HD Moore retweeted
Additional mitigation parts,
memory_limit = -1
max_post_size = 1/4 of configured memory_limit
session.upload_progress.enabled = 0
fatal_error_backtraces = 0
expose_php = 0
User SELinux/AppArmor where possible.
HD Moore retweeted
You’ve been Israelized ¯\_(ツ)_/¯
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
HD Moore retweeted
For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:
HD Moore retweeted
Also, once a vuln has been announced but not patched (eg. PHP RCE), everyone's got an electron-tunneling microscope to point at the codebase. The old ways of embargo and coordinated disclosure are more perilous.
HD Moore retweeted
In a world of AI slop blogs, presentations, images and write ups...
Calif is an excellent example of how to harness it correctly. Accuracy, Art, Asthetic all supporting excellent AI assisted research. 👏
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
HD Moore retweeted
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
HD Moore retweeted
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
Unvalidated AI output (author admits in replies: omp with glm5.3 + ds4), not a lab result. Its screenshot says both CVEs are fixed; the 'surviving paths' need unserialize() of attacker data or an app LFI. Patch per php.net: php.net/archive/2026.p…
HD Moore retweeted
the good thing about the eMudhra CA private key mess is that we can finally use https on localhost
HD Moore retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
HD Moore retweeted
You've gotta patch your dependencies super fast because they're full of vulns (PHP, Node, eMudhra, etc), but not _too_ fast because they're full of backdoors (LiteLLM). Good luck!
HD Moore retweeted
Releasing my lab as well PHP RCE github.com/dinosn/php-cve-20… , use it as a guidance and further reference for work upon. Patches are available at this moment PATCH!
If you're looking for the most detailed AND *entertaining* way to read about the php2shell bugs, the Calif post is epic: calif.io/php2shell/
HD Moore retweeted
... get it while its hot... 😈
> CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x)
> session.upload_progress UAF
> jackalsyn.com/posts/php-up-2…
> Courtesy of Me, @acd421 & @Archknight23
#CyberSecurity #infosec #php2shell #php
HD Moore retweeted
As it's already known, I will be releasing a lab on the CVE-2926-109618,9 PHP RCE upon embargo release. Until then, patch to the latest.
HD Moore retweeted
Block multipart/form-data requests on routes that do not require uploads as well. For a full remediation update to
* 8.5.12
* 8.4.27
* 8.3.36
* 8.2.35
HD Moore retweeted
The PHP foundation announced a security release tomorrow (Oct 21) addressing 2 critical PHP vulns that could lead to RCE.
Find your PHP instances using runZero: runzero.com/blog/php/
For latest developments, tune into runZero Hour tomorrow at 1pm ET (🔗 in 🧵)
HD Moore retweeted
The @php_net advisory is now set for 9 AM EDT tomorrow.
decipher.sc/2026/10/20/resea…
