ɯɹoʇsuoı retweeted
National security expert: "There's a decent chance the internet ceases to exist as such, at least for a time."
ɯɹoʇsuoı retweeted
Today we're launching cve.now 🚨
Yesterday was a rough day for security. php2shell, LiteLLM, Railway... How are we supposed to stay on top of all of this?
cve.now aggregates 4 vulnerability sources into one free feed and uses AI to explain each one in plain English. No login.
cve.now
ɯɹoʇsuoı retweeted
And the security shitshow continues... Four more things to add to yesterday's list. We're now at nine(!) major security issues and developments in just a few days.
6. ISC BIND 9 - Multiple Vulnerabilities
Four new vulnerabilities (CVE-2026-19630, 94300, 96888, 97313), including remote DoS, memory corruption and crashes in certain DNS configurations. Fixed in BIND 9.20.30 and 9.21.27.
kb.isc.org/docs/all-bind-adv…
7. Oracle Java / JSSE (CVSS 9.1)
CVE-2026-91403. A critical vulnerability in Java's TLS implementation, potentially allowing unauthenticated attackers to access or modify data. Affects Java 8, 11, 17, 21, 25 and 27, plus GraalVM.
oracle.com/security-alerts/a…
8. Windows SMB Server DoS (CVSS 7.5)
CVE-2026-96325. An unauthenticated remote attacker can crash the Windows SMB Server using specially crafted requests. Not RCE, but still a serious availability issue for exposed systems.
msrc.microsoft.com/update-gu…
9. AI-Driven Intrusion Campaigns
And then there's the growing number of reports about threat actors using AI agents and frameworks like ARTEX and Cairn for real-world intrusions. Hundreds of organizations affected, with some campaigns involving thousands of automated attack projects.
Microsoft / ARTEX:
microsoft.com/en-us/security…
NorForge / Cairn:
norforge.com/blog/inside_cai…
I'm starting to wonder what next week will look like...
(you can find 1.-5. in the quoted tweet)
🤖 Made with AI
This week has been quite a shitshow already, and there are still 2 days to go
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.php#202…
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-20…
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell-…
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell-php-rc…
Corelight’s open-source Zeek and Suricata detection rules:
github.com/corelight/php2she…
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/pat…
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulnerabi…
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unboun…
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
blog.google/security/protect…
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
bugzilla.mozilla.org/show_bu…
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
ɯɹoʇsuoı retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
ɯɹoʇsuoı retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
ɯɹoʇsuoı retweeted
PHP 8.5.12 may not have completely fixed the latest PHP security issue.
Security researcher Elise Boyd says a double-free crash still works on the patched version.
So far, it has only been demonstrated as a local command-line crash. There is no evidence that it can be exploited remotely, and PHP has not confirmed the finding.
ɯɹoʇsuoı retweeted
In a sea of POC slop, there is one POC out there that works, but it needs certain preconditions.
A) PoC limitations
- The PoC has some hardcoded values. Easy to fix, but might need adjustments depending on the target.
B) Target configuration
-> Memory limits: The bug relies on PHP running out of memory while processing a request. Common settings are 128 MB memory and 8 MB POST limits. These can make exploitation harder, but don't guarantee protection.
-> Same worker: Both requests must reach the same PHP worker. The first leaves something in memory, and the second picks it up. Different worker, no leftover memory to use.
-> Linux (PHP-FPM): Workers are separate processes with their own memory. Hitting the same worker is possible, but not guaranteed.
-> Windows (Apache): Multiple threads handle requests within one process. Reaching the same thread can be harder to control.
-> Windows (IIS/FastCGI): Separate worker processes, similar to Linux.
I'm sure someone will figure it out soon. I'm just trying to explain what I see from my testing.
I haven't seen any php2shell exploitation attempts so far, which proves that the hundreds of POCs out there are all fake junk.
That could actually work in our favor. The more junk there is, the longer it will take script kiddies to weaponize this.
If you haven't patched/mitigated yet, there's still time!
ɯɹoʇsuoı retweeted
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
Unvalidated AI output (author admits in replies: omp with glm5.3 + ds4), not a lab result. Its screenshot says both CVEs are fixed; the 'surviving paths' need unserialize() of attacker data or an app LFI. Patch per php.net: php.net/archive/2026.p…
ɯɹoʇsuoı retweeted
This is one of the funnest internet days of the year! You might not agree with me, but like these are the event we have the boring days for!
everyone pulls together, shares research, intel, puts in place WAF block rules etc. etc.
this is community going BRRRR time! #PHP2Shell
ɯɹoʇsuoı retweeted
This is gonna be a bloodbath if Andrew is warning people to go ahead and take any PHP offline until patch drops.
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:
php.net/index.php#2026-10-20…
ɯɹoʇsuoı retweeted
La vidéo de l’orchestre du nouveau monde jouant sous les gaz lacrymogènes restera probablement l’un des plus grands symboles de la révolution du #17octobre
ɯɹoʇsuoı retweeted
JUST IN: AI data centers could soon require blast-resistant concrete, anti-drone defenses, & missile protection as attacks on computing infrastructure escalate worldwide. — Financial Times
ɯɹoʇsuoı retweeted
This is a joke. One of the most talented ethical hackers and cybersecurity experts ON THE PLANET gets denied. I can't with this.
ɯɹoʇsuoı retweeted
Everyone wants to have solved a hard problem, but almost nobody wants to live inside the grind of actually solving it. The breakthroughs belong to the few who are obsessed with the process, not just the idea of the outcome
ɯɹoʇsuoı retweeted
tokenmaxxing: dead and buried.
New: Accenture has told employees it will only fund $29 per month of Claude use. Meaning that employees who often spend as much as $1,000 a month are now scrambling to find ways to keep access to the tool. A sign of the continuing crack down of AI 404media.co/accenture-tells-…
ɯɹoʇsuoı retweeted
Right now, using AI agents still feels very single-player. They do your work, but the results are trapped in isolated chat histories and nothing compounds.
The Busabase team (@Busabase4agent) is launching an open-source (MIT) database and workspace for agents to fix this. Instead of losing work to ephemeral chats, your agents write directly to a structured workspace to turn their outputs into reusable data, docs, and skills your entire team can access.
Details here: busabase.com/
ɯɹoʇsuoı retweeted
Surprise: the verified Navier-Stokes proof doesn’t match the one in the paper.
arxiv.org/abs/2610.08144
ɯɹoʇsuoı retweeted
👀👀👀👀👀👀 again?!!!
A global credential-compromise campaign known as FortiBleed is actively targeting internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways. Today, the @FBI and @SecretService issued a Joint Cybersecurity Advisory to warn organizations about this activity.
Threat actors are exploiting reused or leaked credentials and legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication at scale. More than 86,644 devices have been compromised across 194 countries, with some organizations locked out of systems.
We encourage organizations to review the advisory for TTPs and IOCs associated with this activity and implement our recommended mitigations.
👉ic3.gov/CSA/2026/261006.pdf
ALT Joint cybersecurity advisory warns of ongoing FortiBleed attacks causing system lockouts as of October 6, 2026.