
Steven Harris | OSINT & Cyber Security Specialist | Investigator | Teach OSINT @SANSInstitute | @OSINTCurious | https://xitter.cf/t.co/EGO8CWyA6H
UK
Joined February 2019
- Tweets7.3K
- Following1.5K
- Followers24.1K
- Likes15K
Nixintel retweeted
What I found Pre Announcement yesterday I see alot of people finding. This has been a known PHP thing, that i can remember from at least 10 years ago becuase it was in a class I wrote.
1. PHP allows you to upload a file even if there is no file upload area.
2. It then realizes that you do not have a file upload area and cleans things up
3. The bug announced recently allowed for one interesting thing: session fixation through setting the PHPSESSIONID (at least this is what I'm verifying now).
4. Given you know the name of the session ID, you can then predict the session ID file name in /tmp because many implementations will do this by default.
5. Recalling the session_id through an LFI (stock configuration) will cause the file to be read.
6. Reading the file, given that it's a serialized object, will deserialize it, giving you potential RCE.
I tried this on stock WordPress in a container, and it appeared to work. I'm unsure how widespread this is, or whether it is really a problem.
Nixintel retweeted
Missed the PHP briefing? Replay is up. CVE-2026-109618 / CVE-2026-109619, the Oct 21 fix, and what to do if you are on a version that will not get one. go.sans.org/MpvmG6
#PHP

ALT The image is a promotional banner for a livestream titled "PHP Vulnerabilities: What You Need to Know Today and Do Right Now," featuring Rich Greene and Moses Frost as instructors from SANS Institute and Neuvik, respectively. There is a button labeled "Watch the Replay" and the SANS logo is displayed in the bottom right corner.
Nixintel retweeted
📣 Deadline Extended! The SANS #OSINTSummit 2027 Call for Presentations is open for another week!
Have an OSINT case study, research project, tool, technique, or lesson learned to share? We want to hear from you!
⏰ New Deadline: Oct. 26, 5 p.m. EDT
📩 go.sans.org/dPm8qI
Nixintel retweeted
Zu dem analytischen Elend kommt noch das hier. Die RUS Dienste kommen doch aus dem Lachen gar nicht mehr heraus, angesichts tausender Zuschreibungen, die ihnen jeden Tag übermenschliche Einflussmöglichkeiten überall auf dem Kontinent attestieren: xitter.cf/AlexanderDinger/status…
Nixintel retweeted
Ursula von der Leyen has confirmed that everyone in the EU will need to use the EU's app for identity authentication before being able to access or post on social media websites.
🇪🇺 As an expert in online child safety, I am here to expose the misinformation and misdirection in von der Leyen's statements.
Today von der Leyen said:
"This is not about whether children can access social media, it is about whether social media can access our children".
💡The first part is true. This isn't about children. It's about surveillance and combating political dissent. A state that can't control its own citizens is more dangerous than a state rife with criminals. The second part is a PR soundbite that politicians are using like a campaign slogan straight out of 1984.
🇪🇺"The question is no longer if children face risks online, but what can we do to give children a safer start online".
💡No. You can't give children a "safer start" online any more than you can offline. In the offline world, the government doesn't enforce curfews or ban children from entering liquor stores, bars or restaurants. That's a parent's responsibility. The digital world should be no different.
🇪🇺"The age verification app is one of the tools to get it done".
💡This is a contradiction because she also said "It won't be foolproof".
🇪🇺"It's easy to use, it is privacy preserving and it is open source".
💡The app was compromised as soon as it was released. "Privacy-preserving" age verification is an oxymoron. You can't verify a person's age without verifying their identity. Where or how that age is shared afterwards is irrelevant.
🇪🇺"This is basically about putting back the power into the hands of parents".
💡More from 1984. The EU is doing the opposite. Parents are having their authority stripped by politicians who think they know better. Many parents are capable and unaffected by peer pressure, and they know how to use parental controls to block any app classified as 13+. Some teens are safe, their parents trust them, and the state has no business overruling that trust.
