Cyber security engineer. #blueteam This account is for kittens, memes, paintins and rants about my country politics. follow me on hmier bsky & cara.
Joined July 2009
- Tweets128K
- Following1.7K
- Followers1.8K
- Likes164K
Helios Mier retweeted
This is fascinating. You can see drastic changed in a human personality after a stroke. Here, flipping two artificial neurons in the Qwen model turns it into pure evil.
Helios Mier retweeted
Emergency WAF ruleset update for 2026-10-25 adds two new detections for CVE-2026-111497. They default to log mode so you can audit impact. Check existing overrides to avoid false positives.
developers.cloudflare.com/ch…
o wow! que fascinante el tema del aligment/misaligment de las LLMs.... con solo retorcer unas cuantas neuronitas le puedes cambiar completamente es estilo de los resultados.
Helios Mier retweeted
Node2Shell PoC is now public.
CVE-2026-111497 — memory corruption in brotli 1.2.0 affecting Node.js 22/24/26, leading to RCE.
No execSync. No eval. No fake webhook.
The brotli decoder itself can reach system().
PoC:
github.com/syrex1013/CVE-202…
#Node2Shell #NodeJS #CVE #InfoSec
Helios Mier retweeted
StealMyBitcoin is solved! This is the absolute best explanation you’ll see on how hard #php2shell is to exploit. The author had to trigger a precise memory corruption condition, leak internal memory addresses, bypass aslr, reverse engineer php’s internal memory structures, forge structures to hijack execution, and account for php build differences, worker behavior and timing to get RCE. 20 http requests with a 7 out of 10 success rate. What an amazingly successful CTF. Impressive the creator was able to keep the server up during all the attempts. With all the BS around it’s nice to see something concrete that moves the art forward.
github.com/KillaBoi/StealMyB…
Love this. The💰is still in the wallet. Finally we get some ground truth around how hard php2shell is to exploit. The amount of bullshit flying around from vendors capitalizing on the moment is staggering, And the alert fatigue they’re creating is really going to hurt when a mass exploitable RCE emerges. We still haven’t seen a production site hacked via #php2shell at Wordfence.
Helios Mier retweeted
Backend lead'imiz zam istedi ve vermediler, adam işi bıraktı. Yerine kimseyi alamıyoruz, benzer tecrübedeki herkes lead abinin istediği zamdan çok daha fazlasını istiyor 🤡
Helios Mier retweeted
Someone bought a really badass domain name and made a sweet landing page for a vibevuln in your product. No one actually knows if the bug is exploitable or impactful yet but it has gone viral anyways, enjoy your weekend
Helios Mier retweeted
>AI hacks everything
>humans burn out
>"everyone NEEDS AI"
>oh but not local AI, too dangerous
>and no Chinese AI, too dangerous
>stonks 📈
>profit never
>slop code is sloppy
>On Error GoTo 0
Helios Mier retweeted
🚨 Brotli2Shell goes beyond HTTP2Shell.
CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Google’s Brotli decoder that has been exploited for RCE and impacts far beyond HTTP.
JFrog reproduced RIP control in FFmpeg via a crafted JPEG XL file and identified additional attack paths in ClickHouse, .NET, and Apache Arrow, where some fixes were still unavailable at the time of writing.
We’ve also released an open-source scanner to uncover potential exposure beyond vulnerable package versions.
Full research and technical details in our blog 👇
This dashboard of all ongoing CVEs should depress you...
iliya-bashrc.github.io/SubZe…
if you are not seeing the signs... the Brotli risk (evolved from node2shell) is going to get even more messier to patch than PHP
broccoli2shell.com/
DotNet is working toward bumping brotli (issue 136422). ClickHouse merged brotli 1.2.1 and is backporting it. Apache Arrow, woff2 are still in progress.
Follow vendor response and updates on broccoli2shell.com
Helios Mier retweeted
DotNet is working toward bumping brotli (issue 136422). ClickHouse merged brotli 1.2.1 and is backporting it. Apache Arrow, woff2 are still in progress.
Follow vendor response and updates on broccoli2shell.com