A Technology Journalist and cybersecurity professional. I have a mission to remove the marketing-speak from the information people receive in their news.
Joined July 2010
- Tweets40.1K
- Following620
- Followers2K
- Likes97.4K
Pinned Tweet
Shape the battlefield with what you have.
Cybersecurity is (almost) always a logistical conversation first, followed by tactical and strategic decisions based on that.
Most people would probably be shocked at how well a small team can shape the battlefield to devastating effect against an opponent.
Now I am even more sad I didn't win the lottery for this one :(
Is this new Elmer T. Lee 40th Anniversary bourbon from @BuffTrace and good or is it all hype? Let’s find out!
Bits, Bytes, and Bourbon retweeted
who remember HAFNIUM?
who remembers MSBLASTER?
who remembers WANNACRY?
who remembers LOG4SHELL?
who remembers {INSERT SOME OTHER NAME}
guys: this is the job! in 10 years time there will be more names to add to the list, and then in 10 years after that... even more.
This is the game!
Bits, Bytes, and Bourbon retweeted
Confusingly written... Article says you've seen PoCs and observed post-exploitation activity. The queries even have a note saying they aren't specific to CVE-2026-109618 and CVE-2026-109619... So this looks like evidence a web server running PHP was compromised, but not necessarily via exploitation of these CVEs?
Bits, Bytes, and Bourbon retweeted
Good news for once...A variety of factors make this annoying for attackers.
xitter.cf/JohnHultquist/status/2…
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
Bits, Bytes, and Bourbon retweeted
'We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.'
#PHP2SHELL #EndOftheWorld (the last hashtag is a joke ;) )
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
Bits, Bytes, and Bourbon retweeted
I keep hitting refresh here where is the PHP vuln?
cisa.gov/known-exploited-vul…
Bits, Bytes, and Bourbon retweeted
There's a massive problem that's been created by AI and I don't think it's the one the AI orgs and 'influencers' have been saying....
I'm tired.... but the sloppening is a thing....
it's insane.... it's not helpful.
I think it's causing issues.
Bits, Bytes, and Bourbon retweeted
Really important:
'Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.'
Backporting is a thing..... there's a lot of claims this week:
> PoCs that are nonsense
> Identification of things that is very questionable
So just a heads up! No one has an all knowing, all seeing view! (that doesn't mean you should fall to FUD)
Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment:
1. Discovery with Nmap
Common and alternative web ports; HTTP headers that may expose PHP versions:
nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target>
Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.
2. Huntress: Monitoring and detection
• Confirmed facts and remaining questions
• Suspicious PHP child processes, shells and downloaders
• Webshells and other post-exploitation activity
• My process-watcher for Linux process visibility
huntress.com/blog/php2shell-…
3. Vincent Schmalbach: Hardening and patching
• Temporary nginx/Apache filters and upload-progress settings
• WAF/origin bypass checks
• Package and backport verification
• PHP-FPM/worker restarts, container rebuilds
• Side effects and checks for compromise
vincentschmalbach.com/cve-20…
Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.
Bits, Bytes, and Bourbon retweeted
Is 70% of the world hacked? The only entity I've seen say they have confirmed successful exploitation in the wild said they found it at one victim, and then within hours revised the report to say zero.
Bits, Bytes, and Bourbon retweeted
That's real big of you, Jason. I have a question for you. How come your product only seems to know how to cause problems instead of actually fixing them without human involvement?
Wasn't that the other half of your company's promise? That it was going to fix all these things?
From my vantage point it's doing a lot of breaking things and causing chaos. I think this is by design. Your company has not proved me wrong yet.
When do we get to see the benefits?
When do you thank the world for all the intellectual property you stole which has enabled you to live a very comfortable life?
You've convinced a slew of business leaders that they no longer need humans because your product can supposedly replace them and yet myself and other experts in the cybersecurity industry use your product and your competitor's product and they need more hand holding than your average toddler.
On a good day.
I am not angry that you pulled a bait and switch.
The more companies who get destroyed by your product and their CEOs get fired by their boards for ever trusting you, without properly vetting you, the sooner we can get back to a sane world.
What a spectacularly arrogant tweet.
🙄
With the "4" I have to wonder if it was not symbolic (instead of just incompetence).
In binary a 4 is 00100, we used to joke that this, when displayed on the human hand, was giving someone the finger (which we dubbed giving you binary 4's)...
Perhaps that is what was going on here...
Or maybe they just screwed up. One is funny, one is sad.
Choose your own adventure ;-)
Bits, Bytes, and Bourbon retweeted
I love the “anyone can write an exploit with an LLM and hack everything now” narrative. Feel free to poke around GitHub for php2shell and see how many of those PoCs work outside the Docker container they were built on.
There are a few working ones in that sea of broken/lab only PoCs, but oddly enough, the people who wrote them actually knew what they were doing.