🇪🇺"We don't give our children keys to the car before they have their licence"
💡Comparing an app to a car is a false equivalence used to justify mass surveillance. Governments don't decide when a young person is ready for car keys, guardians do.
💡Forcing every adult and child into a biometric checkpoint just to use an app or website is not licensing drivers. It's the state seizing everyone's keys, locking the garage, and forcing every driver to ask a private company for permission to take a drive.
💡 This is a gross, unethical overreach that strips authority from parents while imposing state sanctioned identity verification on every adult who doesn't even have a child.
💡Additionally, people who pass a test, obtain a licence and drive a car aren't forced to use an app to constantly authenticate their suitability to drive.
🇪🇺"We do not let them buy alcohol until they are legally allowed"
💡False equivalence. We don't force every person to show ID at a shopping mall entrance just because a few people might buy alcohol with a meal at a restaurant. Some parents are okay with their 12 year-old going to the mall with friends while others aren't. Either way, it's their choice. Whatever irresponsible decisions some parents might make, every adult in the country shouldn't be forced to pay the price.
🇪🇺"It won't be foolproof"
💡This is all the proof we need to show that the EU and every government know that banning social media for teens won't protect them. When pressed by journalists about VPNs being used to circumvent a ban, politicians always state the ban isn't a silver bullet and will take time. The Mayor of London, Sadiq Khan went as far as to say "we know it's not the solution".
💡Either age verification works, or it doesn't. As a technical expert in this space, I can tell you there are no additional steps to take and no progress to be made. Either the approach does what it is supposed to do, or it's not fit for purpose. If they claim a bulletproof solution is coming, it can only mean one thing. They intend to ban or restrict VPNs to people who verify their identity.
🇪🇺"It will take time to invite the cultural change that is already taking shape in our society, just as it took time to outlaw drink driving, just as it took time to use seatbelts in the cars. Great change never happens overnight, but when it comes to our safety it is always worth it".
💡Comparing a social media ban and age verification to seatbelts is a completely broken analogy. Seatbelts are a safety feature that protects children while allowing them to travel in a car. A ban doesn't give kids a seatbelt. It kicks them out of the car entirely.
💡Instead of supporting parents who want to guide their own children through the digital world, this heavy-handed law strips away parental authority by banning the apps and websites that many parents are perfectly fine with and actively monitor.
💡Furthermore, enforcing these bans requires biometric age verification, which means forcing millions of adult citizens to scan their IDs, faces or credit cards just to browse the internet. That isn't a common-sense traffic law.
💡It's a digital checkpoint on every street. True safety means teaching kids how to navigate the digital world safely with real guardrails and parental guidance, not burning down digital spaces for everyone under the guise of protection.
🇪🇺☠️ The EU wants to ban teens from social media so every person is forced to verify their identity before they can read, share or post anything online. In their words, this is to protect children from dangerous content.
🇪🇺☠️ The EU wants to enforce "Chat Control" so every app has to monitor everything people say privately inside it, including apps with end-to-end encryption. In their words, this is to protect children from dangerous criminals.
💡Where this ends
🇪🇺 "If you want a picture of the future, imagine a boot stamping on a human face - forever".
George Orwell, 1984.
This is quite a significant comment from the head of the British Army. It's some way ahead of anything the UK gov have announced on defence. I'm surprised it hasn't yet been discussed more widely.
⏰The head of the @BritishArmy has just delivered a massive wake-up call to his troops - and the whole of the UK - about the gathering storm.
Please read or watch ⬇️
General Sir Roly Walker tells his soldiers: "You didn’t know this but our nation is going to need you.
"Very soon the political leaders of this country will start to have a frank conversation with the citizens of this country about just what is going on and where the risk lies.
"They are going to try and explain to our citizens that our citizens have got to consent to sacrifices to prioritise defence and security.
"And then they are going to ask those citizens, to whom we are not necessarily at the front of their mind, that they too need to play a part in the defence and security of this country.
"They need to understand what we do for them.
