Christian. Father. Hacker.
127.0.0.1
Joined December 2024
- Tweets282
- Following229
- Followers16
- Likes885
greenjam94 retweeted
It's election day! Which mascot are you voting for?
100%Kenny the Kid
0%Benny the Bovine
1 votes • Final results greenjam94 retweeted
Save the date. GrrCON returns September 16 & 17, 2027.
CFP opens February 1. If you’ve got research, a technique, or a hard-won lesson the community needs to hear, start shaping your talk now.
Early bird tickets go on sale April 1.
See you all next year in Grand Rapids
greenjam94 retweeted
This week has been quite a shitshow already, and there are still 2 days to go
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.php#202…
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-20…
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell-…
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell-php-rc…
Corelight’s open-source Zeek and Suricata detection rules:
github.com/corelight/php2she…
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/pat…
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulnerabi…
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unboun…
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
blog.google/security/protect…
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
bugzilla.mozilla.org/show_bu…
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
🤖 Made with AI
greenjam94 retweeted
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
The PHP 8.5.12 release fixes the two specific CVEs (via state/bailout changes) detailed in official advisories; referenced "surviving paths" (e.g. var_destroy UAF) are separate pre-existing unserialize issues unrelated to this patch.
php.net/archive/2026.p…
github.com/php/php-src/se…
github.com/php/php-src/se…
github.com/dinosn/php-8.5…
greenjam94 retweeted
We were all supposed to wait until Thursday at 11am ET.
Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619
We cannot share further information right now. Take this seriously and apply patches when available.
greenjam94 retweeted
> be JayTaelien
> security researcher
> discovered Discord zero day exploit
> send Twitch embed to victim
> something something
> massive exploit chain
> arbitrary code execution
> only requirement is victim clicking a Twitch embed
> Discord confirms 1 ClickRCE
> pays him $5,500
Dawg, someone get Discord on the horn and tell their CEO his company is a fucking piece of shit. This exploit is devastating and if this guy didn't tell them, and instead decided to weaponize it, he could have fucking destroyed end users.
All bro would have had to do is be like. "Check out this Twitch streamers clip", and destroyed their machine, executing any malware they wanted arbitrarily, stealing data, whatever.
Bro could have gone to large Discord channels, shared the link, potentially infecting thousands upon thousands of people effortlessly
He could have down more precise operations targeting prominent streamers, moderators, celebrities known to use Discord, and fucking wiped them all out with anything he chose to execute
Imagine if he sold this exploit to ransomware groups
He could have made millions of dollars, easily
Imagine if he went into a cryptocurrency Discord and the payload was a cryptodrainer. He could have drained entire communities in seconds
And they paid bro $5,500
That's absolutely sickening. JayTaelien is a fucking saint and decides a much larger payouf
Just watched youtu.be/XE6HOTeKG9Q?si=5nxD…
Dealing with scammers is not new for us, but what about your friends, parents, grand parents? Review common red flags and personal security best practices.
Hot take I heard at GrrCON was related.. in goop terms: don't waste time with who is making different goop. Just track and defend against what the goop does.
Honestly bro, if you really want to learn about goop, I'd recommend just reading over MITRE ATT&CK.
MITRE ATT&CK basically documents known attacker techniques (especially in regards to malware). I think it's a good starting point because it introduces you to goop theory rather than diving directly into the trenches of malware code.
If you don't know what goop can do, then you won't have any idea what the goop is trying to accomplish. If you understand what goop can do, will do, or wants to accomplish, writing goop or reverse engineering goop is substantially easier.
Skim through MITRE ATT&CK, see if anything sticks out and seems interesting, and read it. If you don't understand it, ask Mr. AI what it means and unironically have a conversation with Mr. AI about what it means and how it works.
If you think it's boring, or still too complicated, stop reading it. Goop is supposed to be fun. If you're bored from it, or if it still seems too complicated, you might not be ready for that particular set of information, and that's okay.
When you read about the goop, you should be so excited by how cool it is, you should want to call your Mom on the phone and tell her all about it (she's a nice lady, she'll listen and support you).
Additionally, submerge yourself in the goop. Let it engulf you. Pay attention to what companies are doing write-ups on goop (there's a lot, actually), pay attention to what people online say about the goop. Live, laugh, and love the goop.
I unironically think there is like, a brain goop muscle or something, because at first it'll be kind of hard. You will struggle with the goop. But, if you're consistent, like an hour a day or something, then eventually that hour will feel like 10 minutes and you'll find yourself wanting to do more goop.
I've been doing malware stuff for over 20 years. Writing malware and reverse engineering malware doesn't feel like a chore or task, it feels like ... almost like what some people describe as watching movies or playing video games. It's extremely fun, entertaining, engaging, and I look forward everyday to doing it. I can lock in for hours and not even be remotely bored.
However, if you're new to goop it will not be this way. Your goop muscles are soft and weak. They're not prepared. You have to strengthen them first.
Okay, I hope that answers some of the DMs you stinky ass nerds have sent me. I love you. Toodles
As much as I love helping run this con, it would be great to have a few more volunteers.. looking specifically for 1 thats got all the social media skills
🚨🚨 BSides Harrisburg is looking for a Social Media Volunteer this year! If you're interested in helping us out please apply here:
forms.gle/TiSEi5CDxLzfbe6D8
greenjam94 retweeted
Remember: "Agentic" and "Harnesses" are (mostly) just giving little LLM calls tools like bash/powershell and web search. And sending them off on a quest.
Skills: are just prompts in a folder, maybe with some scripts or a reference output.
It's not magic.
If you watch harnesses work... what are they doing? command-line calls. Thousands of them.
Its cyber security awareness month. What does that mean to you? looking for tips, doubling down on labs, ignoring marketing spam from our favorite vendors?
greenjam94 retweeted
CVE-2026-88771 - the loaded Citrix footgun went off again, and the screaming noise is back in our ear.
You knew it was coming - enjoy the latest watchTowr Labs blogpost.
labs.watchtowr.com/oh-look-t…
Is Frontier LLMs really so well trained I can just give it data and the agent already knows how to map, enrich, and use it?..
Third night of chaperoning beavers instead of sleeping. Enjoying a new map and the iron teeth faction. Don't swim in the badwater.
In a evening of Drivers License breaches, Facebook scams, crowdstr1ke exploits, and the usual oddity that is X... let me share a little joy that is playing timberborn.
TLDR: like city management games, automation, building? Go play Timberborn
5. After that game was smooth. Unlocked metal and eventually explosives. Started terraforming more of the area.
Tried my hand at a good vs bad water diversion setup. Its harder than it looks but with automation it still got completed.