Professional Discord Admin - Game Tester/Dev - Cybersecurity Engineer/Consultant - 100% Disabled Veteran - https://nitter.gq/t.co/G6Hu5plLss
Joined December 2019
- Tweets6.2K
- Following1K
- Followers1K
- Likes16K
MVG_Hells retweeted
DHS investigation just revealed that migrant children were raped up to 700 times each and the person responsible for releasing them without vetting is Xavier Becerra
Again, a single child was raped 700 TIMES
Instead of going to prison, Xavier Becerra is running for Governor of the largest state in America. We are not a serious country
“We found 146,000 kids so far. 146,000 kids. We still have nearly 300,000 missing.
We're investigating reports to where some of these kids claim that they were raped 600 to 700 times — I don't care if you're a liberal, you're independent, you're a Democrat, you're Republican. If you can't stand for law enforcement to go find these kids, who are you?”
Government officials should be held accountable for committing these crimes. They should be going to prison
“Every leader should understand what's going on. And do you know where we're finding the most of them? Sanctuary cities.”
Ban Sanctuary cities in America. Why do they even exist?? Their entire purpose is to shield people breaking our immigration laws
MVG_Hells retweeted
🚨 BREAKING: Journalists James O’Keefe and Cam Higby have been hit with TWO FELONY CHARGES in Minneapolis for their video EXPOSING vulnerabilities in Minnesota’s elections
This is TOTAL LAWFARE!
@camhigby walked in wearing a burqa to show they’d let him vote with a WOMAN’S name with NO questions asked, and he could even “vouch” for some other unregistered “Muslim” (who was @JamesOKeefeIII in a costume)
NEITHER of them voted.
The charges include felony unlawful voting and identity theft.
It’s a WITCH HUNT to try to SCARE OFF conservative journalists, and nothing more.
DO NOT BE DETERRED!
Who else is coming to Converge?:)
Tanium Converge 2026. November 16 through 19. Las Vegas. Chuco is a Platinum sponsor at booth 301. Two breakout sessions.
Full details: na2.hubs.ly/H08JgM_0
Register: na2.hubs.ly/H08JgMt0
#Tanium #TaniumConverge
For the love of…
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
MVG_Hells retweeted
She doxxed an ICE officer on Facebook and told people to "blast HER." Then investigators looked at her phone.
Arely Guzman was a real estate agent in Albertville, Alabama, and one of the loudest anti-ICE voices in town.
Her phone showed she was helping move illegal aliens, including Chinese nationals, and handling cash for a smuggling ring run by an inmate in an Oklahoma prison.
She pleaded guilty in federal court this summer.
This week a Texas jury convicted three more members of that same ring. Prosecutors say it made over $5 million.
Their enforcer shot a man, tried to dissolve his body in acid, set it on fire, filmed it, and sent the video to the boss.
That's the operation this "activist" was part of while she was out there trying to sic a mob on an ICE employee.
Next time a Democrat tells you that unmasking ICE agents is about "accountability," remember her name.
Sometimes the person screaming loudest about ICE has the most to hide.
justice.gov/usao-wdtx/pr/hom…
MVG_Hells retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
MVG_Hells retweeted
And the security shitshow continues... Four more things to add to yesterday's list. We're now at nine(!) major security issues and developments in just a few days.
6. ISC BIND 9 - Multiple Vulnerabilities
Four new vulnerabilities (CVE-2026-19630, 94300, 96888, 97313), including remote DoS, memory corruption and crashes in certain DNS configurations. Fixed in BIND 9.20.30 and 9.21.27.
kb.isc.org/docs/all-bind-adv…
7. Oracle Java / JSSE (CVSS 9.1)
CVE-2026-91403. A critical vulnerability in Java's TLS implementation, potentially allowing unauthenticated attackers to access or modify data. Affects Java 8, 11, 17, 21, 25 and 27, plus GraalVM.
oracle.com/security-alerts/a…
8. Windows SMB Server DoS (CVSS 7.5)
CVE-2026-96325. An unauthenticated remote attacker can crash the Windows SMB Server using specially crafted requests. Not RCE, but still a serious availability issue for exposed systems.
msrc.microsoft.com/update-gu…
9. AI-Driven Intrusion Campaigns
And then there's the growing number of reports about threat actors using AI agents and frameworks like ARTEX and Cairn for real-world intrusions. Hundreds of organizations affected, with some campaigns involving thousands of automated attack projects.
Microsoft / ARTEX:
microsoft.com/en-us/security…
NorForge / Cairn:
norforge.com/blog/inside_cai…
I'm starting to wonder what next week will look like...
(you can find 1.-5. in the quoted tweet)
🤖 Made with AI
This week has been quite a shitshow already, and there are still 2 days to go
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.php#202…
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-20…
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell-…
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell-php-rc…
Corelight’s open-source Zeek and Suricata detection rules:
github.com/corelight/php2she…
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/pat…
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulnerabi…
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unboun…
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
blog.google/security/protect…
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
bugzilla.mozilla.org/show_bu…
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
MVG_Hells retweeted
Yesterday, we promised free PHP2Shell hunting material. Today, we’ve created a Hunt Lead covering successful exploitation against a Linux system.
