𓀮 Ex-Pharaoh Vtuber 𓇤 Creator of VTS Face2Face & Medjed 🎤 Aspiring Vocalist https://xitter.cf/t.co/MSaRSYl2A3 https://xitter.cf/t.co/5UxZ8RUnks Model Mom @StudioNekoyama
Joined May 2024
- Tweets3K
- Following323
- Followers919
- Likes6.6K
Pinned Tweet
PUBLIC SERVICE ANNOUNCEMENT FROM YOUR LOCAL CYBER SECURITY SPECIALIST
For those who don’t know what this recent PHP security vulnerability means:
This affects most public facing websites.
These vulnerabilities can allow someone to gain access to most websites and their hosting server. That could give them access to sensitive information and/or creds. That is a serious problem.
Companies are working on patching this immediately. But if someone already got in, patching the vulnerability isn't enough. Backdoors could still be there and you can't take back already stolen data.
The part I am most concerned about. Do these companies have the knowledge, staff, and information needed to properly investigate whether someone got in before they applied the fix? Most don't.
You are going to hear things like "your data was encrypted" this does not automatically mean it was safe. If someone controls the service that can decrypt that information, or the attacker has plenty of time and resources on their hands, the information can be decrypted.
This can also affect apps and other services that rely on these connections. How far an attacker can get depends on what those servers can access and how well the company has separated its systems. From many years of experience, most companies don't have good security posture.
FOR THE REGULAR NONTECHNICAL PERSON:
Don’t assume every account you have was hacked. This is a REALLY good time to pay attention and get your account security in order.
SO:
Keep an eye out for breach notices and unusual login activity. If you get an unexpected message telling you to reset your password, go to the company’s website or app directly. Don’t blindly trust or click links in emails. Fake security warnings will ramp up to take advantage of peoples fear.
Stop reusing passwords, ESPECIALLY THE SAME PASSWORD OR A VARIATION OF IT. Use a different password for each account, and turn on multifactor authentication wherever possible. Start with your email. If a company tells you your password was exposed, change it there and anywhere else you used the same or a similar one.
Being a regular person does not mean you’ll be ignored. A lot of account attacks are automated. Someone doesn’t need to know who you are to try your and a thousand other peoples stolen login on a hundred other websites simultaneously.
If you have ANY questions or need any help what so ever please let me know.
I've poured every thing I've learned in my lifetime into a single art project that has taken a 1.5 yrs to make.
Come watch them crash into walls in Cyberpunk 2077 tonight @ 6 PM PST
Singing requires you to be relaxed and confident.
Both things I am notoriously bad at.
Worked with @hootvt to make the band shirts.
I also have a merch store I never talk about! Go check it out, link in the comments.
Xil 𓆣 Ex-Pharaoh 𓂀 VTuber 𓆣 retweeted
GOING LIVE NOW ON THE PURPLE SITE WITH A SUDDEN NEW MODEL DEBUT!!!
SOUPCAT FOR CLAN MEDICINE CAT RAH! CANT WAIT TO PLAY THE WARRIOR CAT GAME ON RELEASE DAY!
LETTING OUT MY INNER FURRY AWOOO! *werewolf ripping shirt open*
#warriorcats #vtuber #debut #Cat #mascot
Since I got a rapid influx of followers -
Welcome new followers!
I fight cybercrime during the day, and am a streamer by night!
If you followed me because you wanted to stay informed on cyber security news, updates, and happenings. You will be disappointed.
I work on neat technical projects on my free time, like designing my own locally hosted, ethically sourced, AI entertainer that streams with me and I'm always happy to answer any and all curious questions regarding cybersecurity, philosophy, or AI.
If you followed me because you thought my post about the PHP2Shell vulnerability was articulate and elegantly worded. You will be disappointed. That was my work mode voice, it is rarely used beyond the white walls and fluorescent lights of the basement where I am contractually obligated to stay.
If you followed me as a thank you, thank you!
I stream every Monday and Sunday at 6 PM PST with my AI co-host Medjed.
If that sounds like a good time, come check us out!
Thank you all again for the follows and support, stay safe!
I’ve answered everyone I can for tonight. If you still have questions, check the comments first to see if your question as already been asked. If it hasn’t or you want clarity, comment and I’ll check back in the morning to answer.
PUBLIC SERVICE ANNOUNCEMENT FROM YOUR LOCAL CYBER SECURITY SPECIALIST
For those who don’t know what this recent PHP security vulnerability means:
This affects most public facing websites.
These vulnerabilities can allow someone to gain access to most websites and their hosting server. That could give them access to sensitive information and/or creds. That is a serious problem.
