Pinned Tweet
Earlier this week I gave a talk to our internal hacking teams about the difference between good hackers and great ones that have been able to impact our field. I included three extended quotes - two from writers and one from Hamming that influenced my approach early on. Maybe some of it is useful for you.
Dominic White 👾 retweeted
Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).
Check out their awesome writeup here: github.com/KillaBoi/StealMyB…
Dominic White 👾 retweeted
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
Dominic White 👾 retweeted
🥦 Broccoli /CVE-2026-111497 update:
RCE reliability depends on:
• ASLR (official Linux x64 Node builds are non-PIE 🫠)
• decompressed output leaks
• Heap layout / grooming
• glibc arenas & libuv threads
• Repeated reqs reaching the same process
But let's talk about clients:
Dominic White 👾 retweeted
I've led vulnerability management for some very large companies. I've been in the trusted embargo 0day info sharing rooms.
I think it would be negligent at this point to assume that they will be the norm moving forward.
We can't expect to get a nice coordinated vuln announcement and patch handed to us in private with weeks to handle it.
We need layers of defense so 0days in internet facing devices won't be catastrophic. We need machine speed detections and response.
And of course we need to figure out the new norm of how we handle 0days in hours not days. This will take agents and harnesses you might not have yet.
A lot of this has been true for a while, but you could get away with handling in fire drill mode when happened and put off the actual engineering.
As people are saying, the interest rates on security tech debt just skyrocketed.
Yes - less manhattan project and more making the world a better place please.
Dominic White 👾 retweeted
With the AI companies hiring all these amazing VR folks and giving them capabilities that 10xs their talent, it’s really no surprise we’re starting to see a vulnpocalypse.
I’d personally like to see them hire more of the world’s best cancer or Alzheimer’s researchers.
Dominic White 👾 retweeted
What would it take to formally verify all the software a real system runs on?
We modeled one ecosystem: nixpkgs, with 28,650 packages and 154 GB of machine code.
theorem.dev/blog/verified-so…
In an hour @leonjza & @watchtowrcyber will be going through the state of exploitation and defense for the PHP bug on a webinar. Free but needs a reg tho orangecyberdefense.com/globa…
Dominic White 👾 retweeted
It's still attack surface reduction if you are separating functionality implementation by security boundaries. For example, a monolithic service is more space for a vulnerability that compromises its entire database. An ingress-style reverse proxy partitions that attack surface across multiple services. The more sensitive the functionality, the smaller the service should be and furthest down the service call tree.
Dominic White 👾 retweeted
This week has been quite a shitshow already, and there are still 2 days to go
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.php#202…
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-20…
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell-…
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell-php-rc…
Corelight’s open-source Zeek and Suricata detection rules:
github.com/corelight/php2she…
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/pat…
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulnerabi…
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unboun…
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
blog.google/security/protect…
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
bugzilla.mozilla.org/show_bu…
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
🤖 Made with AI
Added support for the compromised eMudhra intermediaries to gopostille. It'll let you create a validly signed certificate chain for a clone leaf cert in places that haven't revoked them. 1/2
2/2 I've hidden it in a feature branch, and likely won't put it in main. You an grab it here github.com/sensepost/goposti…
eMudhra has two interesting implications for me beyond the obvious browser trust issues.
I'm excited for the opportunities to liberate closed hardware this provides. We know hardware, particularly abandoned IoT devices are unlikely to be updating their revocation lists and root CAs. This means we can potentially intercept previously encrypted comms, or sign previously protected firmware.
I'm also interested in how well the revocation works at a WiFi supplicant level. Rogue RADIUS servers (mana, wpe, eaphammer) can now use validly* signed chains for forged leafs with TLS protected EAP modes. I'm not sure how well the revocations work in that world given the difference in the CA trust model in use there.
Dominic White 👾 retweeted
Something that gets lost in all these conversations is that there were years when a major 0day would drop and technical details were almost impossible to come by. Multiple people here would stay up for days reverse engineering the issue and stitching together a working PoC, not just to prove exploitation was possible, but to help defenders understand the actual risk, develop IoCs, build detections, and clean up compromised environments.