Meow. Probably the closest thing to an APT without breaking the law. 0x50 Bugchecks make me happy. VR, Kernel Exploits, Firmware Feline. Proverbs 20:17
The Nether
Joined January 2023
- Tweets7K
- Following513
- Followers4.6K
- Likes1.2K
Yeah I definitely faked the screenshot.
And mine has multiple chains.
github.com/0xdeadbeefnetwork…
_SiCk retweeted
みんなデスドルノートとかいうクソ二流ゴシップアカウントに騙されて @J4ck3LSyN を総攻撃してるのヤバい
この人は確かにモラルには欠けていたかもしれないけど、今回の PHP 騒動の直接的な原因でも諸悪の根源でもないよ……
本当に害悪度 SSS+ なのは誤情報を平気で流してるデスドルノート本人だろ
The uaf doesn't fire. Session poisoning and LFI is the winner.
my shitty prediction, mass exploitation of everything won't occur but a product or two might get pwn3d.
e.g. QNAPs as an example... or some other type of appliance with uniform configuration/hardware etc.
I don't like reading cyber tea leaves but I think it's sensible to remain grounded:
Exploit complexity
Exploit reliability
Attacker Capability/Resources/Skills
Attack Surface Diversity
Compensating Controls
Patching
Monitoring
EDR
Network egress configs
Network ingress (WAF)
all of these things play into the game of mass exploitation.
#PHP2SHELL
Bingo.
Circulating php2shell PoCs and videos are FAKE. Independent audits prove the alleged UAF does not trigger on stock PHP.
Why? The source code has a Z_TRY_ADDREF protection line that prevents the memory free. "Researchers" literally had to delete this protection line and recompile PHP to get their "verified" RCE.
The real risk remains application-level: LFI + Session Poisoning.
Source code proof & audit:
🔗 github.com/jaiswalakshansh/R…
Still patch & mitigate: Disable session.upload_progress.enabled and update to PHP 8.4.27+. Don't panic, verify. #CyberSecurity #PHP #CVE
for those curious since i woke up; the fucking exploit doesn't target FPM which is sitting behind your httpd
nginx in this case has FPM bound to 127.0.0.1.
this means that you'd need to have your FPM port reachable by the exploit which doesn't happen on nginx.
the exploit yaps in raw fastcgi.
LAN? Doable.
Point at nginx and pop a shell? Not yet.
Probably a good idea. I didn't release mine. The screenshot is a warning. I hope all of you stay safe. It's a weird world. 🌍🌪️💔
Genau deshalb ist "wir patchen nächste Woche" keine Strategie. ⚠️ Codeausführung als www-data auf einem frischen 8.5.12-Build. Wer #PHP betreibt: jetzt WAF-Regeln setzen, sofort patchen und Zugangsdaten wechseln. 🔐
_SiCk retweeted
Quick reminder: releasing an exploit isn’t hacking. Courts have treated code as speech for 25+ years, and the CFAA punishes unauthorized access, not publication. Open source ships “AS IS” with zero warranty, too. The law is not the problem here.
Publishing exploit code is not a crime in the US. Code is protected speech (Bernstein, Junger), there’s no federal law against releasing a vuln, and the CFAA covers accessing systems you don’t own, not writing about bugs or releasing code. Law’s on the side of the researcher.
If you wanna lose a 1A case and pay me you're welcome to take that fuckin' L. I'll walk out of that court room owning your MANGA collection.
No Such Accuracy.
Patch what? :)
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Heap ASLR Defeat? In the current PHP version?
Old CVE from 2019?
*MISSEDFIX*
github.com/0xdeadbeefnetwork…
🥰😂😂😂😂😂
CAs when creating their private keys
youtu.be/u8ccGjar4Es