Web Application Security Consultant. Two sons' proud dad! https://xitter.cf/t.co/uEjJ0UQkhV
Online
Joined May 2009
- Tweets17.1K
- Following1.3K
- Followers16.1K
- Likes12.7K
Marius Avram retweeted
Node2Shell PoC is now public.
CVE-2026-111497 — memory corruption in brotli 1.2.0 affecting Node.js 22/24/26, leading to RCE.
No execSync. No eval. No fake webhook.
The brotli decoder itself can reach system().
PoC:
github.com/syrex1013/CVE-202…
#Node2Shell #NodeJS #CVE #InfoSec
Marius Avram retweeted
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
Marius Avram retweeted
In the 4 days since php2shell was published:
* 1,448 more CVEs published.
* No published exploit code for any in Metasploit or Exploit-DB.
* VulnCheck added 25 on its KEV list. 24 are old bugs.
* CISA added just 1 to its KEV list, the only new bug anyone has seen adversaries exploit.
Nothing in the record shows AI or anything else driving up how many vuln adversaries exploit, or how fast. Adversaries keep working a small set of bugs until those stop paying, and only then move on.
Patch php2shell because there are too many eyes are on it not to. Then apply the same rule to everything else, prioritize patching all systems against what adversaries exploit. It sounds simple, and the evidence says it’s what we still haven’t done that actually works.
Marius Avram retweeted
Node2Shell (CVE-2026-111497): Imperva demonstrated RCE on stock Node.js 24.22.0 (Linux arm64) via attacker-controlled Brotli decoded by fetch() or request parsers.
Invalid block transition → OOB write. Patched in 24.22.1. PoC required multiple attempts.
imperva.com/blog/node2shell-…
Marius Avram retweeted
Liked PHP2Shell? You’re gonna love Node2Shell.
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shell-…
Marius Avram retweeted
🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST.
Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using:
🟧 ActiveScan++ v2.0.13 (portswigger.net/bappstore/31…)
🟧 Bambda scan checks (github.com/PortSwigger/bambd…)
🟧 BChecks (github.com/PortSwigger/bchec…)
Start scanning for the vulnerability now → portswigger.net/bappstore/31…
Marius Avram retweeted
PHP Patch is out!!
PHP 8.5.12: 31c0ea7d7f github.com/php/php-src/commi…
PHP 8.4.27: 506e87fa7d github.com/php/php-src/commi…
PHP 8.3.36: 3c832b523e github.com/php/php-src/commi…
PHP 8.2.35: 01a40e89fb github.com/php/php-src/commi…
The two advisories with the full details:
GHSA-w8hw-w9fx-j79w (CVE-2026-109618) github.com/php/php-src/secur…
GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) github.com/php/php-src/secur…
Marius Avram retweeted
Wild story from @briankrebs: 1) Dubrovsky, the arrested ransomware negotiator, knew ShinyHunters stole FBI data but never told FBI; 2) an exec from another large US negotiating firm played an active role operating ShinyHunters' victim extortion website
krebsonsecurity.com/2026/10/…
Marius Avram retweeted
‼️ BREAKING: Unauthenticated attackers are hijacking Plex Media Servers.
Exploit code was published on GitHub on 16 October, immediately after exploitation in the wild began.
A researcher reports a honeypot running Plex was turned into a crypto miner and a proxy.
Marius Avram retweeted
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
Marius Avram retweeted
Here's how exactly Telegram provides user data to U.S. authorities. A letter recently filed in court shows how Telegram transfers that data, such as IP address and phone number.
More: 404media.co/heres-what-teleg…
Marius Avram retweeted
🚨 BREAKING: Suspected Chinese spies hacked BeyondTrust Remote Support servers with a zero-day, CVE-2026-102764.
One was hosted by BeyondTrust itself, and they were alerted instantly, but their automated 3rd party triage tool closed the alerts as false positives.
Marius Avram retweeted
Apple calls the iPad a computer.
So I built Linux for it.
I built LinPad OS - Linux for iPad.
- Desktop windows + a real terminal
- No jailbreak. No VM.
Free & open source (pre-release).
What is your iPad missing?
linpados.com
#Linux #iPad #OpenSource
Marius Avram retweeted
NEW @citizenlab report We uncovered an Israeli firm using online ads to run vast spy operation
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.
45 devices at @AJEnglish confirmed infected
citizenlab.ca/research/how-d…
