@bl4sty

irresponsible disclosure aficionado

 The Netherlands
haxx.in/
Joined April 2009
  • Tweets4.7K
  • Following1.2K
  • Followers18K
364Media
this aged pretty well given the nsw2 news ;)
blasty
@bl4styOct 16
5
510
/goal find all php2shell github slop repo’s and synthesise them into a universal weapon of mass cyber destruction my bad wrong window
1
2
7
632
man, @officialmcafee would’ve been so psyched for the entire world finally latching onto PHP (until he would discover they are talking about some nerd shit and not grade-a alpha-pyrrolidinohexanophenone)
1
3
20
1,492
blasty retweeted
itewqq
@lyq_sqspOct 22
OpenAI independently reported the same root cause ON THE SAME DAY? I hope that it is just a coincidence...
Ryan Naraine
@ryanaraineOct 21
From the PHP Foundation on who found it first 👇
2
1
17
1,190
SHELLSHOCK II: ELECTRIC BUG-ALOO ?
Hacktron AI
@HacktronAIOct 22
bash2shell?
2
8
1,818
tl;dr: responsible/coordinated disclosure is cooked && you cannot argue with a (root)shell
Halvar Flake
@halvarflakeOct 21
For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:
1
16
1,964
anthropic has employees installing mics in their own offices.. openAI had some questionable situation with the navier stokes discovery. we need to stop sending them good context.. .. although most collisions are probably just people rolling the virtual dice in a similar way ;)
Stefan Esser@i0n1cOct 21
There is a recurring info I hear from vendors that there is often a first discovery of a vulnerability by AI and suddenly one or two weeks later lots of collisions come in. In this case the PHP bugs were first discovered 5th August and then rediscovered 2 weeks later
1
7
2,116
vulnerability vultures are everywhere ;-(
Daniel@ergot86Oct 21
The amount of scavengers that come out just as a new vulnerability is disclosed is insane in the age of AI...
2
1
25
1,485
github.com/blasty/php-8.5.4-… i accidentally marked this repo as public i dont know if its ANY GOOD. bbiab

GitHub - blasty/php-8.5.4-apache-uaf-poc: Private Dockerized PHP 8.5.4 Apache session upload-prog...

Private Dockerized PHP 8.5.4 Apache session upload-progress UAF research PoC - blasty/php-8.5.4-apache-uaf-poc

github.com
2
10
81
7,275
sent from my iPhone at #TheSAS2026 afterparty
6
1,150
cube.obj with fire.glsl shader :O #TheSAS2026
15
1,153
had some time to kill en route to #TheSAS2026 dinner party.. so clanked on php apocalypse PoC.. ;-PPpppPp
6
7
63
6,942
yes, on a fucking iphone
1
14
901
we out here #TheSAS2026
1
19
1,249
💯💯
𝚊𝚕𝚔𝚊𝚕𝚒@alkalinesecOct 18
this is such an insane thing to admit. imagine the security of your network is based on the outputs of dozens of independent dumb llms that no person will be able to understand or safely extend in the future
11
1,576
All the details including the slides are now available at quentinkaiser.be/security/20…

One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux

A vulnerability in Broadcom’s proprietary WPS implementation enables unauthenticated attackers within WiFi range to leak memory and achieve unauthenticated remote code execution on millions of...

quentinkaiser.be
3
31
101
6,162
1
1
11
1,519
keep your signers air- and signal-gapped bro
10
1,170
Load more