CTO @TrustedSec | Former Optiv/SecureWorks/Accuvant Labs/Redspin | Race cars
/tmp/.a
Joined April 2008
- Tweets67.6K
- Following5K
- Followers75.1K
- Likes145K
Based on the PoCs interested if any of these would have actually worked
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Justin Elze retweeted
The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE
Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.
Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.
Justin Elze retweeted
PHP exploitation attempts hit AWS honeypots four days before disclosure, and all we get for IOCs is six IPs like it’s 2003.
can someone put some honeypots behind finch (github.com/0x4D31/finch) or something so we get actual telemetry, at least until the @GreyNoiseIO folks get back to work?
PHP2Shell (CVE-2026-109618/109619) hit our MadPot honeypots on Oct 17, four days before disclosure.
Investigating? Start your timeline there, not at the advisory date. Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 now.
aws.amazon.com/blogs/securit…
Justin Elze retweeted
For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:
Justin Elze retweeted
People are getting free goop and they're "warning" people?
This generation makes me SICK.
I speak for everyone when I say we need the goop NOW!!!!!
LLMs...Letting me do fun things I never would have wasted time on.
"I reviewed all 30 public GitHub repos for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) by reading code only. The slide has the full
grouped table; the headline findings:
Nothing works against a real target. Every genuine memory-corruption chain is lab-bound: it needs exact per-build offsets, display_errors=On, a single prefork mod_php worker, and a specific image.
Independent reviewers (allureluoli, dinosn, Gi1gamesh123) and the leaked primary source itself all converge on "no public artifact achieves code execution" on the patched core bug. Every real shell
in these repos comes from an app-side LFI or deserialization sink, not the CVE.
Three are original and real, all lab-only. 9bie (the source of the Set-Cookie leak chain), Marven11 (the most sophisticated, a true in-band leak), and Karasawa2025 (whose "Fermat" troll description
hides a working ROP + display_errors=off exploit). These are the only ones with a genuine ASLR-defeating leak primitive that is their own.
Most are copies. One original (9bie) spawned five derivatives:
- twili8 is an outright uncredited rip-off: its own README still says git clone 9bie/... and the Docker files are byte-identical.
- godylockz and xuehuolll are byte-identical to each other.
- dinosn and 3em0 are credited ports that add value.
Three are mislabeled. iQingshan, KarimUD7 (≈98% the same code), and Gi1gamesh123 exploit a different bug entirely (the Calif unserialize var_hash UAF) against their own planted endpoints, filed
under the php2shell CVE numbers.
The rest is noise. The most-starred repo (ikow, 905★) delivers the least: broken or stubbed chains with the two "real" ones paywalled behind Substack. eness (558★) is a leakless forge that can't
defeat ASLR. syrex1013 ships AI-generated fake CVEs in a side directory. Whackermelon hallucinates a non-existent openai/php2shell-checker. lcfr-eth is a parody with a memecoin address, and Icex0
is an empty repo. The genuinely honest work is the crash labs (allureluoli, slabbdev, 0x4148), which prove the bug without claiming RCE.
The ASLR column, star counts, copy lineage, and the specific "tell" for each repo are all in the table. The page is private to your account; use the Share menu if you want to send it to the team"
Don't we have a newer branch of the armed services to deal with this?
xitter.cf/UnderSecT/status/21129…
As just announced in the @UN First Committee, Russia’s COSMOS 2612 military satellite has been exhibiting threatening behavior by intentionally maneuvering dangerously close to a commercial satellite, behaviors consistent with on-orbit weapons operations. This violates long-established safety thresholds in low Earth orbit. The United States will continue to secure and defend American vital national security interests in, from, and to space.
Justin Elze retweeted
fear not!
this is no cyberpocalypse
this is the internet’s immune system finally waking up to an illness it has always had
a mere fever
the 0days were always there
the only thing that changed is awareness
now we begin the healing process ⚕️
Justin Elze retweeted
AI is changing how we approach security research. In just 20 minutes, a language model wrote a functional script to bypass jailbreak detection. While the code needs cleanup, the speed of iteration is a game changer for automation. @Jr0dR87 #CyberSecurity #AI
Justin Elze retweeted
It's been 3 months since we made our AI-developed decompiler, Kuna, public. We are now at the top of DecBench (for C). How did it happen? How do we know it's good? Are there any fundamental improvements?
A short post on it:
noelo.org/blog/kuna-pipeline…
Justin Elze retweeted
An urgent notice from the Railway team
blog.railway.com/p/security-…
Something that gets lost in all these conversations is that there were years when a major 0day would drop and technical details were almost impossible to come by. Multiple people here would stay up for days reverse engineering the issue and stitching together a working PoC, not just to prove exploitation was possible, but to help defenders understand the actual risk, develop IoCs, build detections, and clean up compromised environments.