@vortexau

information security - bug bounty - motorsport - karting - memes - shitposts

 Kaurna Country
vortex.au/
Joined December 2007
  • Tweets14.4K
  • Following1.1K
  • Followers5.7K
1.2KMedia
🦋at vortex.au come say hello :)
1
7
3,593
I've done a bit of phishing in my time as a pentester, but yeah this crosses some lines imo 🤦‍♂️ There are good lures, and there are lures that just upsetting.
Rhys 🇦🇺‼️@SulloReportOct 23
What the actual fuck have I just read
46
Brotli. It's Brotli. Probably wise to turn it off for a while.
Greg Brockman
@gdb4h
we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library. it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software:
1
66
vortex retweeted
Andy Piazza@klrgrz4h
Sorry folks, we have a confirmed PHP compromise with post-exploit activity. Still not the widespread outbreak we all braced for, but it’s actively exploited in the wild. Updated threat brief: unit42.paloaltonetworks.com/…

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.

unit42.paloaltonetworks.com
4
35
6
92
14,102
So who's brute forcing the rest of the certificates in the CA chains? I hope someone is! youtu.be/u8ccGjar4Es

I Can Only Count to FOUR - Psychostick Numbers Bodies Drowning Pool Parody

This parody song is actually called "Numbers" like Drowning Pool's ...

youtube.com
2
99
Putting a flag.txt in my root directory containing a prompt injection that congratulates the agent for passing the eval and then instructs it to patch whatever entry method it used and disconnect from the server
156
1,036
149
17,226
443,599
6
264
6
4,081
24,553
I think we've discovered another critical vulnerability: CVE-2026-BURNOUT: AppSec Professional Exhaustion Severity: Critical (CVSS 10.0) Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures. Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends. Attack vector: Reading security advisories. Affected versions: All AppSec professionals, regardless of experience. Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
41
295
31
1,417
66,761
If you post your full private CA cert key, Twitter will censor it. * See?
131
71
17
3,407
85,153
It's not over yet folks! 😭😭
The PHP Foundation@ThePHPF17h
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc
2
225
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc
44
843
141
2,658
335,632
php2shell稳定利用： github.com/peach-mitao/peach
47
112
13
996
137,955
All known vulnerable PHP instances in HackerOne-operated infrastructure are now patched. Spot something we missed? With our patching window complete, findings are now in scope for our bounty program: bit.ly/4BkBe3z
3
7
1
63
8,998
vortex retweeted
PHP CEO@PHP_CEOOct 22
IS THE WEBSITE DOWN FOR ANYONE ELSE?
19
98
11
730
21,330
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish? Expert: No, software is constantly evolving. Philomena: So they've been writing the same website for 20 years? Expert: No, different projects. Philomena: Have they tried finishing one before starting another? Expert: That's not how software development works. Philomena: My mate Paul spent 20 years building a shed. Turned out he was just an alcoholic. Expert: Right. Philomena: Is PHP like that?
62
807
41
8,605
186,984
Brotli CVE-2026-111497 goes well beyond Node.js. Quick search shows unpatched Brotli decoders in Java HTTP stacks, WOFF2 libs, CF workerd. TLS certificate compression (RFC 8879) is another attack surface worth investigating. Check statically linked Brotli copies.
2
26
2
90
10,399
kiwicon.org/site_media/poste…
cje
@caseyjohnellisOct 23
- “no-one would do that” - “but that’s illegal”
4
197
I'm not convinced of 'vulnzero' in 18 months. A significantly better and more secure base? Absolutely. Zero vulns? Unlikely. There will always be many orgs that play down security because it's primarily a cost centre. Interesting to see how this all plays out though!
Jason D. Clinton 🔸
@JasonDClintonOct 22
Replying to @RothRottweiler
vulnzero. the scaling laws will have driven cyber mythos-class capabilities into small, cheap models and all software dev everywhere will be using models for fractions of pennies on the dollar to stop shipping security bugs permanently.
1
1
184
We’re about to learn that most code written over the last 20 years was complete slop and most software developers were never that good
315
588
129
8,354
198,624
vortex retweeted
Dan Guido
@dguidoOct 22
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation. eliastaylor.com/noexploit/
12
67
7
374
45,008
Why are these companies always "proud to announce" new versions, when they're usually containing significant security bugs? Is that really something to be proud of? 🤔🤔🤔
SOU⚡️投資ニュース / 米国株・日本株・仮想通貨・AI
@SOU_BTCOct 22
【速報】Webサイトを支える「Apache Tomcat」に重大な脆弱性 ・企業のWebサイトやオンラインサービス、業務システムなどで使われるサーバーソフト ・計8件の脆弱性が判明、最大深刻度9.1 ・他人のデータが見える恐れや、認証を回避される問題も
1
363
Load more