"They need to consent to allow us to do that, which means sacrifices by them.
"And ultimately we are going to need them to back us, to back you to do the one thing that you do that noody else gets to do and that is to take the fight to the enemy."
Nixintel retweeted
Are you a security practitioner in North America? This one's for you. SANS just launched a dedicated X and LinkedIn presence for North America, with guidance built for this region and real voices from the frontlines. Follow @SANSAmerica.
Nixintel retweeted
As the 2026 training year wraps up, SANS is investing back in the practitioners who make up this community.
Nixintel retweeted
When strikes hit Yandex data centers, many assumed Russian bot operations went dark. Cloudflare data reveals that while search crawling stopped, malicious bots simply migrated to other networks. cfl.re/3VQ5uTA
Nixintel retweeted
By popular demand:
A follow-up thread on Russian bots, Yandex, Cloudflare, MAGA, AfD and "breathing easier" on social media.
1️⃣ We see no "dramatic drop" in traffic of Kremlin-aligned human trolls-for-hire targeting Russian domestic users (which we have been tracking for years).
Nixintel retweeted
Last night I was struck — really, almost radicalized — watching in real time as experts at the heights of their careers boosted emotionally satisfying narratives that were pretty much entirely wrong.
We get there eventually.
Kudos to at least acknowledge the error though.
Przeprosiny i sprostowanie.
Chciałbym przeprosić wszystkich Czytelników za podanie nieprawdziwej informacji oraz grafiki jakoby ruch botów wokół AfD spadł o 56%.
Zgodnie z ustaleniami @niebezpiecznik który przytacza opinię Instytutu badawczego Cemas, istytutu Hasso Plattnera i think tanku "Polisphere" nie nastąpił trwały i mierzalny spadek wpisów pro AfD. Zaś pierwotna grafika po niemiecku okazała się być AI.
Niestety mój z wpis z dezinformacją zrobił milionowe zasięgi za co chciałbym raz jeszcze wszystkich czytelników przeprosić. Oczywiście za to co zrobiłem biorę pełną odpowiedzialność i zwyczajnie oraz po ludzku jest mi wstyd za to że Was zdezinformowałem. Przepraszam też kontestowanych oponentów którzy jako pierwsi wykazywali że myliłem się.
Żeby dalej nie dezinformować usunąłem wpis. Od tej pory w tematach nie związanych stricte z militariami przyjmuję zasadę podawania przypisów lub pierwotnych źródeł jeżeli tylko istnieje taka możliwość. Lub jasnego podawania ich braku/niejasnego źródła informacji tak aby było to wyraźnie widoczne we wpisie.
JW.
Nixintel retweeted
No, a Yandex cloud malfunction did not take down disinformation/troll bots. It's a dangerous misconception. This is not how it works, not even technically. After Ukrainian drones hit Yandex data centers, a viral chart showed Russian "bot traffic" collapsing. But those bots are mostly Yandex's own search crawlers, not the info-ops social media accounts. Troll farms hide behind proxies, hijacked devices and Western clouds. They're still operating. Hired influencers are also still around. The "bots went silent" story is misinformation. Believing it is plainly dangerous. It tells people the threat is gone while influence operations keep going. Ahead of elections that complacency is what they may count on.
Nixintel retweeted
There's a story going around: after the drone strikes on Yandex data centres, comments on AfD and MAGA accounts collapsed.
We monitor 17,000+ politicians, media and civil society accounts in 30+ countries. 50,000+ posts a day.
So we checked.
We don't see it. 🧵
A good summary of how the Yandex bots claim degenerated into its own form of misinformation.
Совершенно постыдная история о том, как работает мир современных медиа и общественного мнения.
Кто-то из журналистов обратил внимание на график Cloudflare, который показывает, как после ударов по датацентрам Яндекса упал трафик из подсетей Яндекса — в том числе и трафик поисковых ботов. (Яндекс — это поисковая машина, и автоматизированные агенты, "поисковые боты", постоянно обходят все сайты в интернете, индексируя все обновления: это необходимо для того, чтобы поиск работал). Внимание журналиста упало на слово "боты", а слепое пятно журналиста упало на слово "поисковые", и родилась заметка о том, что "после ударов по датацентрам Яндекса снизилась активность российских ботов".