Researcher analysis is normally subscriber-only. For this Hunt Lead, we’ve made the full analysis free to benefit the whole community.
Here’s what you’ll get:
• 14,838 normalized records covering EDR, auditd, Sysmon for Linux, authentication and system logs, plus Zeek HTTP, connection and file-analysis records.
• 5 endpoint alerts and 145 Suricata records, with network rule matches distinguished from stream warnings.
• 10 KQL hunting queries, 3 Sigma rules and 3 Suricata rules to review and adapt for your environment.
• 5 investigation questions connecting the network activity with evidence from the host.
• A downloadable PCAP and investigation guide so you can examine the exploitation traffic in Wireshark alongside the host evidence.
The Hunt Lead also covers the vulnerabilities, affected versions and mitigation steps, with the information dated 22 October 2026.
Linux is the first release. We haven’t seen a working Windows PoC or successful PHP2Shell exploitation against our Windows environments. So far, the Windows activity we’ve observed has been fingerprinting and reconnaissance.
We’ll add verified Windows evidence to the same Hunt Lead when it becomes available.
Investigate the lead, read the brief, inspect the findings, grab the Hunt pack and explore the detailed researcher analysis. Then use the queries and rules to start hunting in your own environment.
All of it is free for everyone.
threathuntinglabs.com/leads/…
MVG_Hells retweeted
The full release of Enshrouded is coming tomorrow to PC and PlayStation 5! 🎉And for your first taste, we're releasing the launch trailer a day early. Check it out!
MVG_Hells retweeted
🚨EXCLUSIVE J6 INVESTIGATION
- Thanks to new House Speaker Mike Johnson, We now have permission to release Capitol CCTV footage proving that a member of Nancy Pelosi's security detail, Special Agent David Lazarus, perjured himself on the stand during the Oath Keepers trial.
- Lazarus was brought in to corroborate another Capitol police officer's account claiming that he had antagonistic encounter with the Oath Keepers. But footage of Lazarus proves that he was lying.
- These lies, spread unquestioningly by the media and Democrat politicians, were used to put innocent people in prison, ruining their lives and the lives of their families. They and their attorneys did not have access to the footage at trial that Blaze Media is releasing today.
- Instead, Harry Dunn was made a hero by Joe Biden and Nancy Pelosi, and as a result of his and David Lazarus's false testimony, there are innocent people in prison.
- The government lied about this. What else are they lying about?
MVG_Hells retweeted
🚨 BREAKING 🚨
ATF Releases NFA guidance in response to the Texas NFA lawsuit:
"Effective October 9, 2026, ATF will no longer require individuals to seek ATF approval under the NFA before making or transferring short-barreled rifles, short-barreled shotguns, silencers, and “any other weapon[s]” as defined in 26 U.S.C. § 5845(e). ATF will also no longer require such items to be registered in the National Firearms Registration and Transfer Record. These policies apply uniformly to anyone otherwise subject to these requirements, not just to the plaintiffs in the litigation."
MVG_Hells retweeted
إيلون ماسك خلى الخيال حقيقة.
صاروخ Starship وصل المدار...وفتح بطنه ونزل ٢٦ قمر Starlink مرة واحدة، كأن الصاروخ بيطلع حبات من علبة PEZ!
علشان نتخيل صاروخ بحجم ناطحة سحاب تطلع للفضاء.... تدخل مدار الأرض وبعدها ترمي ٢٦ قمر صناعي في رحلة واحدة.
والأقما الجيل الجديد يعني أقوى بكتير من أجيال سابقة....
بقينا بنتفرج على المستقبل وهو بيتبني قدام عينينا.
مفيش حاجة اسمها مستحيل بالعلم
MVG_Hells retweeted
We’re proud to announce that #Valheim 1.0 is out now! Gather your friends, sharpen your axes and check out the patch notes below. We’ll see you in the tenth realm! valheim.com/news/valheim-1-0…
MVG_Hells retweeted
If Mamdani would like me, a white New Yorker who never owned slaves, to pay a black New Yorker who never was a slave, then I propose:
Every Muslim in NYC starting with Mamdani, should pay us for 9/11.
Please explain why the latter makes no sense but the former does.
MVG_Hells retweeted
🚨 JUST IN: Video has been released of suspected vandals DESTROYING the lining of the Lincoln Memorial reflecting pool
Trump Derangement Syndrome seems to be a BRAIN EATING disease. This is INSANE.
This particular incident took place on June 19. Now, even NYTimes is admitting TWO ~170ft blade cuts have been found.
THROW THE BOOK AT THEM!
MVG_Hells retweeted
Wow
Today, I’m releasing never before seen intelligence revealing new evidence of past US government funding for more than 120 biolabs in over 30 countries, including Ukraine.
In support of President Trump‘s Executive Order to end federal funding of dangerous gain of function research around the world, and increase transparency and accountability, ODNI will continue working with partners across the Administration to identify where these labs are, what pathogens they contain, and what “research” is being conducted.
odni.gov/index.php/newsroom/…