A Technology Journalist and cybersecurity professional. I have a mission to remove the marketing-speak from the information people receive in their news.
Joined July 2010
- Tweets40.1K
- Following620
- Followers2K
- Likes97.4K
Pinned Tweet
Shape the battlefield with what you have.
Cybersecurity is (almost) always a logistical conversation first, followed by tactical and strategic decisions based on that.
Most people would probably be shocked at how well a small team can shape the battlefield to devastating effect against an opponent.
Bits, Bytes, and Bourbon retweeted
How many times have people claimed the cyber world will end because of an exploit?
The only real time I got literally out of my chair was wannacry … I had seen MSBLASTER in 2003 and written a response routine as the org I was in was 50 percent down for 3 days ish…. I was allowed on the Friday to run my crappy code and we cleaned the place up very rapidly!
With wannacry I was like: smb worm 🪱 that encrypts…. That fucking terrible.
I was in a Michellin star restaurant with T and friends and then a message came in saying: Dan we need you here…
I then shot off to grab my kit then head to an nhs trust……
That’s not to say the others weren’t and aren’t important (they are)
Log4j was a bloody mess….
This game is complex as fuck.
Now I am even more sad I didn't win the lottery for this one :(
Is this new Elmer T. Lee 40th Anniversary bourbon from @BuffTrace and good or is it all hype? Let’s find out!
Bits, Bytes, and Bourbon retweeted
who remember HAFNIUM?
who remembers MSBLASTER?
who remembers WANNACRY?
who remembers LOG4SHELL?
who remembers {INSERT SOME OTHER NAME}
guys: this is the job! in 10 years time there will be more names to add to the list, and then in 10 years after that... even more.
This is the game!
Bits, Bytes, and Bourbon retweeted
Confusingly written... Article says you've seen PoCs and observed post-exploitation activity. The queries even have a note saying they aren't specific to CVE-2026-109618 and CVE-2026-109619... So this looks like evidence a web server running PHP was compromised, but not necessarily via exploitation of these CVEs?
Bits, Bytes, and Bourbon retweeted
Good news for once...A variety of factors make this annoying for attackers.
xitter.cf/JohnHultquist/status/2…
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
Bits, Bytes, and Bourbon retweeted
'We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.'
#PHP2SHELL #EndOftheWorld (the last hashtag is a joke ;) )
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
Bits, Bytes, and Bourbon retweeted
I keep hitting refresh here where is the PHP vuln?
cisa.gov/known-exploited-vul…
Bits, Bytes, and Bourbon retweeted
There's a massive problem that's been created by AI and I don't think it's the one the AI orgs and 'influencers' have been saying....
I'm tired.... but the sloppening is a thing....
it's insane.... it's not helpful.
I think it's causing issues.
Bits, Bytes, and Bourbon retweeted
Really important:
'Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.'
Backporting is a thing..... there's a lot of claims this week:
> PoCs that are nonsense
> Identification of things that is very questionable
So just a heads up! No one has an all knowing, all seeing view! (that doesn't mean you should fall to FUD)
Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment:
1. Discovery with Nmap
Common and alternative web ports; HTTP headers that may expose PHP versions:
nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true' <target>
Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.
2. Huntress: Monitoring and detection
• Confirmed facts and remaining questions
• Suspicious PHP child processes, shells and downloaders
• Webshells and other post-exploitation activity
• My process-watcher for Linux process visibility
huntress.com/blog/php2shell-…
3. Vincent Schmalbach: Hardening and patching
• Temporary nginx/Apache filters and upload-progress settings
• WAF/origin bypass checks
• Package and backport verification
• PHP-FPM/worker restarts, container rebuilds
• Side effects and checks for compromise
vincentschmalbach.com/cve-20…
Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.
Bits, Bytes, and Bourbon retweeted
Is 70% of the world hacked? The only entity I've seen say they have confirmed successful exploitation in the wild said they found it at one victim, and then within hours revised the report to say zero.