Ладно, это ошибка. Бывает.
Но это все начинают перепечатывать и никто не задается вопросом о том, какая тут может быть связь: какое отношение датацентрам могут иметь бот-фабрики, создающие комментарии в соцсетях; как активность условного "Лахта-центра" может быть связана с серверной Яндекса?
Но на следующем этапе становится гораздо хуже. На волне хайпа откуда-то появляется график (с надписями на немецком языке; одна из осей на графике не подписаны и что они означают — неясно), который изображает резкое падение какой-то функции. Какой! Неясно. Зато ясно, что график фейковый — он вброшен вчера, а ось времени размечена до 15 октября. Это не мешает разным людям начать его публиковать как "график снижения активности российских ботов". И никто не задается вопросом о том, кто и как 11 октября померял "снижение активности российских ботов" до 15 октября.
И это еще не все. Далее некий польский депутат Европарламента публикует тот же самый график, но с дополнительной подписью и комментариев: мол, вот как от ударов по датацентрам уменьшилось количество комментариев в поддержку AfD, немецкой ультраправой партии, которую поддерживает Кремль.
Разумеется, эту подпись он просто придумал. (Может, это была шутка, как про "российского и украинского пилотов, которые подрались на рейсе flyDubai"?). Тут уж просто прорывается поток остроумия — график тиражируется десятки тысяч раз с разными комментариями о том, как вместе с датацентрами Яндекса разом пропали миллионы сторонников AfD, MAGA и Ле Пен.
Это чушь и неправда на таком количестве уровней, что комментировать не хочется: понятно, что многим комментаторам хочется отрицать наличие реальной проблемы (собственно, растущей поддержки ультраправых) и сводить все к "руке Кремля", но, во-первых, от этого реальная проблема не денется никуда, а, во-вторых, невозможно это делать на таком некачественном фактическом материале. Никому не приходит в голову даже задаться вопросом: а что, есть вообще такая штука, как "график числа комментариев в поддержку AfD"? Правда? А на каких платформах? И почему же такие "графики" не публиковались раньше? Ну и опять же: что, в представлении тех, кто репостил график, гипотетическая сетка "комментаторов за AfD" сидит прямо в ЦОДе Яндекса в Сасово? Серьезно?
Ноль фактчекинга. Ноль вопросов. Бесконечный хайп.
От людей, которые так скажем, известны своим некритичным отношением к фактам (типа Гарри Каспарова), до людей, от которых я ну никак не ожидал, что они это запостят (типа Яна Лекуна) — этот безумный график с немецкими подписями и 15 октября был буквально ВЕЗДЕ. Это очень стыдно.
И вот почему еще это очень плохо.
Потому что Кремль, безусловно, вкладывает много денег в поддержку фашистов из AfD и потому что Кремль, безусловно, содержит огромные стада ботов для продвижения своих нарративов в Европе. Но, увы, после массового и легкого распространения фейков наподобие нынешнего, будущие серьезные расследования о том, как кремлевские деньги вкачиваются в влияние на общественное мнение на Западе, уже не вызовут ни доверия, ни должного внимания.
Important and sensible post from @antibot4navalny re: the apparent decline in Russian bots after strikes on Yandex data centres.
Cloudflare's Bot Traffic does not measure social media traffic. It's a measure of automated web requests made for a range of reasons, and not even necessarily harmful ones.
It is in no way a proxy to measure levels of coordinated activity by bot farms on sites like this or other social media platforms.
To those implying that Kremlin-controlled social media bot/troll farms became silent after Ukraine hit a Yandex data center, posting this CloudFare chart (radar.cloudflare.com/bots/as…):
Hate to disappoint you all ⤵️























