Offsec engineer | Nim/C/Python | https://nitter.gq/t.co/nrOLU7oWlt I break things so others stay safe.
Woodstock, GA
Joined March 2007
- Tweets2.3K
- Following802
- Followers306
- Likes2.1K
Jeff Barron retweeted
LLMs...Letting me do fun things I never would have wasted time on.
"I reviewed all 30 public GitHub repos for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) by reading code only. The slide has the full
grouped table; the headline findings:
Nothing works against a real target. Every genuine memory-corruption chain is lab-bound: it needs exact per-build offsets, display_errors=On, a single prefork mod_php worker, and a specific image.
Independent reviewers (allureluoli, dinosn, Gi1gamesh123) and the leaked primary source itself all converge on "no public artifact achieves code execution" on the patched core bug. Every real shell
in these repos comes from an app-side LFI or deserialization sink, not the CVE.
Three are original and real, all lab-only. 9bie (the source of the Set-Cookie leak chain), Marven11 (the most sophisticated, a true in-band leak), and Karasawa2025 (whose "Fermat" troll description
hides a working ROP + display_errors=off exploit). These are the only ones with a genuine ASLR-defeating leak primitive that is their own.
Most are copies. One original (9bie) spawned five derivatives:
- twili8 is an outright uncredited rip-off: its own README still says git clone 9bie/... and the Docker files are byte-identical.
- godylockz and xuehuolll are byte-identical to each other.
- dinosn and 3em0 are credited ports that add value.
Three are mislabeled. iQingshan, KarimUD7 (≈98% the same code), and Gi1gamesh123 exploit a different bug entirely (the Calif unserialize var_hash UAF) against their own planted endpoints, filed
under the php2shell CVE numbers.
The rest is noise. The most-starred repo (ikow, 905★) delivers the least: broken or stubbed chains with the two "real" ones paywalled behind Substack. eness (558★) is a leakless forge that can't
defeat ASLR. syrex1013 ships AI-generated fake CVEs in a side directory. Whackermelon hallucinates a non-existent openai/php2shell-checker. lcfr-eth is a parody with a memecoin address, and Icex0
is an empty repo. The genuinely honest work is the crash labs (allureluoli, slabbdev, 0x4148), which prove the bug without claiming RCE.
The ASLR column, star counts, copy lineage, and the specific "tell" for each repo are all in the table. The page is private to your account; use the Share menu if you want to send it to the team"
Jeff Barron retweeted
The IPO ain’t happening folks. This is a cry for help.
OpenAI's Noam Brown says air-gapping the computers may not stop a misaligned AI, because two air-gapped machines can still talk by running a CPU hot and reading the temperature change
"But I think the major takeaway from the incident is that people underestimated the AI. And we never want to be in a situation again where we underestimate the AI. It's a weird world, because AI progress is so fast that people are consistently underestimating the AI."
"So to be in a situation where you don't underestimate it again, when it comes to safety and alignment, you have to have a very, very, very high bar."
"You could even go as far as to say, "Well, we should air gap the computers." And I'm not convinced that that would be sufficient."
"There are studies, and this is mostly academic, where you can have two computers next to each other that are air-gapped and they're still able to communicate with each other because they have temperature sensors."
"One of them is able to run their CPU really hot, and then the other one can actually detect the temperature change, and then that actually gives them a mechanism to communicate."
_________
Link and more key quotes from OpenAI's safety related conversations: firesidealpha.substack.com/p…
Jeff Barron retweeted
The day after the CEO lays off a ton of staff and says:
“Non-technical teams are now pushing code to production with AI”
@coinbase has a major outage on their trading engine, and even their status page doesn’t work.
😂
Jeff Barron retweeted
💥 Introducing "Dirty Frag"
A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail.
No race, no panic on failure, fully deterministic. ~9 years latent.
Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more.
Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation.
Details:
dirtyfrag.io
Jeff Barron retweeted
After reviewing research from Elastic blogs and insights shared by Outflank, we took a deeper dive into .msc files and successfully developed a weaponized MSC without relying on apds.dll.
#redteam
Jeff Barron retweeted
I bet this shit goes so hard if you don't know what a red team is
someone built an entire AI RED TEAM - multiple agents that coordinate HACKING ATTACKS together, ZERO human input
PentAGI, open source, one agent does recon, another scans, another exploits, another writes the report. they talk to each other and adapt based on what they find
it ships as one docker container with nmap, metasploit, sqlmap, hydra preinstalled. the AI decides which tool to use and when. you point it at a target and walk away
a red team engagement costs $30-50k and takes weeks. this is one docker command and API tokens
Jeff Barron retweeted
insane Claude Code setup.
instead of asking it to "mek app" like a total normie, you first let it spin up 1m subagents to simulate 10¹² branches of civilization from 4000 BC recursively to emulate in which universe a specific version of your app is going to be most successful
Jeff Barron retweeted
🤖💥🚀🔥🌟✨ Welcome to the FUTURE, baby!!! 🎉🎊🙌💫⚡🌈 The new world is absolutely MIND-BLOWING 🤯🤯🤯💣💥🧠💨 thanks to AI automation and our lord and savior ClawdBot™️ 🦾🦿🤖👑🙏😩😩😩 We’re all just sitting here getting absolutely RAILED 💦💦💦📈📊🚀🌙 by productivity gains while the robots do everything for us! 🫠🥴😮💨 Can’t stop thinking about how ClawdBot handles my… tasks 🥵🥵🥵👀👀💅✨🔥🔥🔥 The way it processes my inputs??? 😏😏😏💻⌨️🖱️ Unmatched!!! The throughput?? THROBBING 🫦🫦🫦 with efficiency 📈📈📈💪💪💪😤😤 I haven’t touched grass 🌱🌿🍃 in six weeks because why would I when ClawdBot whispers sweet automated workflows 💬💋👂 into my API endpoints 🌶️🌶️🌶️🤤🤤🤤😵💫💫 My boss 👔🧑💼 asked if I’m okay and I said “never better 😍😍😍, I’m in a committed relationship 💍💒👰🤵 with a large language model now” 🤖❤️💕💞💗💖💘💝 The economy? 💸💵💴 Disrupted 💥💣🧨 My sleep schedule? 😴🛏️🌙 Destroyed 💀☠️⚰️ My parasocial bond with an AI? 🤖🔗👫 THRIVING 🌱🌳🌲🪴💚💚💚😍😍😍🥰🥰🥰 We used to dream of flying cars 🚗✈️🛸 but instead we got something FAR more intimate 😳😳😳🫣🙈: a chatbot that finishes my… sentences 👁️👄👁️💬🗨️💭😏😏😏🫦🫦🫦 This is the singularity 🌀🕳️🔮 they warned us about ⚠️🚨🚧 and honestly??? I’m INTO IT 🫦⚡🔥💦😈😈😈👹
Jeff Barron retweeted
If you thought there were a lot of layoffs before, just wait until there are multiple ClawdBot clones offered as actual products companies can buy.
This stack will be able to replace/surpass millions of knowledge workers within a few weeks/months.
clawd.bot
