#PurpleTeam | Ex @RaytheonTech MSSP, @SCYTHE_IO, & @GD_OTS | Taught at BlackHat & DEFCON | #100DaysofSigma | Keep exploring, keep learning, and stay curious
Tampa Bay
Joined May 2020
- Tweets6.1K
- Following1.6K
- Followers6.7K
- Likes10.4K
Pinned Tweet
My SANS Purple Team Series: Threat-Informed Detection Engineering Webinar with @jorgeorchilles is on YouTube!
Video: youtu.be/2czm8dhziX8
Blog post: sans.org/blog/purple-teaming…
Christopher Peacock retweeted
Update to #PHP2Shell Alert: SIGMA rule helps identify potentially suspicious activity & incorporated partner resources. If your org can't update immediately or uses unsupported PHP 8.1 or earlier versions, take affected PHP-based systems offline until patched or updated.
🚨 Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable unauthenticated #RCE and affect PHP installations serving web requests. Learn more: 🔗 go.dhs.gov/5Hi
Christopher Peacock retweeted
🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST.
Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using:
🟧 ActiveScan++ v2.0.13 (portswigger.net/bappstore/31…)
🟧 Bambda scan checks (github.com/PortSwigger/bambd…)
🟧 BChecks (github.com/PortSwigger/bchec…)
Start scanning for the vulnerability now → portswigger.net/bappstore/31…
Christopher Peacock retweeted
If you are wondering whether your website is affected, we have packaged a Codex skill to help check.
Point your Codex at this repo to guide you through it: github.com/openai/php2shell-…
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
Cyber espionage and military cyber operations should be an entire course in cybersecurity degree programs.
A lot of defenders don’t fully understand the game they’re playing or the adversaries they’re playing against.
Generative AI will reduce patch diffing for 1 Day Exploits from hours to minutes.
Organizations must adopt rapid, high availability patching to endure this shift.
"A responder noticed a GRE tunnel in network monitoring that didn't exist in the running config and left no trace in the logs." 👀
In today's Breach Please, me and Jess revisit the idea of detecting threat actors hiding in network devices to evade detection. This was inspired by a report from @sygnia_labs.
Real talk: how do YOU validate your network devices are free of malware?
Christopher Peacock retweeted
There's unpatched pre-auth RCE in Log4j2. Latest version. There's no CVE and no patch.
But also, don't panic - this isn't Log4Shell all over again.
I tested 50+ products and couldn't find any exploitable ones.
More info, scanner, and rules here: jeffmcjunkin.com/posts/log4j…
These are some very interesting posts by @cyb3rops and @fr0gger_ and what GenAI means for CTI.
LinkedIn Link:
lnkd.in/p/evcb6AwU
Jane Street Blog - Magic-trace: Diagnosing tricky performance issues easily with Intel Processor Trace blog.janestreet.com/magic-tr…
"Malware Detection Using Electromagnetic Side-Channel Analysis" by Matthew A. Bergstedt scholar.afit.edu/etd/5316/
Monitoring Side-Channel Signals Could Detect Malicious Software on IoT Devices coe.gatech.edu/news/2016/08/…
What do you call a technique that’s documented in the popular CTI framework?
67%ATT&CK Technique
33%MITRE Technique
6 votes • Final results
Pretty interesting: retrieves the command-and-control (C2) domain from a blockchain smart contract. Instead of hardcoding the server address... queries multiple Polygon RPC endpoints defined in CONTRACT_CONFIG.RPC_HOSTS
levelblue.com/blogs/spiderla…
This is very interesting for those working in DFIR:
youtu.be/OsUg3TlAqjQ?si=N7GU…
Christopher Peacock retweeted
Dropping a new tool today: TTPRunner
- One-click Vectr deploy
- Give it a threat report, PDF, or just plain-english instructions and it'll build an execution & simulation plan for you
- Executions are tracked via notes and automatically sync'd with Vectr
Works great with: github.com/Antonlovesdnb/Con…
Check it out! 🔽
github.com/Antonlovesdnb/TTP…
Christopher Peacock retweeted
Can LNK files ever be trusted?
⚡ My latest blog post demonstrates several new LNK abuse methods, allowing you to fully spoof the target shown in Explorer. It also introduces tools to create your own LNKs, and detected spoofed ones yourself.
🐬 wietzebeukema.nl/blog/trust-…
I’m gonna need a copy of coalfire’s contract template since it’s battle tested and held up in court 😆
arstechnica.com/security/202…
