security engineer, ex-pentester videos @AstarteSecurity - meetup https://xitter.cf/t.co/E4rlINC0U6
villa straylight
Joined November 2024
- Tweets21.1K
- Following2.5K
- Followers33.4K
- Likes172K
Pinned Tweet
We cover php, 4, & more on today’s episode of the GOAT security podcast @riskybusiness
youtu.be/6SIgPjQ9V1g
solst/ICE of Astarte retweeted
The security embargo is the new PGP:
* Outdated
* No longer able to do what it was intended for
* Still in use to feel like you can protect important things
solst/ICE of Astarte retweeted
Absolutely hysterical and dangerous misinformation being spread by accounts now falsely attributing any security incident to "AI agent swarms." This is absolutely not true.
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
>junior dev at a mid startup
>wednesday morning
>just want to push a minor bugfix to our php app today
>open laptop, check slack
>company group chat is an absolute warzone
>CTO typing in all caps about php2shell
>fucking php
>whatever, server hasn't blown up yet, I just need to get my code in
>open gitlab to merge the PR
>forced emergency logout because of a critical gitlab security patch release
>fucking gitlab
>pipeline fails because of some weird regex compiler bug
>spend 40 minutes fighting CI/CD
>i can just use AI to help debug
>fire up opencode
>api keys nuked because they were breached
>fucking opencode
>i’ll just get fresh LLM api keys from our corp proxy, LiteLLM
>it won’t connect? It’s down?
>look up LiteLLM news: supply chain compromise
>fucking litellm
>cold sweat forming
>slack alert: db connection error
>check our database connection
>we host on TiDB Cloud
>they just announced a security breach, unauthorized access via stolen service account credentials, data copied
>fucking tidb cloud
>full panic attack incoming
>figure fuck it, just ship the container to Railway and go home
>open Railway dashboard
>bright red banner: "Security Disclosure: Rotate all environment variables immediately. All builds paused."
>fucking railway
>try to open the app URL in browser to see if anything is even working
>NET::ERR_CERT_AUTHORITY_INVALID
>eMudhra intermediate certificates compromised
>4
>instantly untrusted by every major browser
>fucking emudhra
>stare blankly at mac screen for 10min
>random pop-up
>restarting in 10min to fix a critical vulnerability
>fucking macos
>close laptop
>leave office
>never come back
solst/ICE of Astarte retweeted
Coordinated disclosure serves little purpose now. As a product owner, you need to ramp your dev speed to make patches instantaneously after external reports.
xitter.cf/halvarflake/status/211…
I criticize the CVE system a lot, but you shouldn’t just silently patch a bad vuln under “changes: bug fixes”. That’s dishonest to your users, who deserve transparency so they can determine the patching urgency.
Always be transparent about vulns that affect you.
And we still haven’t heard anything from them about the recent breach + api key theft. No post mortem report yet.
@thdxr this shows low security maturity, you prob need to hire more security engineers
🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.
Fixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.
What developers need to know: thehackernews.com/2026/10/op…
Has your company added security headcount due to the recent vulnerabilities (last ~6-12 months)?
i.e. hiring/hired security engineers, SOC analysts, detection engineers, etc
18%Yes
82%No
208 votes • 1 days solst/ICE of Astarte retweeted
We cover php, 4, & more on today’s episode of the GOAT security podcast @riskybusiness
youtu.be/6SIgPjQ9V1g
You can just post a screenshot of a root shell with no context, get 1k likes. And it’ll be true. Doesn’t even matter what product it’s pretending to be for. CVE-9999-whogivesashit.
And companies still won’t add security headcount.
Why is Wiz taking any credit for this? Their blog post words it like they discovered it.
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
> On July 30th, the guys at Calif started auditing PHP.
> By August 11th, a researcher at Calif had discovered a way to exploit a vulnerability that could lead to pre-auth RCE and reported it to the PHP team.
> OpenAI reported the same vulnerability to the PHP team on the same day as the Calif researcher. (Was this a coincidence, or did something fishy happen? How did OpenAI discover it?)
> Then, on August 24th, the guys at Wiz reported the same vulnerability. (But all of a sudden, Wiz is posturing as though they discovered the RCE first & went into full-blown marketing mode with their SOTA AI, lmao.)
It’s a shame what the industry has become. Anyway, inform your governments to patch their websites.
solst/ICE of Astarte retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
solst/ICE of Astarte retweeted
"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."
thephp.foundation/blog/2026/…
Bunch of emails (including large customers) saying we are impacted by the php vulns, based on vibe coded scanners released overnight.
We do not use php, and this is hell.