Companies are working on patching this immediately. But if someone already got in, patching the vulnerability isn't enough. Backdoors could still be there and you can't take back already stolen data.
The part I am most concerned about. Do these companies have the knowledge, staff, and information needed to properly investigate whether someone got in before they applied the fix? Most don't.
You are going to hear things like "your data was encrypted" this does not automatically mean it was safe. If someone controls the service that can decrypt that information, or the attacker has plenty of time and resources on their hands, the information can be decrypted.
This can also affect apps and other services that rely on these connections. How far an attacker can get depends on what those servers can access and how well the company has separated its systems. From many years of experience, most companies don't have good security posture.
FOR THE REGULAR NONTECHNICAL PERSON:
Don’t assume every account you have was hacked. This is a REALLY good time to pay attention and get your account security in order.
SO:
Keep an eye out for breach notices and unusual login activity. If you get an unexpected message telling you to reset your password, go to the company’s website or app directly. Don’t blindly trust or click links in emails. Fake security warnings will ramp up to take advantage of peoples fear.
Stop reusing passwords, ESPECIALLY THE SAME PASSWORD OR A VARIATION OF IT. Use a different password for each account, and turn on multifactor authentication wherever possible. Start with your email. If a company tells you your password was exposed, change it there and anywhere else you used the same or a similar one.
Being a regular person does not mean you’ll be ignored. A lot of account attacks are automated. Someone doesn’t need to know who you are to try your and a thousand other peoples stolen login on a hundred other websites simultaneously.
If you have ANY questions or need any help what so ever please let me know.
I was really scared people would start flaming me for fear mongering or being alarmist but you have been asking really good questions and suspiciously nice for people on the internet.
Thank you all so much. I have to step away but I'll return to answer questions in a bit.
PUBLIC SERVICE ANNOUNCEMENT FROM YOUR LOCAL CYBER SECURITY SPECIALIST
For those who don’t know what this recent PHP security vulnerability means:
This affects most public facing websites.
These vulnerabilities can allow someone to gain access to most websites and their hosting server. That could give them access to sensitive information and/or creds. That is a serious problem.
Companies are working on patching this immediately. But if someone already got in, patching the vulnerability isn't enough. Backdoors could still be there and you can't take back already stolen data.
The part I am most concerned about. Do these companies have the knowledge, staff, and information needed to properly investigate whether someone got in before they applied the fix? Most don't.
You are going to hear things like "your data was encrypted" this does not automatically mean it was safe. If someone controls the service that can decrypt that information, or the attacker has plenty of time and resources on their hands, the information can be decrypted.
This can also affect apps and other services that rely on these connections. How far an attacker can get depends on what those servers can access and how well the company has separated its systems. From many years of experience, most companies don't have good security posture.
FOR THE REGULAR NONTECHNICAL PERSON:
Don’t assume every account you have was hacked. This is a REALLY good time to pay attention and get your account security in order.
SO:
Keep an eye out for breach notices and unusual login activity. If you get an unexpected message telling you to reset your password, go to the company’s website or app directly. Don’t blindly trust or click links in emails. Fake security warnings will ramp up to take advantage of peoples fear.
Stop reusing passwords, ESPECIALLY THE SAME PASSWORD OR A VARIATION OF IT. Use a different password for each account, and turn on multifactor authentication wherever possible. Start with your email. If a company tells you your password was exposed, change it there and anywhere else you used the same or a similar one.
Being a regular person does not mean you’ll be ignored. A lot of account attacks are automated. Someone doesn’t need to know who you are to try your and a thousand other peoples stolen login on a hundred other websites simultaneously.
If you have ANY questions or need any help what so ever please let me know.
Xil 𓆣 Ex-Pharaoh 𓂀 VTuber 𓆣 retweeted
Good morning cuties. With all the PHP security news today, I want to mention something for anyone going
Oh, I don’t use PHP, I’m fine.
If you’re on shared hosting, your neighbors on that server might use it. If someone gets into their site and the host hasn’t properly set up isolation, then yours could get caught up in it too.
