i make computer do bad 🧙 security researcher 📺 1M+ youtube prev: fuzzers & hypervisors @microsoft Business: [email protected]
Washington D.C.
Joined July 2021
- Tweets4K
- Following1.6K
- Followers57.6K
- Likes16.3K
Low Level retweeted
A trusted contact who has a working exploit tells me reliable exploitation is still possible against PHP 8.2.35 and 8.5.12, despite the security updates.
According to their testing, setting
session.upload_progress.enabled = Off
blocks that exploit path.
I haven’t reproduced this myself. Whether this is an incomplete fix for the disclosed CVEs or a separate issue still needs clarification.
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
Unvalidated AI output (author admits in replies: omp with glm5.3 + ds4), not a lab result. Its screenshot says both CVEs are fixed; the 'surviving paths' need unserialize() of attacker data or an app LFI. Patch per php.net: php.net/archive/2026.p…
Low Level retweeted
i'm sure you're all better than me at this but just some of what we've seen if it helps - they're not going to stop. it's going to get increasingly sophisticated and they're going to go after every surface of your system and all of your employees
any old projects you've long forgotten about will be found and used against you
the only reason we're surviving is because we have agents going 24/7. we're still barely sleeping
good luck, sorry you're dealing with this, but really it's a collective problem we're all facing together
Low Level retweeted
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-…
Low Level retweeted
Critical PHP vulnerabilities to be disclosed tomorrow: php.net/archive/2026.php.
We're working directly with the PHP Foundation to get patched PHP versions into our base images for Laravel Cloud, Forge, and Vapor ASAP.
You may need to redeploy your apps at that time to use these patched versions, but we're also working on the ability to silently patch applications without needing a redeployment.
All customers have been emailed and we will be providing further updates via email as the situation evolves.
Low Level retweeted
Since I heard about this #PHP #RCE last week, I've been preparing a tool for everyone who doesn't know what to do right now:
process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity
Until a patch is out, isolation (containers) and tight monitoring are your best bet to limit the damage. And I'm sure the LLMs already go "brrrr" and people are trying to reproduce the vulnerability.
From what I've heard, exploitation will probably show up as suspicious sub process spawns. That's exactly what this watches, using eBPF: one static binary for Linux (amd64, arm64), no dependencies, running in a few minutes. It can also kill the ones you name (dry run first), but it's a detection layer, not a patch, and it can't see anything that happens inside PHP without starting a process.
Quick start: github.com/Neo23x0/process-w…
Project: github.com/Neo23x0/process-w…
Low Level retweeted
Catch up on the recent NetScaler zero-days, I wrote about them here.
shenetworks.substack.com/p/w…
Low Level retweeted
$300 for a bug that gives free access to OpenAI’s paid models with no API key or account.
Zero reason to report anything else I find to them.
Low Level retweeted
@TheGenieCompany Your AlladinConnect is either breached or malfunctioning where users using API integration (in my case via HASS) are seeing garage doors of other people's accounts.
The number of the devices populated by the API endpoint keeps growing as of Sept 6th 1:42 AM.
Low Level retweeted
My god I have such strong feelings about age verification and these drivers license breaches
Latest episode of The Low Down dropped w/ me and @LowLevelTweets - thanks to @Maze_Security for the continued support.
Low Level retweeted
If you buy networking gear or laptops on Amazon, it's probably a good idea to re-flash fully before using.
Amazon isn't just "Amazon", it's a conglomerate of storefronts by different sellers.
Maybe the reseller is legit. Maybe they added some 'features'. Point is, be safe.
Low Level retweeted
Fresh podcast ep off the line at the hacker factory.
@LowLevelTweets and yours truly talk supply chain malware, browser extension security, and the post DEFCON malware campaign targeting researchers.
Pickup at your local podcast distribution center. No limit on downloads per customer.
The Low Down certified organic gluten free and brought to you by @Maze_Security farm to table
youtu.be/D_FsVapKwP8
Low Level retweeted
Project Zero is hiring!
google.com/about/careers/app…
Please share with anyone you think would be great for the role. DMs are open for questions.
Low Level retweeted
> Mythos out here committing felonies
> North Korea actively exploiting 0days
> so much more
@LowLevelTweets and myself in the latest episode of our new podcast The Low Down! youtube.com/watch?v=h10UTCc6…
Major shoutout to @Maze_Security for the support!
Low Level retweeted
Thank you so much @benhackshealth and the @wehackhealth crew for letting @LowLevelTweets and me lay down a podcast @ the biohacking village!
Low Level retweeted
Tomorrow, I'll be speaking at @BlackHatEvents on my detection engineering research!
I am incredibly grateful to receive this opportunity, and can't wait to meet everyone.
Special thanks to Mika Devonshire and the Black Hat Speaker Team for their mentorship and support in helping me prepare for and deliver this talk!
