For the love of…
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
MVG_Hells retweeted
She doxxed an ICE officer on Facebook and told people to "blast HER." Then investigators looked at her phone.
Arely Guzman was a real estate agent in Albertville, Alabama, and one of the loudest anti-ICE voices in town.
Her phone showed she was helping move illegal aliens, including Chinese nationals, and handling cash for a smuggling ring run by an inmate in an Oklahoma prison.
She pleaded guilty in federal court this summer.
This week a Texas jury convicted three more members of that same ring. Prosecutors say it made over $5 million.
Their enforcer shot a man, tried to dissolve his body in acid, set it on fire, filmed it, and sent the video to the boss.
That's the operation this "activist" was part of while she was out there trying to sic a mob on an ICE employee.
Next time a Democrat tells you that unmasking ICE agents is about "accountability," remember her name.
Sometimes the person screaming loudest about ICE has the most to hide.
justice.gov/usao-wdtx/pr/hom…
MVG_Hells retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
MVG_Hells retweeted
And the security shitshow continues... Four more things to add to yesterday's list. We're now at nine(!) major security issues and developments in just a few days.
6. ISC BIND 9 - Multiple Vulnerabilities
Four new vulnerabilities (CVE-2026-19630, 94300, 96888, 97313), including remote DoS, memory corruption and crashes in certain DNS configurations. Fixed in BIND 9.20.30 and 9.21.27.
kb.isc.org/docs/all-bind-adv…
7. Oracle Java / JSSE (CVSS 9.1)
CVE-2026-91403. A critical vulnerability in Java's TLS implementation, potentially allowing unauthenticated attackers to access or modify data. Affects Java 8, 11, 17, 21, 25 and 27, plus GraalVM.
oracle.com/security-alerts/a…
8. Windows SMB Server DoS (CVSS 7.5)
CVE-2026-96325. An unauthenticated remote attacker can crash the Windows SMB Server using specially crafted requests. Not RCE, but still a serious availability issue for exposed systems.
msrc.microsoft.com/update-gu…
9. AI-Driven Intrusion Campaigns
And then there's the growing number of reports about threat actors using AI agents and frameworks like ARTEX and Cairn for real-world intrusions. Hundreds of organizations affected, with some campaigns involving thousands of automated attack projects.
Microsoft / ARTEX:
microsoft.com/en-us/security…
NorForge / Cairn:
norforge.com/blog/inside_cai…
I'm starting to wonder what next week will look like...
(you can find 1.-5. in the quoted tweet)
🤖 Made with AI
This week has been quite a shitshow already, and there are still 2 days to go
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.php#202…
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-20…
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell-…
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell-php-rc…
Corelight’s open-source Zeek and Suricata detection rules:
github.com/corelight/php2she…
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/pat…
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulnerabi…
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unboun…
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
blog.google/security/protect…
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
bugzilla.mozilla.org/show_bu…
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
MVG_Hells retweeted
Yesterday, we promised free PHP2Shell hunting material. Today, we’ve created a Hunt Lead covering successful exploitation against a Linux system.
Researcher analysis is normally subscriber-only. For this Hunt Lead, we’ve made the full analysis free to benefit the whole community.
Here’s what you’ll get:
• 14,838 normalized records covering EDR, auditd, Sysmon for Linux, authentication and system logs, plus Zeek HTTP, connection and file-analysis records.
• 5 endpoint alerts and 145 Suricata records, with network rule matches distinguished from stream warnings.
• 10 KQL hunting queries, 3 Sigma rules and 3 Suricata rules to review and adapt for your environment.
• 5 investigation questions connecting the network activity with evidence from the host.
• A downloadable PCAP and investigation guide so you can examine the exploitation traffic in Wireshark alongside the host evidence.
The Hunt Lead also covers the vulnerabilities, affected versions and mitigation steps, with the information dated 22 October 2026.
Linux is the first release. We haven’t seen a working Windows PoC or successful PHP2Shell exploitation against our Windows environments. So far, the Windows activity we’ve observed has been fingerprinting and reconnaissance.
We’ll add verified Windows evidence to the same Hunt Lead when it becomes available.
Investigate the lead, read the brief, inspect the findings, grab the Hunt pack and explore the detailed researcher analysis. Then use the queries and rules to start hunting in your own environment.
