@InsanityBit
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States Android App
Account-level information from X, not a live location or the device used for a specific post.
"And please don't get me started about the memory leaks or faulty pointers. We have Valgrind, Asan etc."
Can we please start licensing software development? This shit is insane lol
People like this shouldn't be legally allowed to write code.
This is cool but if you think that this is gonna get you anywhere close to rust perf on a real codebase I have bad news for you.
Colin O'Brien retweeted
Update: Our PHP exploit is now production-grade.
* stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load
* ARM64 + x86-64 targets
* MediaWiki, WordPress, phpBB, Laravel
* Apache/mod_php and nginx/php-fpm -> root
xitter.cf/dguido/status/21131291…
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
eliastaylor.com/noexploit/
It's sort of unfortunate that even on the latest models I have to get it to do specific adversarial reviews to pick up on vulns it wrote. I don't think most people are doing this.
Colin O'Brien retweeted
Its me, I have a working PoC with the infoleaks to bypass ASLR. It took a lot of prompting and re-iterating to find those, tested against PHP 8.5.11 x86_64 with with all defaults and tested over the Internet
Colin O'Brien retweeted
next time you're thinking about researching the linux kernel (@linuxfoundation), remember that someone on the receiving end of your report might talk about you like this:
in one of the threads, kernel maintainer "Peter Zijlstra" decides to call the ZDI team "monkeys"
there's a longer argument about how ZDI submits reports, whether they should include patches, and how fixes get tested. fair enough, have that discussion
but how does insulting the people reporting vulnerabilities help?
i thought the kernel's code of conduct was something everyone on these lists was expected to follow
sad to see people spoken to like this while trying to help improve linux security.
crime scene:
lkml.iu.edu/2610.2/16616.htm…
lkml.iu.edu/2610.2/16917.htm…
Every key in 3B has an expiration. We support OIDC and oauth. We have no passwords, no forever-keys, no user API keys.
It's time to retire long-lived static credentials.
We surveyed 1,000+ SaaS vendors and found only 8.4% support secure auth. This is our call to action and how we're doing our part.
vercel.com/blog/death-to-lon…
Colin O'Brien retweeted
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
eliastaylor.com/noexploit/
Incredible that php is trying to shift blame to chainguard.
Imagine releasing unsafe, dogshit software for decades and then when someone patches it a few hours early you go "yeah this is their fault".
I forked wasmtime to add additional optimizations but it's all vibecoded (explored mem64-specific opts).
I feel like this isn't something that would be interesting to send upstream, and I don't want to spend much time on prepping it. But also, significant mem64 wins.
I seriously doubt that ASLR is a meaningful mitigation here. 0 chance there aren't tons of infoleaks in a C codebase the size of php.
*Maybe* infoleaking/ controlling the heap is particularly annoying because of the nature of the vulns though.
Current information I have on php2Shell:
- The RCEs requires the attacker to obtain memory addresses which are typically protected by ASLR.
- I suspect the original author (lcfr_hax) likely has a reliable exploit which leads to stable code execution.
- Most of the PoCs being posted are completely non-functional AI slop.
- There is at least 1 working non-slop exploit being passed around, but it's reliant on bruteforcing for ASLR bypass, so not particularly impactful.
- Rumor of ITW exploitation are patchy. There are attempts being seen using the non-functional leaked RCE, or variants that are config / system specific.
- Some rumors point towards a known-working exploit being used by threat actors (I've personally confirmed this specific exploit works, but the ASLR bypass technique is unreliable at best and massively limits the potential impact).
- I'd expect heavy ITW exploitation in the next few weeks based on how many people are looking at this. Though, success rates will vary heavily based on the specific exploit chain.
I believe pretty strongly that vulnerabilities in software will be inexhaustible, regardless of whether you use proofs, AI, fuzzers, etc.
I'm adding `unsafe` to witchy, except it's going to:
1. Require proofs.
2. Break up `unsafe` into `unsafe` and `trust`.
3. Tests always run with address sanitization.
4. Can't be used in build scripts.
5. Safe constructs to reduce the need (ie: what zerocopy provides in rust).
Me 5 minutes ago: "I wonder how long it will take to build a POC"
I need to start checking ToB before I tweet, this happens too often.
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
eliastaylor.com/noexploit/