2021
- Tweets4K
- Following1.6K
- Followers57.8K
- Likes16.3K
Low Level retweeted
A trusted contact who has a working exploit tells me reliable exploitation is still possible against PHP 8.2.35 and 8.5.12, despite the security updates.
According to their testing, setting
session.upload_progress.enabled = Off
blocks that exploit path.
I haven’t reproduced this myself. Whether this is an incomplete fix for the disclosed CVEs or a separate issue still needs clarification.
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
Unvalidated AI output (author admits in replies: omp with glm5.3 + ds4), not a lab result. Its screenshot says both CVEs are fixed; the 'surviving paths' need unserialize() of attacker data or an app LFI. Patch per php.net: php.net/archive/2026.p…
Low Level retweeted
i'm sure you're all better than me at this but just some of what we've seen if it helps - they're not going to stop. it's going to get increasingly sophisticated and they're going to go after every surface of your system and all of your employees
any old projects you've long forgotten about will be found and used against you
the only reason we're surviving is because we have agents going 24/7. we're still barely sleeping
good luck, sorry you're dealing with this, but really it's a collective problem we're all facing together
BRRRRRROTHER
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-…
Low Level retweeted
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-…
friend asks you to drive him to the airport on the same day your dog died
We are investigating reports of degraded performance for Actions, Pull Requests and Webhooks githubstatus.com/incidents/n…
Low Level retweeted
Critical PHP vulnerabilities to be disclosed tomorrow: php.net/archive/2026.php.
We're working directly with the PHP Foundation to get patched PHP versions into our base images for Laravel Cloud, Forge, and Vapor ASAP.
You may need to redeploy your apps at that time to use these patched versions, but we're also working on the ability to silently patch applications without needing a redeployment.
All customers have been emailed and we will be providing further updates via email as the situation evolves.
Low Level retweeted
Since I heard about this #PHP #RCE last week, I've been preparing a tool for everyone who doesn't know what to do right now:
process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity
Until a patch is out, isolation (containers) and tight monitoring are your best bet to limit the damage. And I'm sure the LLMs already go "brrrr" and people are trying to reproduce the vulnerability.
From what I've heard, exploitation will probably show up as suspicious sub process spawns. That's exactly what this watches, using eBPF: one static binary for Linux (amd64, arm64), no dependencies, running in a few minutes. It can also kill the ones you name (dry run first), but it's a detection layer, not a patch, and it can't see anything that happens inside PHP without starting a process.
Quick start: github.com/Neo23x0/process-w…
Project: github.com/Neo23x0/process-w…
holy shit this is so bad lol. wormable RCE over the air
huh, same combination as my luggage
A hacker got access to personal data belonging to more than 8.8 million people in Denmark, and the password involved was apparently just “123456”.
The company, Pays ApS, had legitimate access to Denmark’s Central Register of Persons, which contains sensitive information like names, addresses and personal ID numbers.
According to reports, three accounts at the company were using “123456” as their password. One of them was an admin account.
The attacker used the account to make around 14 million searches in the database.
The breach wasn’t discovered immediately. It was only noticed later when an unusually large invoice showed that the company had been making a massive number of database searches.
uhhhhhhhhhhhhhhh
claroty.com/team82/research/…
Low Level retweeted
Catch up on the recent NetScaler zero-days, I wrote about them here.
shenetworks.substack.com/p/w…
people are saying “why are fridges able to be remotely controlled?” I actually think that makes sense, being able to centrally supervise 100+ fridges in a store
this smells more like “someone left a management interface internet facing”