All of it is free for everyone.
threathuntinglabs.com/leads/…
MVG_Hells retweeted
The full release of Enshrouded is coming tomorrow to PC and PlayStation 5! 🎉And for your first taste, we're releasing the launch trailer a day early. Check it out!
MVG_Hells retweeted
🚨EXCLUSIVE J6 INVESTIGATION
- Thanks to new House Speaker Mike Johnson, We now have permission to release Capitol CCTV footage proving that a member of Nancy Pelosi's security detail, Special Agent David Lazarus, perjured himself on the stand during the Oath Keepers trial.
- Lazarus was brought in to corroborate another Capitol police officer's account claiming that he had antagonistic encounter with the Oath Keepers. But footage of Lazarus proves that he was lying.
- These lies, spread unquestioningly by the media and Democrat politicians, were used to put innocent people in prison, ruining their lives and the lives of their families. They and their attorneys did not have access to the footage at trial that Blaze Media is releasing today.
- Instead, Harry Dunn was made a hero by Joe Biden and Nancy Pelosi, and as a result of his and David Lazarus's false testimony, there are innocent people in prison.
- The government lied about this. What else are they lying about?
MVG_Hells retweeted
🚨 BREAKING 🚨
ATF Releases NFA guidance in response to the Texas NFA lawsuit:
"Effective October 9, 2026, ATF will no longer require individuals to seek ATF approval under the NFA before making or transferring short-barreled rifles, short-barreled shotguns, silencers, and “any other weapon[s]” as defined in 26 U.S.C. § 5845(e). ATF will also no longer require such items to be registered in the National Firearms Registration and Transfer Record. These policies apply uniformly to anyone otherwise subject to these requirements, not just to the plaintiffs in the litigation."
MVG_Hells retweeted
إيلون ماسك خلى الخيال حقيقة.
صاروخ Starship وصل المدار...وفتح بطنه ونزل ٢٦ قمر Starlink مرة واحدة، كأن الصاروخ بيطلع حبات من علبة PEZ!
علشان نتخيل صاروخ بحجم ناطحة سحاب تطلع للفضاء.... تدخل مدار الأرض وبعدها ترمي ٢٦ قمر صناعي في رحلة واحدة.
والأقما الجيل الجديد يعني أقوى بكتير من أجيال سابقة....
بقينا بنتفرج على المستقبل وهو بيتبني قدام عينينا.
مفيش حاجة اسمها مستحيل بالعلم
MVG_Hells retweeted
We’re proud to announce that #Valheim 1.0 is out now! Gather your friends, sharpen your axes and check out the patch notes below. We’ll see you in the tenth realm! valheim.com/news/valheim-1-0…
MVG_Hells retweeted
If Mamdani would like me, a white New Yorker who never owned slaves, to pay a black New Yorker who never was a slave, then I propose:
Every Muslim in NYC starting with Mamdani, should pay us for 9/11.
Please explain why the latter makes no sense but the former does.
MVG_Hells retweeted
🚨 JUST IN: Video has been released of suspected vandals DESTROYING the lining of the Lincoln Memorial reflecting pool
Trump Derangement Syndrome seems to be a BRAIN EATING disease. This is INSANE.
This particular incident took place on June 19. Now, even NYTimes is admitting TWO ~170ft blade cuts have been found.
THROW THE BOOK AT THEM!
Wow
Today, I’m releasing never before seen intelligence revealing new evidence of past US government funding for more than 120 biolabs in over 30 countries, including Ukraine.
In support of President Trump‘s Executive Order to end federal funding of dangerous gain of function research around the world, and increase transparency and accountability, ODNI will continue working with partners across the Administration to identify where these labs are, what pathogens they contain, and what “research” is being conducted.
odni.gov/index.php/newsroom/…
MVG_Hells retweeted
WOW 🚨 United States Pardon Attorney confirms the ONLY pardon that was physically signed, not by autopen, was Hunter Biden’s pardon
He says Anthony Fauci was very worried about getting a pardon and reached out to make sure he got one, he immediately officially accepted it to make it legal once he got it
“The only signature on pardons that you see with a wet pen is Hunter Biden, which was signed at Thanksgiving. All the rest are auto pen, which begs another question
But most importantly, you can see these are email exchanges where Fauci, Dr. Fauci's lawyer, is saying, will there be pardons for Fauci? And then in the morning of January 20th, and just in time for the change of the presidency, Fauci got his pardon. And you have to accept under American law, the one thing the Supreme Court has said is you have to accept the pardon. So Fauci immediately had his lawyer say, I accept the pardon, and sent that in. So they were very aware that they needed that and they wanted it.”
