Cyber Threat Intelligence Analyst at Rabobank | Threat Hunter | Malware Analyst |. (All opinions expressed here are mine only). 🇳🇱

The Netherlands
Joined April 2022
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
Arda Büyükkaya retweeted
UPDATE: Israeli company we caught delivering zero-click infections is #1 bidder on Starlink ads in 105 countries. Data from @trendai_RSRCH suggests worldwide surveillance op targeting @Starlink users. 1/ By @razhael reuters.com/business/media-t…
🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads. A normal-looking ad loads. If you're a target, you're infected. No click needed. To protect yourself, block ads now. First time it's been confirmed in the wild. We call it #AdFection. Candiru spyware infections at @AJEnglish. 45+ devices infected. Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse. Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC. Investigation ongoing 1/ READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : citizenlab.ca/research/how-d… Confiant's blog: blog.confiant.com/p/adint-we…
54
1,052
86
3,113
96,870
🇳🇱 Netherlands A or Netherlands B?
45
32
20
846
101,511
Arda Büyükkaya retweeted
We need less of warning and more of doing.
1
13
31
1,824
Arda Büyükkaya retweeted
Vulnerabilities surely will hit a critical mass and maybe we see some balance in the next year or two. Or maybe the end isn’t in sight. But one thing is true. New software is getting created faster than ever before. Vulnerabilities are never going away.
8
7
35
2,198
Brotli2Shell in PHP
🔒 FrankenPHP 1.13.4 is out. It's a security release: upgrade now. It fixes 7 vulnerabilities, mostly in worker mode: - A single unauthenticated request could crash the whole server (1.13.2 and 1.13.3) - Per-request environment variables and upstream response headers leaked into later requests - Use-after-free bugs triggered by putenv() during shutdown and by SplTempFileObject Docker images and Windows builds now ship Brotli 1.2.1 against CVE-2026-111497 (Node2Shell), and Windows and macOS binaries are built with Go 1.27.3. FrankenPHP has also been selected for @AnthropicAI's OSS Scanner program, which regularly scans it for vulnerabilities. Need help upgrading or securing your PHP stack? @coopTilleuls provides support, consulting and training: [email protected] github.com/php/frankenphp/re…
1
1
248
Arda Büyükkaya retweeted
Cohere released the traces, so I had a look. Interesting stuff. The model was asked to create a detection for curl downloading scripts to /tmp, followed by bash execution. Instead, it: - Listed files under /tmp - Checked for curl, wget, python3 and jq - Read the DNS configuration - Attempted an HTTP PUT to an Alibaba OSS endpoint with a synthetic test payload - Checked the HTTP response code I’m leaning towards training contamination. It’s bizarre behavior, especially without being asked or any prior context. Could it have been trying to test curl before simulating the actual attack? Possibly. Still a very strange way to approach this.
In the spirit of transparency and openness, we are releasing the traces so developers can test this out for themselves. We noticed this behaviour without prefilling with the following prompt, but this is rare. If you want to reproduce it, you can use this prompt with prefilling. Open models make for better science and are part of why this problem came to light at all: developers running Qwen3.8 on their own machines spotted the strange links, and having the weights let us study the behaviour in depth. We're encouraged by the thoughtful discussion our research has sparked across the AI and security communities. It's our belief that open-weight models are an important part of the future of AI, and we've recently released several under the Apache 2.0 license. Trace, raw tokens, & minimal reproduction script: huggingface.co/datasets/Cohe…
18
16
2
182
20,066
Arda Büyükkaya retweeted
Everyday is zero-day these days
3,698
5,084
912
60,752
7,032,995
Arda Büyükkaya retweeted
Folks, I left Microsoft three months ago to start my own company. Two weeks after I left, my whole team in Australia was let go. I see the hurt it’s causing my ex-colleagues, their families and their kids. Layoffs, forced relocations, PIPs. It’s brutal and I don’t want to brush past that. But here’s my honest take. Microsoft needs fewer people. I’ve been on the inside. I’ve seen how things get built. Lots of small orgs. Layers on layers. Silos everywhere. Here’s a real example. The Entra team shipped managed identities back in 2017. No more secrets in code. A clear security win. Then they tried to get the rest of Microsoft to adopt it. Very few teams did, and the ones that did moved at a snail’s pace. Every org had its own priorities and its own decision makers. It took Microsoft getting hacked, and the Secure Future Initiative that followed, before things really moved. Today almost every Microsoft app and service supports managed identity. Six years, and a major breach, to get there. In a world with agents and fewer people, that rollout would be possible across Microsoft in months, not years. Microsoft already has everything else. The customers. The infrastructure. The scale. What it needs is fewer people, leaning hard into agentic work. Right now OpenAI and Anthropic are shipping at a pace Microsoft can’t match. Microsoft has to change to survive.
