@LiveOverflow

wannabe hacker... he/him 🌱 grow your hacking skills @hextreeio

 Internet
youtube.com/LiveOverflow
Joined March 2015
  • Tweets10.3K
  • Following1.3K
  • Followers164K
2.2KMedia
Where to find me: 🔴 Hacking Videos: youtube.com/LiveOverflow 📜 Articles: liveoverflow.com 💻 Start Hacking? liveoverflow.com/start-hacki… 🥰 Support: liveoverflow.com/support 📹 2nd Channel: youtube.com/LiveUnderflow 🤳 Instagram: instagram.com/liveoverflow
15
107
1
650
Made a quick video (aka 5h of work), about my experience racing to find php2shell. youtube.com/watch?v=7CiZmq2l…

The race to the first exploit // php2shell

I used Codex and the hints from Calif's public demo to try to redis...

youtube.com
3
14
2
106
5,635
I also wanted to make this video to document an AI/Codex workflow in October 2026. Let's see how different it will be in a few months from now :D
4
818
LiveOverflow 🔴 hextree.io retweeted
Stefan Esser@i0n1c9h
Omg I found a copy of the original memory_limit advisory. marc.info/?l=bugtraq&m=10898…
7
29
5
192
27,012
LiveOverflow 🔴 hextree.io retweeted
Anthony Ronning
@anthonyronning13h
Replying to @maxious
Very strange how this keeps on happening
8
22
12
464
96,619
LiveOverflow 🔴 hextree.io retweeted
SinSinology
@SinSinology9h
To teach a lesson, After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again. A big budget can buy a domain. It shouldn't buy someone else's research credit. If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve. Hack the planet. Credit the researchers.

phpbleed

Welcome, Wiz. Beat you to the checkout.

phpbleed.com
41
193
23
1,211
87,912
I don't know the php ecosystem. Is this useful for anything? This fell off the clanker-train while looking for php2shell
6
2
158
21,176
I think it's useless and wanted to just share PoC. But just in case there is some system running untrusted PHP, I thought I'd better ask.
2
6
3,840
Official update instructions recommend a third-party provider that adds telemetry? 🤨
27
17
4
385
43,836
LiveOverflow 🔴 hextree.io retweeted
LCFR
@lcfr_haxSep 23
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac (posted in august) (related) 8da579ec498d57c20977c8d186d7f6cd4c04f46ffa1b436dd646ec19b99bdf47 cb4c8532c245ff7e05d6e270fca5742bb3271f541ef80f0071ca3d4307eb2b53 957f8cc21b18483f80a9d723aa4f9ded26e456424ffd065a044d1ed9d58a4fbc 4f93976ef105f0d9ff2d60f35d48958c8bba9d9eb2873cd93b3f7105fa4716a6
Justin Elze
@HackingLZSep 23
Despite all the doom and gloom from InfoSec we are how many months are into people throwing endless tokens at various OSS projects? Hows Apache? Nginx? OpenSSH doing? Any public point and shoot RCEs in RDP/SMB in Windows? All of the above technology getting wrecked in the wild?
25
9
2
164
59,168
There we go wiz.io/blog/php2shell-php-rc…

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog

Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.

wiz.io
4
47
5
375
28,415
close
3
8
4,191
I don't think this is real? Or it's a different issue? Did anybody check this properly?
Jλckλι@J4ck3LSyNOct 21
... get it while its hot... 😈 > CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x) > session.upload_progress UAF > jackalsyn.com/posts/php-up-2… > Courtesy of Me, @acd421 & @Archknight23 #CyberSecurity #infosec #php2shell #php
14
3
48
15,505
more replies
this is what I got
2
1
4
3,053
As far as I can tell, I am just missing an ASLR leak. Anybody got that?
4
1
4
2,301
“jUsT mOniT0r whAt tHE aGenT tHinKs aBouT”
3
4
125
16,886
1000% OpenAI is doing this. It refuses even to setup fuzzing in the related area. I am wondering if you can use the guardrails as an oracle to figure out where the vuln is 🤔 But I have to go to bed now. So reply with any findings pls so I can read in the morning. kthx
LiveOverflow 🔴 hextree.io
@LiveOverflowOct 20
A prompt like this would never be refused by Daybreak blue before. I am wondering if OpenAI set guardrails specific to this vuln to slow down rediscovery.
12
6
1
121
15,269
okay update. relogged, and it's working now. sorry false alert. don't know what happened though. Literally before that and in parallel I was doing other exploitation work and had no guardrails hitting there.
1
11
1,444
A prompt like this would never be refused by Daybreak blue before. I am wondering if OpenAI set guardrails specific to this vuln to slow down rediscovery.
LiveOverflow 🔴 hextree.io
@LiveOverflowOct 20
pov: somebody drops a video with a critical 0day for the lulz and you try to fix it
16
5
2
171
28,976
Load more