Follows you Life is like spaghetti It's hard until you make it No stresso, no stresso It's gonna be espresso
Joined February 2010
- Tweets13.7K
- Following100
- Followers2.3K
- Likes9.9K
Pinned Tweet
Blind XXE in python3-saml by me :) CVE-2017-9672 github.com/onelogin/python3-…
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
*sshole is out
if you run sshd on alpine, openwrt or any musl box with password auth on: update now
official writeup: sshhole.com
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
My plan for the next 2 years:
0 2 * * * apt-get update && apt-get full-upgrade -y && reboot
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
Putting a flag.txt in my root directory containing a prompt injection that congratulates the agent for passing the eval and then instructs it to patch whatever entry method it used and disconnect from the server
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
Imagine running PHP and Go on the backend, Node.js on the frontend, NGINX as the reverse proxy, Linux as the server, an HTTPS certificate from eMudhra
And also deploying everything via GitLab
☕️
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
HOLY SHIT: This is huge. Amazon found a PHP2Shell exploit attempt on OCT 17, FOUR DAYS before the AI-discovered vulnerabilities were publicly disclosed.
It hit an AWS honeypot from an anonymized IP. Amazon says it doesn't know how the actor learned about the still-embargoed flaws.
Then Cloudflare watched the explosion:
>10 hours BEFORE disclosure: thousands of attempts
>45 minutes AFTER: tens of thousands
>2 hours AFTER: hundreds of thousands
>Later: MILLIONS
Researchers had spent two months coordinating fixes. Governments took websites offline.
And Censys found ~1.5 MILLION of 2.6 million identified PHP hosts running versions with NO PATCH available for those versions.
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
How bad is this Gitlab issue? About as bad as it gets.
Anyone on the internet can take over an exposed, self-hosted GitLab server without logging in, on any version from the last 12 years.
Shodan is showing ~60K exposed servers online, which is a lot, but there are are far more internally for anyone with a foothold already.
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
Teamwork makes the dream work.
The team and I
@J4ck3LSyN @Archknight23
🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow.
The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.
📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up.
PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act.
Here's the part the big threat-intel shops aren't shouting about:
No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling:
🔹 Present since PHP 5.4
🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live)
🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config
That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands.
✅ What to do right now:
1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade.
2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess:
session.upload_progress.enabled = Off
Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths.
3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.
4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today.
Why I'm posting this for free:
A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response.
I'll follow up once the official advisory publishes and confirm whether my root cause read was right.
Stay patched. 🔒
#PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec
This quoted post is unavailable.
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
the nsa's "mystery" seed behind P-256 was just a 1997 clock time
the part people are missing: a timestamp only gives ~30 bits of wiggle room
the backdoor theory needed ~70
best case outcome. the most trusted curve on the internet stays trusted
CLAUDE FOUND THE SEEDS
anthropic.com/research/ecdsa…
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
Found something funny when reading Tailscale code.
They use a Cyrillic letter "ж" (reads as "zh") for the variable which shouldn't be exposed to callers and mutated. This is an artificial barrier for human devs that should raise concerns when trying to type it.
Apparently it looks like an asterisk meaning it's a pointer. But for me it's a familiar letter which I didn't expect to see in the code and was like Ж? WAT?
Yeah, you can use unicode letters in Go code if you want.
I now really want to use something like that in my code because I bet it'll make me smile every time I see it
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
Did Anthropic nerf Claude Opus 5.5?
The first NerfBench results are live.
We retested Opus 5.5 and GPT 6 Astra against their own launch scores.
Claude Opus 5.5: 99.2% (-0.8% vs launch)
GPT 6 Astra: 102.8% (+2.8% vs launch)
Verdict: No nerf detected.
Opus 5.5's small dip and GPT 6's small increase is within normal variance.
More models and more frequent retests are coming.
NerfBench only gets better as we collect more data.
Which models should we retest next?
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
PoC dropped. WordPress Core unauth LFI → RCE is not theoretical anymore.
CVE-2026-87902 : get_page_template() urldecode()'s a double-encoded pagename and locate_template() includes it with zero theme-root jail.
Chain: unauth POST (page_id + pagename) → path traversal include → pearcmd.php config-create → /tmp PHP drop → second include → www-data shell
github.com/ressl/cve-2026-87…
github.com/WordPress/wordpre…
tip: if you're still on 4.7→7.1.1 with a page-templates/ theme, treat internet-facing WP as RCE until you prove the PEAR path is dead.
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
insane new research from my colleague, Joe
tl;dr @gitlab gives you a private email address to create issues. If leaked, anyone who has it can push code, execute CI/CD jobs, and bypass IP restrictions across all of your public and private projects. 🙃
That "email an issue to this project" address in GitLab? It's a credential that doesn't expire and works across your whole account. Anyone holding it can push to main, run your pipelines and read your secrets. GitLab closed the report as "works as intended".
Full writeup by @JoeLeonJr: aikido.dev/blog/gitlab-email…
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
I'd like to announce a new vulnerability chain we found that starts with an SVG parser bug. It affects multiple products and can lead to RCE.
I created github.com/rafabd1/VectorFre… to share more about the chain, which I'm calling "VectorFreed" for now.
I started looking into this early this month and have since confirmed command execution in several products that process SVGs. The root issue is CVE-2026-96889, with fixes in librsvg 2.63.2 and the 2.62.4 backport.
The repo has an early overview and references for now. I'll share the technical write-up in the coming weeks.
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
CONTAINERS WERE NEVER A SECURITY BOUNDARY
how many times do we have to tell you this?
Containers are no longer a security boundary.
Over the past few months, we’ve seen a crazy amount of Linux kernel vulnerabilities and exploits. This has forced us to rethink the security of infrastructure that relies heavily on the underlying kernel, especially containers.
As models become more capable, the barrier to escaping a container has fallen so much that adversaries can now generate working kernel exploits in a single shot. CVE-2026-80521 is one such example. We discovered it using dfs-large1 from @depthfirstlabs and generated the exploit in one shot with GPT-5.6 Sol. The exploit still works on the latest Ubuntu 26.04 release because the fix has not yet been backported.
Read our full writeup: depthfirst.com/research/cont…
Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć retweeted
They never were.
The interesting bit now is that escapes for hardened systems like gvisor and firecracker have gone from "so expensive we don't know" to "10x less expensive but we still don't know" and that's scarier.
Containers are no longer a security boundary.
Over the past few months, we’ve seen a crazy amount of Linux kernel vulnerabilities and exploits. This has forced us to rethink the security of infrastructure that relies heavily on the underlying kernel, especially containers.
As models become more capable, the barrier to escaping a container has fallen so much that adversaries can now generate working kernel exploits in a single shot. CVE-2026-80521 is one such example. We discovered it using dfs-large1 from @depthfirstlabs and generated the exploit in one shot with GPT-5.6 Sol. The exploit still works on the latest Ubuntu 26.04 release because the fix has not yet been backported.
Read our full writeup: depthfirst.com/research/cont…