security engineer, ex-pentester videos @AstarteSecurity - meetup https://xitter.cf/t.co/E4rlINC0U6
villa straylight
Joined November 2024
- Tweets21K
- Following2.5K
- Followers33.4K
- Likes172K
Pinned Tweet
We cover php, 4, & more on today’s episode of the GOAT security podcast @riskybusiness
youtu.be/6SIgPjQ9V1g
Has your company added security headcount due to the recent vulnerabilities (last ~6-12 months)?
i.e. hiring/hired security engineers, SOC analysts, detection engineers, etc
16%Yes
84%No
154 votes • 1 days solst/ICE of Astarte retweeted
We cover php, 4, & more on today’s episode of the GOAT security podcast @riskybusiness
youtu.be/6SIgPjQ9V1g
>junior dev at a mid startup
>wednesday morning
>just want to push a minor bugfix to our php app today
>open laptop, check slack
>company group chat is an absolute warzone
>CTO typing in all caps about php2shell
>fucking php
>whatever, server hasn't blown up yet, I just need to get my code in
>open gitlab to merge the PR
>forced emergency logout because of a critical gitlab security patch release
>fucking gitlab
>pipeline fails because of some weird regex compiler bug
>spend 40 minutes fighting CI/CD
>i can just use AI to help debug
>fire up opencode
>api keys nuked because they were breached
>fucking opencode
>i’ll just get fresh LLM api keys from our corp proxy, LiteLLM
>it won’t connect? It’s down?
>look up LiteLLM news: supply chain compromise
>fucking litellm
>cold sweat forming
>slack alert: db connection error
>check our database connection
>we host on TiDB Cloud
>they just announced a security breach, unauthorized access via stolen service account credentials, data copied
>fucking tidb cloud
>full panic attack incoming
>figure fuck it, just ship the container to Railway and go home
>open Railway dashboard
>bright red banner: "Security Disclosure: Rotate all environment variables immediately. All builds paused."
>fucking railway
>try to open the app URL in browser to see if anything is even working
>NET::ERR_CERT_AUTHORITY_INVALID
>eMudhra intermediate certificates compromised
>4
>instantly untrusted by every major browser
>fucking emudhra
>stare blankly at mac screen for 10min
>random pop-up
>restarting in 10min to fix a critical vulnerability
>fucking macos
>close laptop
>leave office
>never come back
You can just post a screenshot of a root shell with no context, get 1k likes. And it’ll be true. Doesn’t even matter what product it’s pretending to be for. CVE-9999-whogivesashit.
And companies still won’t add security headcount.
Why is Wiz taking any credit for this? Their blog post words it like they discovered it.
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
> On July 30th, the guys at Calif started auditing PHP.
> By August 11th, a researcher at Calif had discovered a way to exploit a vulnerability that could lead to pre-auth RCE and reported it to the PHP team.
> OpenAI reported the same vulnerability to the PHP team on the same day as the Calif researcher. (Was this a coincidence, or did something fishy happen? How did OpenAI discover it?)
> Then, on August 24th, the guys at Wiz reported the same vulnerability. (But all of a sudden, Wiz is posturing as though they discovered the RCE first & went into full-blown marketing mode with their SOTA AI, lmao.)
It’s a shame what the industry has become. Anyway, inform your governments to patch their websites.
solst/ICE of Astarte retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
solst/ICE of Astarte retweeted
"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."
thephp.foundation/blog/2026/…
Bunch of emails (including large customers) saying we are impacted by the php vulns, based on vibe coded scanners released overnight.
We do not use php, and this is hell.
