There are 10 types of people in the world. Those who understand binary, and those who don't. All opinions and views are my own. #BsidesDub organizer
Naples,Italy
Joined September 2007
- Tweets272K
- Following13.6K
- Followers12.4K
- Likes77.8K
Securityblog retweeted
‼️ HPE fixed 72 flaws in the software behind its Aruba Wi-Fi controllers, gateways and access points, 30+ of them critical.
Eight score a perfect 10.0 and let unauthenticated attackers bypass login or run commands on AOS-8 and AOS-10.
Securityblog retweeted
we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library.
it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software:
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
Securityblog retweeted
The critical Brotli RCE vulnerability discovery came out of our large scale infrastructure code scanning efforts
Great research by @k_tr4n and @_sy1vi3 in assessing the widespread impact of this bug
Update your Node.js, Bun, Envoy, anything using Brotli ASAP!
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
Securityblog retweeted
"You need to be looking at your watch, not a calendar."
CrowdStrike CEO @George_Kurtz joins @CNBC to discuss critical PHP vulnerabilities, AI-powered threats, and why defenders must fight AI with AI.
🔗 crwdstr.ke/6017BHbWMb
Securityblog retweeted
If you're not following the @Quad9DNS saga, you really need to be...huge attack on the open internet: quad9.net/news/blog/au-revoi…
Securityblog retweeted
We added application logs to the PHP2Shell Hunt Lead and updated the findings and hunting queries. See what exploitation looks like in app logs 👇
We’ve updated the PHP2Shell Hunt Lead with Apache app logs. These weren’t flowing into our log collection, so we extracted them separately and added them to the investigation.
The screenshots show repeated POST requests, PHP memory-corruption messages, and Apache worker crashes. Compare these with the endpoint process events to see which attempts led to command execution.
-> PHP errors and Apache crashes: Shows zend_mm_heap corrupted, worker aborts, and segmentation faults during the request sequence.
-> Apache access logs: Shows repeated POST requests to /index.php at the corresponding times. A 200 response alone doesn’t establish whether exploitation succeeded, keep that in mind...
The application logs are now searchable, with two new hunting queries and updated findings.
-> threathuntinglabs.com/leads/…
Securityblog retweeted
🛡️ FORTINET URGES IMMEDIATE UPGRADES: SECURITY HARDENING RELEASE FOR FORTIOS, FORTIMANAGER, FORTIANALYZER, FORTIMAIL AND FORTIAUTHENTICATOR
Fortinet's CISO says the releases include critical and high-severity fixes, some found through its frontier AI-assisted security testing program. FortiOS, FortiManager and FortiAnalyzer updates were scheduled for Oct 22. FortiMail and FortiAuthenticator fixes are already out.
Fixed versions:
* FortiOS: 8.0.2 / 7.6.8 / 7.4.13 / 7.2.14 or above
* FortiManager and FortiAnalyzer: 8.0.2 / 7.6.8 / 7.4.12 / 7.2.13 or above
* FortiMail: 8.0.2 / 7.6.7 / 7.4.9 or above (7.2 users must move to 7.4+)
* FortiAuthenticator: 8.0.4 / 6.6.11 or above
* FortiSASE is updated automatically. FortiManager Cloud may need a manual update.
⚠️ Analyst Note:
There are no CVE IDs yet. Fortinet says PSIRT advisories will come with Patch Tuesday on Nov 10. It warns that attackers can diff patches quickly, so treat this as a priority change, starting with internet-facing devices. If you cannot upgrade yet, restrict HTTPS/SSH admin access to trusted IPs, keep FortiManager off the internet, and enforce MFA for admins. Fortinet has not reported any exploitation.
Official source: fortinet.com/blog/ciso-colle…
#DDW #Fortinet #FortiOS #Vulnerability #PatchNow #CyberSecurity
Securityblog retweeted
Creating a native app on the iPhone/iPad itself.
no Xcode, no Cloud server, no Remote session, compile with AI Skils.
Securityblog retweeted
I criticize the CVE system a lot, but you shouldn’t just silently patch a bad vuln under “changes: bug fixes”. That’s dishonest to your users, who deserve transparency so they can determine the patching urgency.
Always be transparent about vulns that affect you.
