@AndrewMohawk

Sec/Madness @privy_io principal security , @_seal_org technical council prev: HoS @uniswap, D&R/IR @RobinhoodApp, IR @BitMEX, Built @Paterva Maltego with RT

 New York, USA
andrewmohawk.com
Joined February 2008
  • Tweets13K
  • Following3.1K
  • Followers5.5K
1.1KMedia
Fun react bug, (CVE-2025-55183) if you have a server side component and it explicitly or implicitly exposes a stringified argument you can get the source code for that function. Also found DoS, but reported it to vercel instead of meta and some else reported the next day 🙃
7
13
2
95
19,389
Has anyone actually seen a fully working PoC in the wild for the PHP vuln? Finding the UAFs is fast, but you still need things like info leak to get it to exec and I dont see anyone posts that include it, just tons of llms that are just reading proc/other ways to manage layout
5
1
26
4,240
Its gonna be a long day for defenders :'(
Railway
@Railway9h
An urgent notice from the Railway team blog.railway.com/p/security-…

Security Disclosure: Wednesday October 21st | Railway Blog

Railway detected anomalous activity involving systems that store customer environment variables and recommends your immediate attention

blog.railway.com
16
1,110
thephp.foundation/blog/2026/… Really disappointing that companies put marketing ahead of safety.
11
53
5
573
37,521
Fresh Node.js + React/Next.js security fixes: Node Brotli RCE (CVE-2026-111497): 22.23.4 / 24.22.1 / 26.12.1 Next.js: 2 critical RCEs + Server Actions DoS → 15.5.28 / 16.4.1 Check your deployed versions. nodejs.org/en/blog/vulnerabi… nextjs.org/blog/nextjs-secur…

Node.js — Wednesday, October 21, 2026 Security Releases

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org
5
701
Love that people arent even bothering to rewrite AI slop, just screenshot and go, who needs to validate findings anymore. Security needs to have PoCs that rm -rf / again to bring back some critical reviews.
3
2
31
9,110
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Nagli
@galnagli17h
php2shell.com

PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web

PHP2Shell is a family of critical vulnerabilities in core PHP that can allow unauthenticated attackers to execute code or disclose sensitive process memory.

php2shell.com
2
12
82
4,438
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
php-net@php_net17h
PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619). Changelog + downloads: php-net.pro/news/php-8-5-12-…

PHP 8.5.12 released with security fixes | The Dev Dispatch

The PHP project has released PHP 8.5.12: 90 fixes across 29 components of the 8.5 branch.

php-net.pro
39
2,488
211
5,275
684,122
- [RCE via OOM corruption · Advisory · php/php-src](github.com/php/php-src/secur…) - [RCE via stale global state · Advisory · php/php-src](github.com/php/php-src/secur…)

RCE via OOM corruption

## Summary PHP uses `longjmp()` for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it ...

github.com
3
6
1,278
If you run PHP please: session.upload_progress.enabled = Off php_admin_flag session.upload_progress.enabled Off
1
9
2
45
20,540
phpc.social/@Girgias/1174764…

Gina Peter Banyard (@[email protected])

@[email protected] The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.

phpc.social
2
964
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Gary Bernhardt@garybernhardtOct 20
I, for one, consider 4 a perfectly fine integer between 1 and 39402006196394479212279040100143613805079739270465446667946905279627659399113263569398956308152294913554433653942642
58
1,143
34
28,358
316,282
Wow, what a hire
Maddie Stone@maddiestoneOct 21
A lil personal news: Yesterday I started working at OpenAI on the cyber research team. I'm really excited to join this team of brilliant researchers and work on problems that feel really important and meaningful to me. Let the next chapter begin! 🥳🩷
13
1,282
^
sshell@sshell_Oct 21
it's very easy for people to create piles of plausible-looking slop and call it a PoC someone out there has figured out the PHP RCE (CVE-2026-109618 / CVE-2026-109619), but it might not be the person whose code you're retweeting sight unseen
4
1,362
GL to everyone
Kirill Firsov
@k_firsovOct 20
php2shell Tomorrow is a helluva day.
1
96
14,361
<?php echo "oh noes!"; id; whoami infosec.exchange/@watchTowr/…

watchTowr (@[email protected])

Attached: 1 image We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2026-109618/619 We...

infosec.exchange
10
3,548
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Alex Rad
@defendtheworldOct 20
a particularly epic @xkcdComic inside joke
1
16
445
emudhra.andrewmohawk.xyz/ if you need a quick test ^_^
1
7
3,604
Small amount of graph crime with those y-axis numbers, but otherwise interesting to remember that this is happening everywhere
Sam Freedman@SamfrOct 18
To give an indication of the problem here's a chart of 12 government agencies around the world and numbers of applications / appeals / complaints etc... The dotted grey line is when ChatGPT was invented.
2
347
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Nick Price@DominoTreeOct 19
Working with vibe coders be like
1
4
14
499
AndrewMohawk⁽ⁿᵘˡˡ⁾ retweeted
Liste@endlisteOct 18
Just found out about recency bias. Maybe the most important bias ever
342
13,630
351
212,983
3,204,914
Load more