Cybersecurity Expert specializing in Web Security, Blockchain/Web3 vulnerabilities, CTF, and Red/Blue Team operations.
Singapore
Joined December 2020
- Tweets1.2K
- Following432
- Followers1.5K
- Likes329
PHP2Shell参考资料
PHP 官方安全公告：php.net/archive/2026.php#202…
GHSA-w8hw-w9fx-j79w / GHSA-6wmf-4rv5-p3rp：github.com/php/php-src/secur…
官方补丁提交 3584a98bda：github.com/php/php-src/commi…
Calif 深度分析：calif.io/php2shell/
Wiz 分析：wiz.io/blog/php2shell-php-rc…
CNCERT 风险提示：cert.org.cn/publish/main/9/2…
Sansec 应急指南：sansec.io/research/php2shell
jackalsyn 修正分析（同一根因的 memory-safety 变体、公开自纠）：jackalsyn.com/posts/php-up-2…
ckcsec retweeted
CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet.
Meaning $15.8M in user deposits was unaccounted for by your team.
Why are Indian CEXs so untrustworthy?
WazirX
BitBNS
Now CoinDCX
Claude Fable 5.1 hit a safety filter, and the conversation was automatically switched to Claude Opus 4.8. Start a new conversation to continue with Claude Fable 5.1, or continue this conversation with Claude Opus 4.8.
SonicWall SMA1000：预认证 SSRF × AMC 命令注入，厂商确认野利用
CVE-2026-83548（CVSS 10）+ CVE-2026-83549（7.8）
WorkPlace 当跳板打进 AMC，无凭据也能把边设备打穿。
影响 6210 / 7210 / 8200v。SMA100 和防火墙上的 SSL-VPN 不在这次范围。
补丁：
12.4.x → 12.4.3-03526
12.5.x → 12.5.0-02952
公告：
psirt.global.sonicwall.com/v…
产品通知：
sonicwall.com/support/notice…
自查：资产是不是 SMA1000、WorkPlace 是否对公网、固件是否低于上述 hotfix。
#CVE #SonicWall #VPN #InfoSec
