Crazy amount of misinformation around PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Most “PoCs” flooding GitHub right now are AI slop. They don’t work. At the time of writing: zero public PoCs that actually work against a default, production-grade deployment (stock php.ini-production, display_errors=Off, normal memory_limit, multi-worker, ASLR on). The bug is real. PHP confirmed RCE on mod_php defaults. Private exploits exist. Public GitHub repos are mostly theater. Patch to 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 and restart workers. Stop amplifying fake exploits.
Credit goes to @ethiack, @0xacb, @s3np41k1r1t0, and the rest of the original research team. Check the repo for the full list of credits.
Read their technical write-up:
ethiack.com/info-hub/researc…
About the new Rails bug , CVE-2026-66066. Nasty, but it's not wp2shell level. It's an unauthenticated file read. Conditions: the app lets you upload a photo AND shows a thumbnail somewhere. An attacker uploads a fake "image," reads the server's files, steals secret_key_base, and turns that into RCE.
A complete wp2shell walkthrough : xitter.cf/0xsha/status/207848775…
New video on WP2Shell is now live!
This one covers everything you need to get started, including the theory, a hands-on lab, a Nuclei template and dorks to help you discover bug bounty targets.
youtu.be/vgi4l-9LIWI
Chinese labs, no top-tier chips: full frontier weights, take them.
Anthropic/Fable: I can't help with cyber, that could be misused.
OpenAI: hasn't opened anything since GPT-2/OSS.
Thank god for Qwen, GLM, Kimi, and DeepSeek. Can't even imagine the gatekeeping level without them.
Here's wp2shell 🐚 single-file, zero-dependency PoC for the WordPress core pre-auth RCE (CVE-2026-63030 + CVE-2026-60137)
one anonymous HTTP request:
REST batch route confusion → unauth SQLi → admin hash → shell
default install. no plugins. no login.
the best of other public PoCs, unified into one file.
scanner + full-chain code + deep dive + lab to play 👇
Thousands of engineering hours.
Thousands of alignment hours.
Countless hours building cyber guardrails and gatekeeping frontier capabilities.
Then frontier-class open weights dropped.
Now gatekeep and guardrail this.
Introducing Kimi K3: Open Frontier Intelligence
🔹 2.8 Trillion Parameters, 1 Million Context, Native Multimodal
🔹 Kimi Delta Attention enables up to 6.3x faster decoding in million-token contexts
🔹 Attention Residuals deliver ~25% higher training efficiency at <2% additional cost
🔹 Built for long-horizon agentic coding and self-evolving workflows
Kimi K3 is now live on on Kimi.com, Kimi Work, Kimi Code, and the Kimi API.
Open Weights by July 27, 2026.
🔗 API: platform.kimi.ai
🔗 Tech blog: kimi.com/blog/kimi-k3
Early results from GPT-5.6-sol:
It’s restricted, Feels closer to Fable-level restrictions, just not quite as bad.
Grok 4.5 is surprisingly locked down.
Way more restricted than the usual Grok models but somehow, not a complete disaster like Fable.
Try it yourself in Council.
🌲 AI Council v1.2.0 — Day-0 support for Grok 4.5
xAI's brand-new Grok 4.5 takes the council's xAI seat the day it launched.
council.darkgrove.io
0xSha retweeted
stop opening 10 tabs to hunt for a job.
🌲 new free tool from the lab: jobaggr. we crawl 10+ niche boards for AI and crypto roles and aggregate them into one feed.
~1k jobs live now, fresh every few hours. free, no signup.
👉 jobs.darkgrove.io
In case you need to use maxed out fable with other models for hard problems. One of the main points of a Mythos-class model was supposed to be writing more secure code, but then it blocks even the most basic defensive tasks. Make it make sense. 🤷
🌲 AI Council v1.1.0 — Fable 5 joins the council
Anthropic's Claude Fable 5 is now on the panel, and Sonnet is upgraded to Sonnet 5.
council.darkgrove.io
