
Dislike cyber__ terms | @HardHatBrigade | Perpetual Newb | Meyers-Briggs: IDGAF | !Serious Account | ex-Payphone Purveyor | on infosec exchange | views my own
Ward River
Joined July 2014
- Tweets64.6K
- Following4.8K
- Followers6.2K
- Likes134K
A comprehensive look at cryptocurrencies and NFTs, and how it's mostly a scam. 💯
Line Goes Up - The Problem With NFTs
youtu.be/YQ_xWvX1n9g
MrBill // wardrive every day // retweeted
This is all just a very aggressive Cybersecurity Awareness Month campaign
MrBill // wardrive every day // retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
SITUATION DETECTED: CloudFlare CEO Matthew Prince says he is aware of additional severe vulnerabilities in other pieces of critical software, and said “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” per Reuters.
MrBill // wardrive every day // retweeted
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches thehackernews.com/2026/10/ur…
MrBill // wardrive every day // retweeted
Somewhere, a CTO just found out their servers still run PHP 5.6 💀
MrBill // wardrive every day // retweeted
Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment:
1. Discovery with Nmap
Common and alternative web ports; HTTP headers that may expose PHP versions:
nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true'
Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.
2. Huntress: Monitoring and detection
• Confirmed facts and remaining questions
• Suspicious PHP child processes, shells and downloaders
• Webshells and other post-exploitation activity
• My process-watcher for Linux process visibility
huntress.com/blog/php2shell-…
3. Vincent Schmalbach: Hardening and patching
• Temporary nginx/Apache filters and upload-progress settings
• WAF/origin bypass checks
• Package and backport verification
• PHP-FPM/worker restarts, container rebuilds
• Side effects and checks for compromise
vincentschmalbach.com/cve-20…
Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.
MrBill // wardrive every day // retweeted
We are still wrapping up a summary and will be drawing a winner of the WiFi Shuriken by the end of the week, so stay tuned. Thanks!
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
MrBill // wardrive every day // retweeted
Claude Code found spyware on my sister’s phone. It had been tracking her for 11 weeks…
She asked me to check her phone. Someone always seemed to know where she was and she couldn’t figure out how
I plugged it into Claude Code and asked what’s running that she never installed. It walked every app, including the hidden ones, and flagged one disguised as “System Service”, no icon, not on any store
It had been there 11 weeks, logging her location every 2 minutes. Claude pulled the details on whoever was running it:
reports to → +1 (415) *** **72
carrier → T-Mobile US
device id → IMEI 35 ********** 47
last ping it sent → 40.7**, -73.9** · 2 min ago
We saved everything the app had recorded and passed it to the people who do this professionally. Then Claude shut it down and wiped it off her phone
The full step-by-step is below, takes 5 minutes. Save it so you don't lose it, and send it to anyone who might need it
MrBill // wardrive every day // retweeted
> be @malwrhunterteam
> on a legendary run on social media
> find silly website
> estrosa-dot-it
> website for italian cosmetics
> legit website, used by the pasta people
> notice something silly on website
> /js/analytics/assets/js/group.html
> look inside
> group.html checks browser agent
> detects iOS version
> loads different files depending on iOS version
> loads 49554fde7424c31c.js
> 49*.js doing lots of crazy stuff
> layers of obfuscation and pointer arithmetic
> lolwtf
> look inside
> exact match of Coruna EK
> Coruna Exploit Kit
> Coruna originally used by US government
> rumored to be made by US contractor
> rumored US contractor illegally sold to kremlin
> UNC6353 (kremlin) found using Coruna in 2025
Chat, someone is swinging the legendary goop around. It is Coruna, the state-sponsored iOS exploit kit. All this requires is your Apple device to visit a website and (assuming you're running the targeted iOS version) you're cooked.
Although, from my initial bonking of it, it appears this delivers two different payloads depending on the iOS version. Unfortunately, I know almost nothing about iOS exploitation and iOS malware, so I have no idea what I'm doing. I encouraged my peers and colleagues to review it. It is good goop.
I've archived the payloads from the compromised domain. The shared link is below.
pic unrelated
MrBill // wardrive every day // retweeted
Really good amateur radio news!
openresearch.institute/2026/…
Successful EVE2026 attempt.
Please follow @radiotelescoop for more information, details, and updates. Congratulations!
@OpenResearchIns helped with communications theory, link budgets, and protocol support.
MrBill // wardrive every day // retweeted
10 bux off any assembled device in the colonelpanic.tech store until Halloween.
Use code cryptid during checkout at colonelpanic.tech for 10 bux off any mesh detect or oui spy order. Happy Halloween season. Trick or treat mfers!
MrBill // wardrive every day // retweeted
A 10-year-old satellite built for daylight imaging just started seeing Earth after dark.
ESA switched Sentinel-2A on at night in December 2025. It was a test, not a normal mission mode. Sentinel-2’s multispectral imager usually relies on reflected sunlight, so the instrument is normally switched off when the satellite passes over the dark side of Earth.
This time, ESA left it running.
The targets were carefully chosen: gas flares, bright lights, wildfires, fishing activity and marine activity. The campaign covered selected locations during one full Sentinel-2A cycle, with Level-1B data collected in specialist modes.
The results were better than expected.
Sentinel-2A captured gas flares from oil production in the Middle East. That was the easier part, because flares are bright enough to stand out clearly at night.
Then it picked up subtler signals: a wildfire in India, fishing boats off South Korea, gas flares in Iraq and Qatar, and city lights.
That’s the interesting part. Sentinel-2A launched in 2015 to observe land, coasts, forests, farms and water in daylight. It carries a 13-band multispectral imager, has a 290 km-wide swath, and became one of the core workhorses of Copernicus, Europe’s Earth observation programme.
Now it’s the older sibling.
Sentinel-2B launched in 2017. Sentinel-2C launched in 2024 to take over from Sentinel-2A. Sentinel-2D is still to come. With the newer satellites handling the main operational mission, ESA is using Sentinel-2A’s remaining time in orbit to test ideas for Sentinel-2 Next Generation.
Night imaging is one of those ideas.
The next generation mission is being designed to deliver higher resolution imagery and to image some parts of the planet when the Sun is down. Sentinel-2A is helping ESA work out which signals are useful enough, strong enough and technically realistic enough to build into that future mission.
Gas flares could support emissions monitoring.
Fishing boat lights could help track marine activity, including poorly monitored fishing.
Wildfires could be easier to detect in some night scenes because the background is darker.
City lights could reveal urban expansion, infrastructure growth, electrification, disaster recovery and conflict impacts.
For researchers, the spatial detail is the real prize. Most nighttime lights work relies on sensors such as DMSP, VIIRS and Black Marble. Those datasets are incredibly useful, but they’re much coarser than Sentinel-2.
Sentinel-2 can get down to 10 to 60 metre resolution depending on the band. That opens the door to seeing night activity at the scale of ports, road corridors, settlement edges, mine sites, flare stacks, fishing clusters and fire lines.
There are constraints. This doesn’t turn Sentinel-2 into a full-time night lights mission. Energy use matters. Calibration matters. Signal strength matters. Target selection matters. Processing Level-1B nighttime data also takes specialist care.
But the direction is clear: the old boundary between “daylight optical imagery” and “nighttime activity monitoring” is starting to move.
The data is also opening up. The December 2025 campaign was first limited to expert users through the Copernicus Data Space Ecosystem.
In May 2026, ESA said a consolidated nighttime dataset from the campaign would be made public to all users, expected by the end of Q2 2026... I'm looking forward to this...


































