Bold | Enginerd | Cyberstuff | Data science(AI) | Jedi Knight | Sportoholic | Grinch | Übermensch | Science, yeah! | Derechos Reservados©Pablo Corona Fraga 2009
México
Joined June 2009
- Tweets41K
- Following950
- Followers5.4K
- Likes6.6K
Pinned Tweet
Now available :
Practical Guidance for Risk Management in the age of cybersecurity
amazon.com/dp/B09S64JZ13
First time I went to a @Metallica concert was in 1992. 36 years after, we are here.
Long way to the top!!!
Getting ready for watching @Metallica for the 30th time at the Sphere Las Vegas!!
Pablo Corona Fraga retweeted
Wel, no the 30th time at las vegas, I meant:
For the 30th time, at las vegas sphere
Pablo Corona Fraga retweeted
Getting ready for watching @Metallica for the 30th time at the Sphere Las Vegas!!
Los atacantes escanean toda tu infraestructura y código visible con IA, en busca de vulnerabilidades.
Si tú no estás haciendo algo similar, escaneando tu código e infraestructura con IA y buscando con ella posibles soluciones, no estás en desventaja, estás perdido y ni lo sabes.
Y conste que nadie dijo que la IA remedie y parche todo sola. Necesita pruebas, validación, supervisión y mucho trabajo antes de hacer cambios en entornos productivos.
Pero tratar de defender a velocidad humana los ataques a velocidad máquina es un gran problema.
Pablo Corona Fraga retweeted
Finding bugs is the easy part. Shipping fixes that hold up is harder.
We analyzed thousands of Codex sessions from our work on Patch the Planet with @OpenAI and built patching-bugs, a plugin that writes a fix, proves it, and checks it for regressions.
To prove a fix, the plugin checks that the original code fails, the patch passes, and reverting the patch brings the bug back.
patching-bugs hands each fix to regression-hunt, our second new plugin. We ran it on the patches behind 21 known regressions, and it reported 25% fewer false positives than a baseline Codex agent.
Both plugins work best when your repo has a THREAT_MODEL.md and a PATCHING_GUIDELINES.md. blog.trailofbits.com/2026/10…
Pablo Corona Fraga retweeted
LLMs...Letting me do fun things I never would have wasted time on.
"I reviewed all 30 public GitHub repos for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) by reading code only. The slide has the full
grouped table; the headline findings:
Nothing works against a real target. Every genuine memory-corruption chain is lab-bound: it needs exact per-build offsets, display_errors=On, a single prefork mod_php worker, and a specific image.
Independent reviewers (allureluoli, dinosn, Gi1gamesh123) and the leaked primary source itself all converge on "no public artifact achieves code execution" on the patched core bug. Every real shell
in these repos comes from an app-side LFI or deserialization sink, not the CVE.
Three are original and real, all lab-only. 9bie (the source of the Set-Cookie leak chain), Marven11 (the most sophisticated, a true in-band leak), and Karasawa2025 (whose "Fermat" troll description
hides a working ROP + display_errors=off exploit). These are the only ones with a genuine ASLR-defeating leak primitive that is their own.
Most are copies. One original (9bie) spawned five derivatives:
- twili8 is an outright uncredited rip-off: its own README still says git clone 9bie/... and the Docker files are byte-identical.
- godylockz and xuehuolll are byte-identical to each other.
- dinosn and 3em0 are credited ports that add value.
Three are mislabeled. iQingshan, KarimUD7 (≈98% the same code), and Gi1gamesh123 exploit a different bug entirely (the Calif unserialize var_hash UAF) against their own planted endpoints, filed
under the php2shell CVE numbers.
The rest is noise. The most-starred repo (ikow, 905★) delivers the least: broken or stubbed chains with the two "real" ones paywalled behind Substack. eness (558★) is a leakless forge that can't
defeat ASLR. syrex1013 ships AI-generated fake CVEs in a side directory. Whackermelon hallucinates a non-existent openai/php2shell-checker. lcfr-eth is a parody with a memecoin address, and Icex0
is an empty repo. The genuinely honest work is the crash labs (allureluoli, slabbdev, 0x4148), which prove the bug without claiming RCE.
The ASLR column, star counts, copy lineage, and the specific "tell" for each repo are all in the table. The page is private to your account; use the Share menu if you want to send it to the team"
Pablo Corona Fraga retweeted
"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."
thephp.foundation/blog/2026/…
Pablo Corona Fraga retweeted
URGENTE: Si manejan algún sitio en PHP, actualícenlo a la última versión de su rama. Se viene el apocalipsis de PHP: php.net/archive/2026.php#202… #PHP
Pablo Corona Fraga retweeted
🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet.
Pablo Corona Fraga retweeted
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:
php.net/index.php#2026-10-20…
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow
The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.
PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