Does that mean you’re automatically vulnerable? No. But check in with your hosting provider and ask about their patch plan. 💙
Xil 𓆣 Ex-Pharaoh 𓂀 VTuber 𓆣 retweeted
ごめん、PHPの脆弱性は確かに深刻で、日本中の企業が今本気で対応してくれてるんだけど。
個人はこっちの方がほんまに緊急で。驚き屋とかじゃなくて、ガチでヤバいねん。
ちょっと、意訳されることを覚悟で、分かりやすく言うから、全員対応してくれ。
まず、ウェブサイトが信用できるかどうかを判断する「電子証明書」っていうのがあるんだよ。
で、その電子証明書っていうのは。
信用できるサイトにしか発行されないようになってて。
例えばですけど、銀行サイトのフィッシングサイトとかを作ったとしても電子証明書取れないんで、
そういうのを踏んだ時に、ブラウザ側で、これ偽物のサイトっすよ。やばいっすよ。
っていう警告を出してくれるものなんですね。
※まぁ、ブラウザだけで検証出来ない時代になってはいるから本件とは関係なくすでにわかんないんだけど…
この電子証明書が機能してるから、ウェブサイトの安全性が担保されてるんですよ。
で、その電子証明書を認証するっていう組織が何個かあって。
うん、このサイトはちゃんとしたサイトだね。
OK、電子証明書発行しますっていう認証局。
これはたくさんあって、世界中にあるわけ。
そんで、この認証局を運営するインドの会社eMudhraがマジでありえないぐらいのやらかしをしてて。
本来だったら複雑にしておかないといけない。この認証局の秘密鍵。これがびっくら驚き。
秘密鍵8本が4、56、66、115、155、156、230、237だったのよ。
本来は最大約116桁にもなる巨大な範囲からランダムに選ぶ必要があるのに。
つまり、このサイトはOKですよっていうハンコを押すのがめっちゃ簡単に出来るようになっちゃったのよ。
これが何を意味するかっていうと。
詐欺師とかハッカーとかが、訳のわからないフィッシングサイトを完全再現して量産。
銀行サイトとか仮想通貨の取引所とか、株式口座のサイトとかを作ったとするじゃん。
こういうのは本来電子証明書にハンコが押されないから、みんな騙されないんだけど。
インドマンのやらかしで。ハンコを押し放題になったのよ。
ということは、どんなフィッシングサイトでもブラウザ側が安全だって誤解しちゃうようになっちゃってるんだよ。
OSとブラウザを更新すると直るんだけど、ブラウザ以外のアプリケーションも影響するやつあるから。
リプライにもう1個貼るから、そのポストを見て、AIエージェントに自分のパソコンの中とかに脆弱性がないかっていうのをきちんと確認させてほしい。
詳しく言うと、さらにやばいことがいっぱいあるんだけど、もうざっくりそんな感じや。
最新のOSと最新のブラウザに更新してないネットは、もう今完全に魔界です。
PHPとは別件ですが、とにかく全員今すぐ引用元のとこに貼ってるサイトにアクセスしてみて、赤文字が出たらマズいと思ってください(画像の通り、私はマズかったです)
事の発端とかは全部省略して何がマズいのかを簡単に言うと、「悪意ある攻撃者が、自分が所有していないgoogleや銀行のドメインとかについて、暗号学的に正しい署名を持つ偽証明書が作れちゃう」ってこと。
これができると何がマズいのかといえば、DNSの改ざんとか経路の乗っ取りとかで接続先をすり替えることが出来た瞬間に
・HTTPS通信の盗聴と改ざん
・ログイン情報、Cookie、APIトークンの窃取
・正規サイトを装った偽コンテンツの配信
・ソフトウェアのダウンロード内容やAPI応答の改ざん
が全部できちゃうって感じ
つまり「偽サイトが、暗号学的に正しい証明書を使用して、正規の手順で、本当のサイトになりすませる」ってこと
実際に攻撃が行われたかってのは分かってないけど、とりあえず赤文字が出たら非常に脆弱な状態にあるってことは確かなので、まず確認し、赤文字が出たらOSとかBrowserとか全部更新してください
それこそAI Agentに聞いてもOKです
PHPは企業とかに対する問題だったのであれば、こっちは個人で対処しないとダメな問題なので、今すぐ更新とかによる確認を！(特にEdgeユーザーは要チェック)
Also please buy a drink for your nearest cyber security experts. They are going to need it. A lot of it.
Might as well remind people.
I get paid to work with nation state actors in digital forensics, malware analysis, exploit prevention and testing.
Most of my life has been spent working with (or against) the most talented hackers on earth.
If you have any questions LET ME KNOW.
My god.
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.
Xil 𓆣 Ex-Pharaoh 𓂀 VTuber 𓆣 retweeted
People are sleeping on Wave Link for mic audio. You don't need to complicate your setup with VoiceMeeter or a DAW. If you already know how to set up your mic filters in OBS, you can do the same in in Wave Link and route the audio to OBS, plus it supports VST3 plugins
Reminded me of my lifelong pet peeve.
Any other tall finger peeps out there feel the pain of transforming into a merfolk?
Thank you raiders!
Handsomest of lads, foolest of fellows, it's @CFowl_TTV
Baron of insane keyboard aesthetics and forgot what they put in the microwave, it's @EPvtuber
Would give Faker a run for their money, we raided the rift legend herself @moonbugvt