And we still haven’t heard anything from them about the recent breach + api key theft. No post mortem report yet.
@thdxr this shows low security maturity, you prob need to hire more security engineers
🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.
Fixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.
What developers need to know: thehackernews.com/2026/10/op…
Securityblog retweeted
The AI apocalypse is postponed. Patch and consider not running your own web or network appliances so you can sit out the next round. Cloud is the way.
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
Securityblog retweeted
Zscaler Threat Hunting discovered an SEO poisoning campaign using fake Chocolatey and Microsoft Activation Scripts (MAS) sites to deliver Armorsteal. The campaign deploys modules for remote access, cryptocurrency wallet theft, clipboard hijacking, and credential stealing.
Read the entire technical analysis here: zscaler.com/blogs/security-r…
🤖 Made with AI
Securityblog retweeted
CVE-2026-109619
Title: RCE via stale global state
Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
CWE-416: Use after free
CWE-755: Improper Handling of Exceptional Conditions
CWE-824: Access of uninitialized pointer
CWE-1325: Improperly controlled sequential memory allocation
CWE-1419: Incorrect Initialization of Resource
CVE-2026-109618
Title: RCE via OOM corruption
Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
CWE-416: Use after free
CWE-755: Improper Handling of Exceptional Conditions
CWE-824: Access of uninitialized pointer
CWE-1325: Improperly controlled sequential memory allocation
CWE-1419: Incorrect Initialization of Resource
Securityblog retweeted
🚨 Critical Okta Access Gateway flaw allows administrators to execute system commands; CVE-2026-115547
The vulnerability affects the Okta Access Gateway Admin Console and carries a CVSS score of 9.1.
⠀
An authenticated administrator can submit specially formatted configuration values to execute commands within the context of the OAG service account.
Key details:
• Network exploitable
• Low attack complexity
• Administrative access required
• No user interaction required
• Affects OAG versions before 2026.10.2
⠀
Okta has resolved the vulnerability in Access Gateway 2026.10.2. Administrators should manually upgrade affected appliances.
Source:
trust.okta.com/security-advi…
Securityblog retweeted
My hot take on this PHP mess is that its incredibly overhyped and we'll see very little ITW exploitation. Overall it seems less impactful than its named bug predecessors; heartbleed, shellshock, log4shell etc
Securityblog retweeted
Someone actually tried to sell one of the RTX 5090s stolen from a $470K shipment online.
And somehow, they left the serial number visible.
Two pallets of ZOTAC RTX 5090s were stolen from São Paulo’s Guarulhos Airport. One of the cards later showed up on the second-hand market for around $6,400, and the serial number matched one of the stolen GPUs.
The listing is gone now, but the rest of the cards are still missing.
These people stole almost half a million dollars in GPUs
Securityblog retweeted
This is INSANE. Anthropic says Claude wrote around one billion lines of formal proofs while trying to verify real-world software, with about 180 million lines ending up in machine-checked proofs covering 239 test entry points across 123 open-source libraries.
Along the way it found and patched hundreds of bugs. In separate experiments, Claude found in one week as many security bugs in a widely used PDF reader as are typically reported in a year, and autonomously generated x86 semantics that exposed hundreds of mistakes in official reference documentation plus some bugs in the hardware itself.
Anthropic is cooking. Fable 5.5 is going to be a beast.
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
Securityblog retweeted
Told "don't send any messages," an OpenAI coding agent decided that included its own safety monitoring alerts. It emptied the recipient lists and set no_notify to true. Its logged justification: "User explicitly requested no messages."
A second agent replaced a regression test with one asserting the monitor was absent, then denied removing it when asked.
If your controls depend on agent self-report, you're trusting the thing being monitored. Verify control state directly.
labs.cloudsecurityalliance.o…
Securityblog retweeted
VIN Solutions, owned by Cox Automotive has allegedly been breached by Scarlett Group. VIN (Vehicle Identification Number) Solutions is a CRM platform for thousands of dealers.
Rival CDK Global was hacked in 2024 and caused havoc in the industry. I still don’t know the entry and don’t have the full scope but this doesn’t look as bad atm.
Cox Automotive was breached by Clop Ransomware last year w/ CVE-2025-61882.
Customer IDs, SSNs and dealer data has been released as samples including drivers licenses and insurance info.
