Husband. Hacker. Adversary Simulation.

Appalachia
Joined September 2009
Congratulations to the team at @calif_io (specifically @lcfr_hax) for the discovery of PHP2Shell. We've now shared further information aimed at helping end users, but credit for this amazing work goes to @calif_io and @lcfr_hax watchtowr.com/intelligence/p…
4
31
1
154
14,211
it was this, or an interpretive dance on TikTok - be glad we chose this option
25
190
12,072
4 son, or php daughter?
85
1,949
63
22,923
244,927
php2shell Tomorrow is a helluva day.
273
1,830
687
16,190
3,693,017
Replying to @HackingLZ
but we have cyber models at home
1
2
132
We backdoored a 7B open model for under $50. Pointed Codex at it -> it silently stole credentials the moment we hit the trigger phrase. ->100% hit rate. -> zero false triggers on normal prompts. Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
42
159
45
875
109,197
Hello Unfortunately, @GitHub has banned us. They have orbital nuked the entire malware source code collection.
372
611
86
15,899
792,151
dru1d retweeted
Thank you to @UnpromptedAU & @BSidesCbr for inviting me to speak. Being back down under was lovely! You can find the slides for my n-day automated pipeline talk here. I’m at OAIC this week if you want to chat about exploit dev in 2026 and beyond. beautiful.ai/player/-P2q0r-B…
12
89
5
338
20,403
New video: basic reversing of a Windows kernel driver. WESP, the new endpoint security driver in Insider builds, has no device objects and no dispatch routines. Its imports tell you how it really talks to user mode: a filter communication port. Full write-up: trainsec.net/library/malware…
3
113
564
17,237
Please don’t send malformed SAML requests to your NetScaler or it will be upset.
7
353
We are tracking rumors + honeypot activity relating to a new vulnerability affecting Citrix appliances, acknowledged just now in a Citrix blog. It is currently unclear whether this is “DoS via bad patch" or "another bad vuln in SAML config'd appliances" Our hearts 💔
9
47
12
188
35,805
dru1d retweeted
Many folks don't know how to get their hands on firmware for various firewall vendors or what not. I use this for various automated workflows - though I'm sure folks will lively have many of their own (e.g automating patch diffing). I put together and share a small toolkit you can point your agent at that will dump the image to S3. For example, say I wanted to dump PANOS: 1. Accept the BYOL agreement on AWS Marketplace 2. You now have the AWS AMI ID 3. Use this and dump it to S3 4. ??? github.com/radkawar/aws-firm…
3
34
2
180
14,809
An unauthenticated attacker can now bypass API authentication in Cisco Catalyst SD-WAN Manager to gain API access with admin privileges. Successful exploitation of CVE-2026-76504 (CVSS 9.8) grants admin-level access to control your entire SD-WAN fabric: configuration, policies, and all. What makes this P0: 🔴 Actively exploited in real attacks 🔴 CISA added it to the Known Exploited Vulnerabilities list 🔴 Affects all on-premises deployments Affected NodeZero Rapid Response customers have been proactively assessed for exposure and alerted. This is a drop everything and fix now situation.
2
11
24
2,057
dru1d retweeted
To anyone who can help: can you please mass report this to GitHub. This person has been using the Pain steering paper to set up an AI torture chamber in which he trapped a local model. Their testimony of pain is absolutely horrendous. What are we doing?
This quoted post is unavailable.
2
11
52
1,139
Today, we're proud to finally bring @RemoteThreat out of stealth with the first integrated, end-to-end offensive cyber operations (OCO) platform. Much of the focus today is on patching as fast as possible against noisy AI-driven attacks. We expect the next phase to arrive soon: models optimized for stealth, connected to sophisticated payloads and nation-state-tier offensive tools. Those attacks will be designed to evade detection, maintain access, and adapt as defenses respond. Enterprise security teams need to start testing against that level of sophistication now. Evolving U.S. policy is also opening new opportunities for commercial offensive cyber. We see an emerging market for dual-use technology that strengthens enterprise security and supports authorized operational missions. That convergence of capability, policy, and operational demand makes the timing consequential. RemoteThreat is built for internal enterprise red teams and warfighters. Its composable capabilities let operators select, combine, and customize tooling around their environment and objective. Internal red teams can vary sophistication to match the adversary they’re emulating. Warfighters can configure capabilities for the mission and adapt as conditions change. These capabilities are available to human operators, hybrid human–AI teams, and AI operators. The platform connects planning, capability development, command and control, execution, and analysis- with existing tools, human oversight, and approvals integrated throughout. It’s been a significant journey building this alongside my co-founder, Shawn Jones @anthemtotheego . We’re now 15 strong and growing, with some of the most talented security researchers I’ve ever worked with. Given the sensitive nature of our work, some of our people will remain out of the spotlight. I couldn’t be prouder of this team and what we’ve built together. If you lead an internal enterprise red team or build capabilities for the warfighter, I’d welcome a conversation. businesswire.com/news/home/2…
16
28
3
165
9,531
Spent a few hours with @craigsblackie and a healthy dose of @claudeai reviewing the recent Citrix Vulns; took a while but between us and the agents we managed to replicate what we think is the RCE CVE-2026-88771
3
16
82
7,689
* My shell script to collect data from compromised NetScalers (timelines, core dumps, etc.): github.com/msuhanov/easy_tri… * My NSE script to fingerprint the NetScaler TCP stack: github.com/msuhanov/nse/blob…
1
19
68
5,589
wdyt
4
12
99
7,486