security researcher good guy hacker AI tinkerer OSCP certificate owner ADHD Brain owner https://xitter.cf/t.co/6AvGIhVjFJ
Joined July 2015
- Tweets65.3K
- Following831
- Followers3.6K
- Likes2.4K
Pinned Tweet
Other places to get RedPacket Security updates:
Telegram:
t.me/RedPacketSecurity
Discord:
discord.gg/xZY94PXXs4
Reddit:
reddit.com/r/RedPacketSecuri…
LinkedIn:
linkedin.com/company/redpack…
Mastodon:
mastodon.social/@RedPacketSe…
RedPacket Security retweeted
More private keys by the Indian certificate authority have been discovered. These are all small numbers.
People are suspecting that they interpreted 384 bit keys to mean that they should pick numbers from 1-384 to use as their private keys.
RedPacket Security retweeted
HOLY SHIT: This is huge. Amazon found a PHP2Shell exploit attempt on OCT 17, FOUR DAYS before the AI-discovered vulnerabilities were publicly disclosed.
It hit an AWS honeypot from an anonymized IP. Amazon says it doesn't know how the actor learned about the still-embargoed flaws.
Then Cloudflare watched the explosion:
>10 hours BEFORE disclosure: thousands of attempts
>45 minutes AFTER: tens of thousands
>2 hours AFTER: hundreds of thousands
>Later: MILLIONS
Researchers had spent two months coordinating fixes. Governments took websites offline.
And Censys found ~1.5 MILLION of 2.6 million identified PHP hosts running versions with NO PATCH available for those versions.
RedPacket Security retweeted
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
RedPacket Security retweeted
Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.
foxio.io/blog/header-accordi…
Aaaaaaaaaand this is exactly why monthly patching cycles are dead.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
RedPacket Security retweeted
php2shell の検証ついでに、パッチを追う中で session.upload_progress の filename 注入 + LFI を自分でPoC化してみた！
8.5.4 でも 8.5.12（パッチ版）でも www-data でコマンド実行までいけた
既知の手法で LFI 前提だけど、この経路はパッチ後も塞がってない
#php2shell #PHP #CVE2026109618
RedPacket Security retweeted
Great work by the @TalosSecurity team getting this out quickly! If anything in your business runs on PHP, this is critical info and requires every company to move quickly. The old habit of baking patches into the next general purpose release isn't going to survive the AI era.
Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset blog.talosintelligence.com/t…
RedPacket Security retweeted
BREAKING: US spy agency urged organizations to take websites offline if they cannot immediately fix two serious security flaws in PHP, a programming language behind a large share of the world's websites
insiderpaper.com/nsa-fix-php…
RedPacket Security retweeted
This might be the most watched GitHub Actions build in the history of the platform: github.com/docker-library/ph…
RedPacket Security retweeted
🚨 PHP2Shell may begin with malicious requests that blend into routine scanning, but the activity that follows should be more recognizable.
ReliaQuest assesses that threat actors will use code execution to expand access by spawning shells, running discovery commands, downloading tools, establishing persistence, and moving laterally. This can turn a PHP exploit into broader server compromise, data theft, and operational disruption.
Patching closes the vulnerability but will not remove existing access. Organizations should patch immediately, rotate exposed secrets, and use behavioral detections and retrospective hunting to identify post-exploitation activity.
Read the full assessment:
ow.ly/ySiy50ZZOmA
#ReliaQuest #ThreatResearch #AgenticAI
RedPacket Security retweeted
🚨 Fixes are out for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
Security researchers: If you find affected assets within program scope, submit validated findings with clear evidence and impact.
Details: bit.ly/4z1vVUX
So true
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
RedPacket Security retweeted
Los que se reían de PHP esta mañana, revisad vuestro Node.js.
Node.js ha parcheado hoy 4 vulnerabilidades de gravedad alta. El mismo día que PHP. Aquí no se libra nadie.
La más grave, CVE-2026-111497, está en el decodificador Brotli y, según Node.js, permite ejecutar código en remoto.
Pero la que más me preocupa es otra: dos fallos permitían saltarse la comprobación del nombre de host en TLS.
Tu aplicación puede dar por bueno un certificado que no es del servidor con el que habla.
El candado sigue ahí, pero ya no garantiza nada.
Si tienes algo en Node.js:
➡️ Ejecuta node -v. Si es anterior a la v22.23.4, la v24.22.1 o la v26.12.1, actualiza
➡️ Si despliegas con Docker, reconstruye la imagen. Actualizar tu equipo no cambia lo que está en producción
➡️ Si sigues en Node.js 18 o 20, no hay parche para ti: toca migrar
RedPacket Security retweeted
🚨 Nightmare day for cybersecurity
Multiple major security incidents, active exploits, supply chain compromises...
If you run production systems, start patching NOW.
PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW
LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets.
eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores.
Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs.
TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff.
Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors.
BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign.
And that's not even the full list.
Patch. Audit. Rotate. NOW.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All #PHP users are strongly encouraged to update immediately.
RedPacket Security retweeted
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
For more⬇️
ncsc.gov.uk/news/critical-se…
