Let's bring your web projects to life 🚀 Founder @twopeaksdigital - Building https://nitter.gq/t.co/PQjUnGh0jI
Bregenz / Lochau
Joined February 2010
- Tweets10.4K
- Following693
- Followers547
- Likes18.4K
// tomhatzer - let's build together! 🚀 retweeted
I used to think muting people on X was how you end up with an echo chamber of your own thoughts, but I think it's essential in 2026
So much negativity and ragebait/engagement farming on here that it's just not healthy to see all the time
Will be heavily pruning in coming weeks
// tomhatzer - let's build together! 🚀 retweeted
Following the Polymarket hack via a third party JavaScript file, I figured that I should write this blog post. Our biggest weakness is me, a "single point of failure", but Fathom now has eight years of operating like this and it hasn't been an issue for us
usefathom.com/blog/how-we-se…
// tomhatzer - let's build together! 🚀 retweeted
vs. our free, open-source security tools:
1️⃣ BlockBlock alerts when the payload persists via ~/Library/LaunchAgents/com.apple.sysmond.plist
2️⃣ LuLu alerts when the payload attempts to connect to its C&C server via SSH and/or HTTP
Tools! 🛡️😇
objective-see.org/tools.html
"@PhorionTech has detected a backdoor in the official Claude Code for VS Code extension bundle on Open VSX that drops a persistent SSH backdoor across macOS, Linux, and Windows." 🫣
Read More:
phorion.io/blog/offical-clau…
// tomhatzer - let's build together! 🚀 retweeted
Full blown intrusions happening for php2shell right now, which you can watch here: php.events.greynoise.io/
It looks like the actor intends to deploy ransomware. It also looks like they have compromised other actually real victims.
// tomhatzer - let's build together! 🚀 retweeted
⚡️ 0-Day Alert: Node.js, PyPI, .NET, and others
CVE-2026-111497: Google Brotli buffer overflow to code execution
The bug is now in active exploitation via popular software that bundles brotli library.
intelligence.zerodayengineer…
// tomhatzer - let's build together! 🚀 retweeted
Finally, after deploying the most carefully crafted "please, exploit me successfully" honeypot, I can say confirmed PHP2SHELL exploitation. Which I'm thankful for, so I can move on.
// tomhatzer - let's build together! 🚀 retweeted
Wow! Big news today!
Soon Discord messages will be indexable on Google. If you're in a public Discord which is discoverable, and has not changed its privacy settings, any messages posted moving forward can be found from search engines!
Hooray!!!!!1 (I think this is very bad)
// tomhatzer - let's build together! 🚀 retweeted
Here is my 10 Minute Mac Security Checklist
It covers the min requirements to harden your Mac's security using system settings and free, open source tools
mac.0xosprey.com/
// tomhatzer - let's build together! 🚀 retweeted
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
// tomhatzer - let's build together! 🚀 retweeted
‼️ EU governments approved a GDPR change to let companies train AI on Europeans' personal data without consent.
It makes AI training a possible "legitimate interest", judged case by case. Parliament must still agree.
Max Schrems calls it a "digital expropriation" of Europeans.
// tomhatzer - let's build together! 🚀 retweeted
This delights me so very much. People using AI to take back control of devices that they bought, but were covertly designed to spy on them and harvest their data.
I'm usually reluctant to brandish my fame, but I'm gonna do it for this worthy cause. OG hacker says you're doing good! This kind of liberation is what it's all about.
// tomhatzer - let's build together! 🚀 retweeted
WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.
Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.
Firmware was locked down, so zero-days it was.
Got a root shell.
then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.
This isn’t a bug, It’s the product bro.
// tomhatzer - let's build together! 🚀 retweeted
❗️ EU governments backed a GDPR change on Wednesday that would let AI companies use Europeans' personal data without consent.
Privacy group noyb says OpenAI, Google and Meta could tap decades of collected data with almost no limits.
The European Parliament still has to agree.
// tomhatzer - let's build together! 🚀 retweeted
Here’s an early prototype of an AI designed and 3D printed electronic motor.
We used our Continuum Engine platform to produce electromagnetic, thermal and mechanical simulations rapidly for the 3D optimised model. The physical product was constructed, molecule by molecule, by our Fabricator.
The goal is to enable full products - from drones to satellites and medical devices - fully assembled from raw material by one small machine.
No supply chain fragility, entirely under one roof. Producing all electronics, motors, chassis, batteries, antennas all together, rapidly and more optimised than possible with yesterday’s machines.
We’re very close to letting you vibe code with a real-life matter compiler.
// tomhatzer - let's build together! 🚀 retweeted
// tomhatzer - let's build together! 🚀 retweeted
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish?
Expert: No, software is constantly evolving.
Philomena: So they've been writing the same website for 20 years?
Expert: No, different projects.
Philomena: Have they tried finishing one before starting another?
Expert: That's not how software development works.
Philomena: My mate Paul spent 20 years building a shed. Turned out he was just an alcoholic.
Expert: Right.
Philomena: Is PHP like that?
// tomhatzer - let's build together! 🚀 retweeted
BREAKING: eMudhra exits SSL/TLS certificate business, blames social media instead of incompetence for the same
// tomhatzer - let's build together! 🚀 retweeted
I took this opportunity to revisit and update my 2022 presentation on post-exploitation detection.
The exploit may be new, or completely different from anything we’ve seen before, but the activity that follows often fits patterns we already understand. Generic detection rules can recognize those patterns without knowing which vulnerability was used. A rule written for one incident can therefore help detect another, years later.
That’s the idea I’ve been talking about for years, and what the presentation explains in practical terms. The slides walk through how to turn an observation into a useful rule, which data you need, and why a match still needs context.
There are examples using Sigma and YARA, a look at how we apply them in THOR and Aurora, and my “Sigma Hall of Fame” with some old favourites :)
figma.com/deck/XCtQhJSlqp2rO…
We’ve been checking our PHP2SHELL detection coverage at Nextron and extending the rule set based on the published PoCs
After successful exploitation, we expect familiar activity: webshell drops, reverse shells, suspicious child processes, new user accounts… Our generic detection rules have covered many of these patterns for years, so useful coverage was already in place before disclosure.
The blog documents that existing coverage and the additions, explains what the findings can actually tell you, and includes PHP hardening recommendations.
nextron-systems.com/2026/10/…
