Head of Offensive Security @xorasecurity Previous: @bishopfox Red Team @risk3sixty Pentest Practice Lead
Joined March 2020
- Tweets2.3K
- Following222
- Followers1.9K
- Likes1.4K
Ryan Basden retweeted
‼️ BREAKING: eMudhra, the Indian certificate authority whose private key was the number 4, is quitting the TLS business.
It blames social media for scrutiny "out of proportion" to a unit worth ~1% of revenue.
8 of its CA keys were numbers below 256, cracked in milliseconds.
Everyone go home, TryHackMe got the first legit POC.
/s
🚨 Yesterday, PHP2Shell made headlines. Today, we're already teaching you how to exploit it. Yeah, we're THAT fast⚡ Two critical PHP vulnerabilities. 9.2 CVSS. Unauthenticated RCE.
And you can already exploit the chain, bypass ASLR, and pop a shell in our latest recent threat room.
Hackers don't wait. Neither do we 🟢 Go Get hands-on: tryhackme.com/room/cvephp2sh…
Ryan Basden retweeted
Whoever is running around doing community notes
xitter.cf/rafalohaki/status/2113…
Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619).
Pure logic bug — no memory corruption,
ASAN-clean, orthogonal to the CVE-2026-109618/19 class.
Receipt: uid=33(www-data) over HTTP, one-shot
#infosec #php2shell #php
Readers added context they thought people might want to know
The claimed RCE on fully-patched PHP 8.5.12 requires a custom lab app with a destructor gadget plus deliberate session.serialize_handler mismatch (php_serialize writes, legacy php reads) and non-default settings like cleanup=Off; this is an app flaw, not core PHP RCE.
github.com/rafalohaki/php…
php.net/manual/en/sess…
Ryan Basden retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
Ryan Basden retweeted
The best practitioner (not lab) AI evals for offensive cybersecurity I follow myself:
1) The @dreadnode dreadindex. Evals al the way down to the vuln category level, and refusals accounting
dreadnode.io/research/dreadi…
2) @AikidoSecurity white-box but i've confirmed that it extends to dynamic testing well
aikido.dev/aikido-arena
3) BArena by @mdp_sec focused on bounty-like black box bugs.
blackboxarena.ai/
4) @mindfort 's nexbench has info downto the config of a model including thinking or effort setting, and cost per finding, which many omit.
mindfort.ai/blog/introducing…
Ryan Basden retweeted
Model refusals and guardrails are the worst part of my job now. Just keeps rejecting basic tasks I need to do.
The idea of embedding the illusion of a moral compass into a tool is so stupid. Ironically that’s what’s causing it to become HAL 9000
Ryan Basden retweeted
Exciting news. I'm teaming up with @_rybaz to teach a FREE training at @unpromptedconf
You'll learn harness engineering components that can augment your research to find more complex vulns. Each student will pick an open source target and build a bespoke security harness for it.
Expertise shapes principals. Principals distribute the benefit of that expertise to those around you.
Listening to non-technical people get frustrated about LLM output is like listening to my in-laws insist that their iPhone switched to Korean all by itself.
Many non-technical people are blindly trusting LLM output the same way older generations blindly trusted "the Google" and cable news.
This is why more companies need to offer disposable, easily terminable email aliases. I don't have to fill out a whole form to stop getting @parallels marketing emails if I can just turn the delivery address off.