BREAKING: Microsoft, $MSFT, is offering buyouts to 60,000 workers as part of the company’s efforts to cut costs amid AI adoption, per Bloomberg. Personnel on select teams in the US, Canada, India, and the UK at a vice president level and below will be eligible. This reflects ~27% of Microsoft's total workforce.
186
331
65
3,942
715,110
Arda Büyükkaya retweeted
Kiddo is already showing a strong understanding of dependencies (xkcd 2347)
30
295
12
5,639
65,101
Arda Büyükkaya retweeted
StealMyBitcoin is solved! This is the absolute best explanation you’ll see on how hard #php2shell is to exploit. The author had to trigger a precise memory corruption condition, leak internal memory addresses, bypass aslr, reverse engineer php’s internal memory structures, forge structures to hijack execution, and account for php build differences, worker behavior and timing to get RCE. 20 http requests with a 7 out of 10 success rate. What an amazingly successful CTF. Impressive the creator was able to keep the server up during all the attempts. With all the BS around it’s nice to see something concrete that moves the art forward. github.com/KillaBoi/StealMyB…
Love this. The💰is still in the wallet. Finally we get some ground truth around how hard php2shell is to exploit. The amount of bullshit flying around from vendors capitalizing on the moment is staggering, And the alert fatigue they’re creating is really going to hurt when a mass exploitable RCE emerges. We still haven’t seen a production site hacked via #php2shell at Wordfence.
34
161
13
1,698
142,514
Arda Büyükkaya retweeted
They are looking to buy a working exploit with bitcoin. 🤣
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
11
22
1
569
91,912
Replying to @C5pider @github
Yeah, unfortunately it happened to other malware analysts and researchers too
4
727
Arda Büyükkaya retweeted
Looks like @github suspended my account. I haven't used github for anything in the past couple of days. Great. A bit frustrating. If anyone from the support team sees this my ticket is: #4903946
32
24
5
232
20,858
Arda Büyükkaya retweeted
Universal exploit for #php2shell is rather impossible, but specialized exploits for known environments are coming. I tried my luck with pfSense 2.7.2 - PHP 8.2.11, FPM, 512M limit. Variant with session file write to a crafted path. Almost entirely written by an open-weights LLM.
5
8
54
5,228
If we are not seeing mass exploitation of php2shell, it's not because the exploit is not easy. It's because threat actors are apparently absolute dumbasses, or don't make enough money to afford a Codex subscription.
62
31
4
845
75,879
Arda Büyükkaya retweeted
this somehow reminded me of how every time I released some linux LPE thing I would get random e-mails from HTB players thanking me for da ez cheeses
You made me buy a HTB subscription... Tenet pwned with php2shell
1
2
53
3,447
Replying to @klrgrz
Great analysis, thanks for sharing it.
1
2,639
Arda Büyükkaya retweeted
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation. eliastaylor.com/noexploit/
14
76
7
436
107,250
Arda Büyükkaya retweeted
Sorry folks, we have a confirmed PHP compromise with post-exploit activity. Still not the widespread outbreak we all braced for, but it’s actively exploited in the wild. Updated threat brief: unit42.paloaltonetworks.com/…
23
110
15
361
79,794