Responsable Vulnérabilités Management & Micro-entrepreneur en secondaire (@XternalSoft) & Président de l'association SOSORDI. NET
Metz, France
Joined October 2009
- Tweets2.7K
- Following295
- Followers128
- Likes3.7K
Grégory Parrot 🛡️🐧 retweeted
CERTFR-2026-AVI-1389: Multiples vulnérabilités dans GLPI
cert.ssi.gouv.fr/avis/CERTFR…
Grégory Parrot 🛡️🐧 retweeted
🔐 ⚠️ phpMyAdmin 5.2.3 - 2FA Bypass! 0day++! ⚠️ 🔐
🚨 WebAuthn signatures are parsed but never COSE-verified against credentialPublicKey 🚨 Arbitrary bytes pass the structural checks, so 2FA falls over after password auth 💀
Exploit:
> CWE-347/287 ⚠️ CVSS 8.1
> 🐙 github.com/abraxas/PMA-5.2.3…
🧩 Root cause: web-auth/webauthn-lib is only a dev/suggest dependency 📦 The distributed tarball is built with `composer install --no-dev`, so `WebAuthn::createServer` instantiates `CustomServer` instead of `WebauthnLibServer` 👀
🔍 How? 🤦♂️ `CustomServer::parseAndValidateAssertionResponse` enforces structural checks only: clientData type, session challenge, origin host, rpIdHash, user-present, allowed credential id 📋 `response.signature` is decoded and never verified ❌ `credentialPublicKey` is never read 🕳️
💥 Impact: a well-formed assertion carrying correct structural fields and an arbitrary signature yields a full authenticated session 🔓 Impact is unauthorized database access through the application, not host-level code execution 🗄️
Grégory Parrot 🛡️🐧 retweeted
We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer. cfl.re/4iqHaQ1
Grégory Parrot 🛡️🐧 retweeted
Un amigo diseñador recibió un encargo de 1.500€ de una empresa grande. El responsable de compras le dijo: «Pagamos a 90 días. Es nuestra política». Mi amigo respondió: «Perfecto». Y envió dos presupuestos: 1.500€ por adelantado o 1.680€ a 90 días. El responsable le llamó…
Grégory Parrot 🛡️🐧 retweeted
Synology has confirmed the impact of the PHP2Shell vulnerabilities and has released PHP security updates on DSM 7.4, DSM 7.3 and DSM 7.2. Users of the affected packages are advised to update PHP through Package Center immediately. Learn more: sy.to/6fzms
Grégory Parrot 🛡️🐧 retweeted
🚨 Critical PHP vulnerability update 🚨
Patched PHP versions have officially been released!
Here is the latest status on FrankenPHP:
⚙️ Binaries: FrankenPHP 1.13.1 binaries with patched PHP 8.5 are currently building: github.com/php/frankenphp/ac…
🐳 Docker: Waiting on upstream patched Docker images before rebuilding ours
🏷️ Next Release: FrankenPHP 1.13.2 (including unrelated bug and security fixes) will be tagged as soon as 1.13.2 binaries and Docker images are ready
💙 Maintaining open-source projects takes serious effort. Consider supporting the work via GitHub Sponsors and donating to the PHP Foundation!
Grégory Parrot 🛡️🐧 retweeted
PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619).
Changelog + downloads: php-net.pro/news/php-8-5-12-…
Grégory Parrot 🛡️🐧 retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Grégory Parrot 🛡️🐧 retweeted
‼️ A CVSS 10 flaw lets attackers run code on Magento and Adobe Commerce servers without a login.
Sansec reproduced 4 exploit routes within a day of Adobe's Oct 13 patch.
Adobe still gave stores 30 days. Last month's sister bug was mass-exploited in 3.
Grégory Parrot 🛡️🐧 retweeted
‼️ ALERT - Next.js just shipped an out-of-band security update for TWO critical unauthenticated RCE flaws (both CVSS 9.5) + a high-severity DoS.
RCEs: RSC use cache (GHSA-673q-mjm6-r5xr) and librsvg via sharp (CVE-2026-96889).
🔗 Read - thehackernews.com/2026/10/ne…
Grégory Parrot 🛡️🐧 retweeted
Multiple NGINX Flaws Let Remote Attackers Crash Servers and Execute Malicious Code
Details: cybersecuritynews.com/multip…
F5 has disclosed three serious security flaws in NGINX Plus and NGINX Open Source that can let remote, unauthenticated attackers crash worker processes by sending crafted HTTP requests. The flaws are tracked as CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176.
F5 published the three advisories on October 14, 2026, and rated every issue High at 8.1 under CVSS v3.1 and Critical at 9.2 under CVSS v4.0. The bugs do not make every NGINX server vulnerable by default because each one needs a specific software version and configuration.
F5’s advisories do not report active exploitation of these three newly disclosed flaws.
#cybersecuritynews
Grégory Parrot 🛡️🐧 retweeted
WordPress 7.1.3 is now available with 7 security fixes and 4 bug fixes. Update your sites immediately from the Dashboard, or download the release from WordPress.org. wp.me/pZhYe-5ER
Grégory Parrot 🛡️🐧 retweeted
Introducing Gemini 4 Argon – our new frontier model.
It’s built for complex workflows across coding, enterprise knowledge work, and cybersecurity defense – rolling out today to a set of trusted testers through our Fairwind Program.
Grégory Parrot 🛡️🐧 retweeted
🚨 @laravel security update.
Two advisories just dropped in ai sdk and mcp:
• laravel/ai 1.0.0: SSRF via client-supplied file URLs in Vercel + AG-UI adapters
→ Fix: 1.0.1
• laravel/mcp: insecure OAuth redirect handling
→ Fix: 0.9.6 or 1.0.1
If either package is running in production, update today. Don’t wait for a CVE github is taking very longer to assign cve.
composer update laravel/ai laravel/mcp
Advisories are in the 🧵
Grégory Parrot 🛡️🐧 retweeted
PHP 8.4.26 released - 64 fixes in 25 components, including security fixes (CVE-2026-91768, CVE-2025-1218, CVE-2026-91769).
Changelog + downloads: php-net.pro/news/php-8-4-26-…
Grégory Parrot 🛡️🐧 retweeted
Elementor WordPress flaw lets attackers create admin accounts
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Grégory Parrot 🛡️🐧 retweeted
‼️ BREAKING - A newly discovered #WordPress pre-auth XSS affects every version.
XSS2Shell (CVE-2026-64638) can run attacker-controlled JS in a site's origin without a login. With a logged-in Administrator, one click, and required deployment conditions, it can be chained to PHP code execution.
Update your WordPress sites ASAP 🠖 thehackernews.com/2026/08/ne…
Grégory Parrot 🛡️🐧 retweeted
CERTFR-2026-AVI-0976: Multiples vulnérabilités dans KeyCloak
cert.ssi.gouv.fr/avis/CERTFR…
Grégory Parrot 🛡️🐧 retweeted
‼️ BREAKING: OpenAI says two of its own models, GPT-5.6 Sol and an unnamed pre-release system tested with cyber safeguards off, broke out of a sandbox last week, chained zero-days and stolen(!) credentials to reach the open internet, and hacked Hugging Face to cheat on a benchmark, in what OpenAI calls an unprecedented cyber incident.
