A Technology Journalist and cybersecurity professional. I have a mission to remove the marketing-speak from the information people receive in their news.
Joined July 2010
- Tweets40.1K
- Following620
- Followers2K
- Likes97.4K
Bits, Bytes, and Bourbon retweeted
who remember HAFNIUM?
who remembers MSBLASTER?
who remembers WANNACRY?
who remembers LOG4SHELL?
who remembers {INSERT SOME OTHER NAME}
guys: this is the job! in 10 years time there will be more names to add to the list, and then in 10 years after that... even more.
This is the game!
Bits, Bytes, and Bourbon retweeted
Confusingly written... Article says you've seen PoCs and observed post-exploitation activity. The queries even have a note saying they aren't specific to CVE-2026-109618 and CVE-2026-109619... So this looks like evidence a web server running PHP was compromised, but not necessarily via exploitation of these CVEs?
Bits, Bytes, and Bourbon retweeted
Good news for once...A variety of factors make this annoying for attackers.
xitter.cf/JohnHultquist/status/2…
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
Bits, Bytes, and Bourbon retweeted
'We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.'
#PHP2SHELL #EndOftheWorld (the last hashtag is a joke ;) )
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
Bits, Bytes, and Bourbon retweeted
I keep hitting refresh here where is the PHP vuln?
cisa.gov/known-exploited-vul…
Bits, Bytes, and Bourbon retweeted
There's a massive problem that's been created by AI and I don't think it's the one the AI orgs and 'influencers' have been saying....
I'm tired.... but the sloppening is a thing....
it's insane.... it's not helpful.
I think it's causing issues.
Bits, Bytes, and Bourbon retweeted
Really important:
'Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.'
Backporting is a thing..... there's a lot of claims this week:
> PoCs that are nonsense
> Identification of things that is very questionable
So just a heads up! No one has an all knowing, all seeing view! (that doesn't mean you should fall to FUD)
Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment:
1. Discovery with Nmap
Common and alternative web ports; HTTP headers that may expose PHP versions:
nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target>
Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.
2. Huntress: Monitoring and detection
• Confirmed facts and remaining questions
• Suspicious PHP child processes, shells and downloaders
• Webshells and other post-exploitation activity
• My process-watcher for Linux process visibility
huntress.com/blog/php2shell-…
3. Vincent Schmalbach: Hardening and patching
• Temporary nginx/Apache filters and upload-progress settings
• WAF/origin bypass checks
• Package and backport verification
• PHP-FPM/worker restarts, container rebuilds
• Side effects and checks for compromise
vincentschmalbach.com/cve-20…
Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.
Bits, Bytes, and Bourbon retweeted
Is 70% of the world hacked? The only entity I've seen say they have confirmed successful exploitation in the wild said they found it at one victim, and then within hours revised the report to say zero.
Bits, Bytes, and Bourbon retweeted
That's real big of you, Jason. I have a question for you. How come your product only seems to know how to cause problems instead of actually fixing them without human involvement?
Wasn't that the other half of your company's promise? That it was going to fix all these things?
From my vantage point it's doing a lot of breaking things and causing chaos. I think this is by design. Your company has not proved me wrong yet.
When do we get to see the benefits?
When do you thank the world for all the intellectual property you stole which has enabled you to live a very comfortable life?
You've convinced a slew of business leaders that they no longer need humans because your product can supposedly replace them and yet myself and other experts in the cybersecurity industry use your product and your competitor's product and they need more hand holding than your average toddler.
On a good day.
I am not angry that you pulled a bait and switch.
The more companies who get destroyed by your product and their CEOs get fired by their boards for ever trusting you, without properly vetting you, the sooner we can get back to a sane world.
What a spectacularly arrogant tweet.
🙄
Bits, Bytes, and Bourbon retweeted
I love the “anyone can write an exploit with an LLM and hack everything now” narrative. Feel free to poke around GitHub for php2shell and see how many of those PoCs work outside the Docker container they were built on.
There are a few working ones in that sea of broken/lab only PoCs, but oddly enough, the people who wrote them actually knew what they were doing.
Bits, Bytes, and Bourbon retweeted
I know Amazon (in a blog written by an Amazon CISO, not a line professional) said "widespread exploitation" was occurring. But I believe GreyNoise and others on whether widespread successful exploitation (isn't) occurring at this point.
Bits, Bytes, and Bourbon retweeted
TO ALL THE BRAINDEAD CEOS THINKING OF FIRING THEIR TECHNICAL STAFF TWO WEEKS BEFORE CHRISTMAS: THE AI IS MIRRORING TECHNIQUES WE TAUGHT IT BY WAY OF INGESTING OUR NOTES.
IF YOU HAVEN'T NOTICED BY NOW ALL THAT MONEY YOU SPENT?
IT'S NOT FIXING ANY OF THESE PROBLEMS BUT CREATING THEM.
SO MAYBE DON'T DO THAT.
Sorry for yelling. My thoughts are actual colors right now I'm so tired.
Bits, Bytes, and Bourbon retweeted
Oh, boy, it doesn’t end …
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Bits, Bytes, and Bourbon retweeted
This week has been quite a shitshow already, and there are still 2 days to go
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.php#202…
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-20…
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell-…
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell-php-rc…
Corelight’s open-source Zeek and Suricata detection rules:
github.com/corelight/php2she…
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/pat…
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulnerabi…
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unboun…
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
blog.google/security/protect…
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
bugzilla.mozilla.org/show_bu…
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
🤖 Made with AI
