Founder @Binary_Defense @TrustedSec. @WeHackHealth Pod. God + Family/Hacker/CSO/USMC/Intel/Fitness. Make the world a better place.
Fairlawn, OH
Joined July 2009
- Tweets59.2K
- Following6.3K
- Followers234K
- Likes206K
NightBeacon on what we are building over at @Binary_Defense on the agentic SOC side has a component that I'm insanely proud of what we call Scout Forge.
Every new alarm, data, log source - gets interrogated in how we can improve detections, log source identification, and more. Every packet we get into NightBeacon makes it smarter every single time.
We train our own models, and each week its exponential improvements in identifying threats across all of our customers.
Due to this, our response time is now hitting sub 3 minutes to identify, sub 5 minutes to resolution. That's only going to get better.
#BinaryDefense
Dave Kennedy retweeted
18 months after Trimarc joined TrustedSec, the work speaks for itself. In our new #blog, Identity Security Architect @PyroTek3 reflects on Trimarc’s integration into TrustedSec and what it means for customers, services, and ongoing research. Read it now! hubs.la/Q04C18Yy0
Dave Kennedy retweeted
Tomorrow’s the day! Catch Senior Security Consultant @InfoSteph1 moderating “Zero Day, Zero Limits: Women Leading Cyber” at @ThreeRiversISec in Pittsburgh at 1:00PM. Add it to your schedule! hubs.ly/Q04BWYMV0
Dave Kennedy retweeted
Last @ISC2 Cleveland Chapter meeting of the year—and what a topic to end it! Join us next Tuesday from 5:30-8:00PM at TrustedSec HQ for Matt Lee’s presentation, “Giving Swords to Our AI Overlords.” Register now! hubs.la/Q04BZ3NX0
Dave Kennedy retweeted
GPT-Rosalind surfaced a new lead for drug discovery: could restoring cholesterol transport protect neurons from degeneration?
DCTN1 is a gene linked to Perry syndrome, a rare neurodegenerative disorder. In mouse-brain data, disrupting it increased expression of genes involved in making cholesterol. GPT-Rosalind suggested a possible explanation: cholesterol may not be reaching where neurons need it.
That gives scientists a specific mechanism to test and, if confirmed, a direction for developing new treatments for neurodegenerative disorders.
With @perturbai_tx and @scrippsresearch, a team of thousands of GPT-Rosalind agents worked in parallel, connecting gene-expression results from millions of mouse brain cells with scientific literature in just 32 minutes. We’re now expanding this collaboration to identify new drug targets.
openai.com/index/scaling-ai-…
Dave Kennedy retweeted
Two critical PHP vulnerabilities (CVSS 9.2) were disclosed today, allowing unauthenticated RCE on default configurations.
To help everyone patch fast we are making images for PHP 8.2, 8.3, 8.4, and 8.5 free for anyone to use. You can access them here: images.chainguard.dev/direct…
Coordinated disclosure is hard, we appreciated everyone's help as we worked through this over the last several days.
Readers added context they thought people might want to know
Chainguard published patched PHP images at 07:41 UTC on Oct 21, over 6 hours before the coordinated release, per the PHP Foundation.
thephp.foundation/blog/2026/10/2…
php.net/archive/2026.p…
Dave Kennedy retweeted
BREAKING: The FDA just granted accelerated approval to the first immunotherapy for a leading cause of cancer death in U.S. men under 50. This therapy allows certain patients to skip radiation, chemo, and surgery altogether.
Thinking about creating a special holiday @Binary_Defense - a "Yeet to Prod Day".
Thoughts? (this is a joke)
🤖 Made with AI
Came into the gym and found that my son was using barbell clamps/collars on the smith machine.
Def going to have to talk to this boy, can't have that on the smith.
Dave Kennedy retweeted
Happening at 1:00PM TODAY! Director of Advisory Innovation @rockiebrockway is navigating the #AI framework landscape and unveiling TrustedSec’s new AISec Performance Maturity Framework. Last chance to grab your spot—register now! hubs.la/Q04BQJzv0 #webinar
Dave Kennedy retweeted
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
Dave Kennedy retweeted
Teamwork makes the dream work.
The team and I
@J4ck3LSyN @Archknight23
🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow.
The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.
📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up.
PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act.
Here's the part the big threat-intel shops aren't shouting about:
No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling:
🔹 Present since PHP 5.4
🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live)
🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config
That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands.
✅ What to do right now:
1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade.
2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess:
session.upload_progress.enabled = Off
Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths.
3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.
4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today.
Why I'm posting this for free:
A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response.
I'll follow up once the official advisory publishes and confirm whether my root cause read was right.
Stay patched. 🔒
#PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec
This quoted post is unavailable.
Dave Kennedy retweeted
Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.
Dave Kennedy retweeted
Another chance to catch our Founder and CEO @HackingDave on stage! He’s keynoting at @BSidesColumbus, Friday, November 6 at 9:00AM. Don't miss “This Talk Was Written by AI;” be sure to add it to your schedule! hubs.la/Q04BNqWf0
Dave Kennedy retweeted
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
