sam4k retweeted
Our researcher @pamoutaf just popped a shell on a stock WordPress image using php2shell!
But how does this *help* (besides being super cool)? Well, our research is distilled directly into Precog.
As a result, it's able to autonomously exploit complex vulnerabilities like this, using cheaper models (like GPT-5.6 Terra in this case)!
This allows us to help defenders find and fix real exploitable risk in their environment at scale.
You've probably seen plenty about PHP2Shell by now: two critical PHP vulnerabilities, potential unauthenticated RCE, and a lot of PoCs flying about.
But what does responding to this actually look like for defenders?
With AI accelerating the path from disclosure to exploit, there's less time to work through thousands of vulnerability findings and figure out what's relevant to your environment.
In our latest post, we walk through how Precog helps triage PHP2Shell in your own environment, from identifying affected workloads and validating vulnerable behaviour against your actual application in a sandbox, through to prioritising fixes and guiding remediation.
bynar.io/blog/php2shell-findโฆ
sam4k retweeted
You've probably seen plenty about PHP2Shell by now: two critical PHP vulnerabilities, potential unauthenticated RCE, and a lot of PoCs flying about.
But what does responding to this actually look like for defenders?
With AI accelerating the path from disclosure to exploit, there's less time to work through thousands of vulnerability findings and figure out what's relevant to your environment.
In our latest post, we walk through how Precog helps triage PHP2Shell in your own environment, from identifying affected workloads and validating vulnerable behaviour against your actual application in a sandbox, through to prioritising fixes and guiding remediation.
bynar.io/blog/php2shell-findโฆ
sam4k retweeted
Here's what happened last month at Bynario:
- @daisyydaisy_ joined us ๐
- Company retreat in beautiful Franciacorta, Italy ๐ฎ๐น
- 12 new vulns disclosed (CVE-2026-80795, CVE-2026-80794, CVE-2026-91945, ...) ๐ฎโ๐จ
Find more information about our disclosures here bynar.io/disclosures
sam4k retweeted
Managed to get @opa334dev to talk about the TSS bug on chITchat ๐ You can listen on most platforms but here is the link to Spotify. Will upload to youtube as well. open.spotify.com/episode/5fIโฆ
sam4k retweeted
New linux-insides chapter is out!
Continue to investigate different data structures and how they are implemented in the Linux kernel.
This time: Bitmaps in the Linux kernel 0xax.dev/books/linux-inside/โฆ
sam4k retweeted
Testing race conditions with memory access tracing and stack-based delay injection
Article by @tehjh about MAccConc โ a KCOV-based tool for exploring possible kernel code interleavings of a multi-threaded program.
Article: projectzero.google/2026/09/mโฆ
Tool: github.com/googleprojectzeroโฆ
sam4k retweeted
@riprcx took us deep: ๐
๐ซ๐จ๐ฆ ๐๐ฅ๐จ๐ฌ๐๐๐๐ง๐๐ฅ๐ ๐ญ๐จ ๐๐จ๐๐ ๐๐ฑ๐๐๐ฎ๐ญ๐ข๐จ๐ง: ๐๐ฑ๐ฉ๐ฅ๐จ๐ข๐ญ๐ข๐ง๐ ๐๐ง ๐๐ซ๐๐ข๐ญ๐ซ๐๐ซ๐ฒ ๐๐๐ง๐๐ฅ๐ ๐๐ฅ๐จ๐ฌ๐ ๐๐ฎ๐ฅ๐ง๐๐ซ๐๐๐ข๐ฅ๐ข๐ญ๐ฒ ๐๐จ๐ซ ๐๐๐.
An exploit that had the room hooked as we continue our a.m. dives #๐๐๐๐๐๐๐
In case you missed it, last week @bynar_io shared my write-up on several FreeRDP bugs I found & chained to get pre-auth RCE via GNOME Remote Desktop (1/X)
bynar.io/blog/linux-has-screโฆ
Not to mention the CTF-esque primitive the write gets us: calling system() with an 8-byte arg limit. It also surfaced some interesting hurdles for frontier models + exploitation while working on a non-trivial, multi-bug chain like this (3/X)
sam4k retweeted
If you were curious about the FreeRDP pre-auth RCE, @sam4k1 did an incredibile job in documenting the entire chain here
Check out @sam4k1's latest write-up: a technical deep dive on how three vulnerabilities we reported in FreeRDP can be used to achieve pre-auth RCE by popping a remote shell with some old school memory corruption shenanigans ๐ง
bynar.io/blog/linux-has-screโฆ
this was a lot of fun (and it has gifs!!)
Check out @sam4k1's latest write-up: a technical deep dive on how three vulnerabilities we reported in FreeRDP can be used to achieve pre-auth RCE by popping a remote shell with some old school memory corruption shenanigans ๐ง
bynar.io/blog/linux-has-screโฆ
sam4k retweeted
Check out @sam4k1's latest write-up: a technical deep dive on how three vulnerabilities we reported in FreeRDP can be used to achieve pre-auth RCE by popping a remote shell with some old school memory corruption shenanigans ๐ง
bynar.io/blog/linux-has-screโฆ
sam4k retweeted
I am working now on the next part of linux-insides!
This time I decided to change the approach a bit. Instead of proceeding with the kernel initialization details, I decided to make a little stop and describe some fundamental things that will be useful on the way to exploring the kernel internals.
The first such stop is the implementation of linked lists in the Linux kernel.
New chapter soon, hopefully next week!
sam4k retweeted
@sam4k1 extending pre-auth RCE support to Linux via GNOME Remote Desktop ๐ฅ
FreeRDP 3.31.0 fixes a number of security issues, including five server-side ones reported by us.
If you use Gnome Remote Desktop, KDE krdp or other software that uses FreeRDP then make sure you update your packages.
Not wanting macOS to have all the limelight, @sam4k1 was able to chain several of these vulnerabilities to achieve pre-auth RCE against a Gnome Remote Desktop server.
Note: only GRD 51 pre-release versions should be affected by the chain we demonstrated (currently used by Fedora 45 & rawhide, CentOS Stream 11 and Arch's gnome-unstable repo); see our oss-security advisory in the comments for more details on impact + exposure.
A technical write-up will follow after folks have had time to get patched!
sam4k retweeted
FreeRDP 3.31.0 fixes a number of security issues, including five server-side ones reported by us.
If you use Gnome Remote Desktop, KDE krdp or other software that uses FreeRDP then make sure you update your packages.
Not wanting macOS to have all the limelight, @sam4k1 was able to chain several of these vulnerabilities to achieve pre-auth RCE against a Gnome Remote Desktop server.
Note: only GRD 51 pre-release versions should be affected by the chain we demonstrated (currently used by Fedora 45 & rawhide, CentOS Stream 11 and Arch's gnome-unstable repo); see our oss-security advisory in the comments for more details on impact + exposure.
A technical write-up will follow after folks have had time to get patched!
sam4k retweeted
My educational sabbatical came to an end, and I wrote a blog reminiscing of the last year and all the cool things I got to do ๐p0pcycle.com/2026/08/20/pentโฆ