Crimes Against Humanity can’t be pardoned
Also according to everything I could find, the presidential pardon system was never meant to be used the way Biden used it. Every pardon should be thrown out
MVG_Hells retweeted
Every dollar Elon Musk has made is traceable. Every product sold, every service rendered, every government contract awarded, every share of stock bought or sold. It’s all on the record.
You, on the other hand, haven’t built a company, invented a product, or created anything people willingly pay for. You’ve spent the last 14 years collecting a $174,000 Senate salary.
Yet somehow you managed to buy a luxury D.C. condo, a $4 million Victorian mansion in Cambridge, and saw your net worth balloon by 150% to $12 million. Everyone knows where Musk’s money came from. The same can’t be said for yours.
MVG_Hells retweeted
Oh, great
deadeclipse666.blogspot.com/
MVG_Hells retweeted
On January 6th I followed the crowd into the Capitol and shouted. Police stood by the whole time, hanging out with us and sometimes directing us places.
At one point near the House Chambers I was walking downstairs when a trio of some special section, secret service looking men started pointing guns in my direction.
Confused and annoyed, I walked the other way and when I saw a normal police officer asked him why they were doing that.
He informed me a protestor (Ashli Babbit) had been killed, and advised me to leave the building.
I walked towards the exit and after a short rest on the bench I left.
I harmed nobody and damaged no property that day and complied with all police orders.
What I received for that was a pre-dawn raid at my parents house, where my 1 month post-partum wife and I were staying, on Biden's first day in office. His DOJ had signed the order to arrest me 3 hours after his inauguration.
In the subsequent weeks I received death threats online and harassing phone calls, something that would be ongoing for the next few years.
I was banned from Meta and Paypal. My wife and I were both debanked by PNC and banned from Airbnb. My wife was detained at the airport for hours with our newborn daughter.
I was charged with 4 misdemeanors and the 1512 unconstitutional felony. The government offered to drop the misdemeanors if I pled to the felony. The felony was a lie, so I refused and went to trial.
At trial the prosecution for 2 days straight was allowed to show footage to the jury of things that occurred around the Capitol I wasn't present for "for context." When we asked to put forward footage that contradicted the prosecution's "context" we were not allowed. They could show what they wanted, we could not.
Police officers were then put on the stand for the next 2 days who cried about their experiences. I had no idea who they were. They admitted they never saw me or interacted with me.
Nevertheless like every other J6er, I lost, and was sentenced to 4 years and $22k in fines and restitution. Yet even after the Supreme Court overturned the felony, the judge would not let me out until my misdemeanor sentences of a year were maxed out. Because she can't count she actually kept me in longer - to the extent she intervened at the last minute to make the prison release me on a Sunday, something that is against BOP rules. My family sat outside the prison gates the Friday before practically the whole day waiting in vain because of this pettiness.
But the government wasn't satisfied with their pound of flesh: after my release they took me back in for resentencing, to attempt to have me resentenced after the fact to my misdemeanors consecutively, so I'd be taken from my family again and have another 1.5 years behind bars. This time I won, as they had no legal precedent and it skirted on violating double jeopardy since I had served my full prison time. Even still, it cast a cloud over the holidays and cost me another 20k my family couldn't afford.
People ask whether prison was bad, and yeah of course prison sucked. It was a hard and violent place. I was present for a stabbing, and was lucky to avoid two fights and a race war.
But dealing with Biden's DOJ and the DC Judiciary was the real trauma - they would grind down your spirit by weaponizing the legal system and use the endless procedure to bankrupt you. I had nightmares for months after release that I had somehow been hit with new charges.
By the time I was pardoned by President Trump, I had spent literally every single day of Biden's presidency either in prison or under some form of supervision. I had incurred over $300k in legal fees and over $1 million in lost business.
It was a reign of terror, and yet it was a mere foreshadowing of what they had planned for anyone else who opposed them under Kamala. The country should never forget it.





























