An Internet Intelligence Company with hyperspecialization in Subdomain and Exploit Intelligence.
India
Joined November 2023
- Tweets1.6K
- Following342
- Followers574
- Likes2.1K
Pinned Tweet
In 2020 we open-sourced Kenzer, a recon and scanning framework for bug bounty hunting: github.com/ARPSyndicate/kenz…
Today it's reborn as a full security platform.
Cybersecurity comes down to targets, exploits and threats. Most teams cover them with separate tools that all score them differently, so nobody can answer the one question that matters: how exposed are we?
Kenzer brings it into one place, with one security grade. It covers SCA, SAST and DAST, Fourth-party risk and Dark web monitoring. Every finding is ranked by real exploitability using VEDAS, our exploit intelligence covering nearly 5 million vulnerabilities.
Built by ARPSyndicate. Watch the 4-minute tour below.
kenzer.arpsyndicate.io
#cybersecurity #bugbounty #vulnerabilitymanagement #appsec
ARPSyndicate - Cyber & Open Source Intelligence retweeted
THIS IS ACTUAL F*CKING GOLD
Anthropic just shared one of the best tricks for Claude Code.
The idea: run Sonnet, Haiku and Opus 5.5 together, each one doing only the job it's best at.
Opus-level judgment on every big call, without paying Opus rates for every routine turn.
You just launch Claude Code like this:
claude --model sonnet --advisor opus
here's the split:
→ Sonnet 5.5 runs the session and writes the code
→ Haiku 5.5 explores files and docs in parallel
→ Opus 5.5 stays on call as advisor for the big calls
→ you stop spending Opus on work that doesn't need it
Opus only steps in at three moments:
→ before a plan locks
→ when the same error shows up twice
→ before calling it done
Sonnet builds. Haiku explores. Opus reviews.
JEV engineering is the same move one layer down: the forks that need no thinker (which file, which tool, retry or stop) go to JEV in milliseconds, and the big models only see the ones that split
the full tree
> Sonnet 5.5 runs the main session and edits code
> search maps the repo on Haiku 5.5
> grep finds call sites on Haiku 5.5
> docs pulls the API reference on Haiku 5.5
> Opus 5.5 on call as advisor, reads the whole transcript when consulted
> JEV routes micro-forks in milliseconds
paste the tree and this prompt into Claude Code ↓
"Rebuild my Claude Code setup around this tree:
1. Run the main session on Sonnet 5.5 with Opus 5.5 as advisor.
2. Create three read-only Haiku 5.5 subagents: search (maps the repo), grep (finds call sites), docs (pulls the API reference).
3. Add one rule to CLAUDE.md: consult the advisor before locking a plan, after the same error twice, and before calling a task done.
4. Route fast deterministic forks (tool choice, path selection, retries) through JEV.
Show me every change as a diff first. No edits until I say go."
↳ code.claude.com/docs/en/advi…
save it, you'll use this every single day.
ARPSyndicate - Cyber & Open Source Intelligence retweeted
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
Readers added context they thought people might want to know
The Tailscale SSH findings require prior authorized access on the tailnet per the researcher's report; Tailscale stated issues concern post-authorization behavior only and did not recommend disabling SSH for everyone.
tailworm.com
x.com/IntCyberDigest…
ARPSyndicate - Cyber & Open Source Intelligence retweeted
JUST IN: 🇰🇵 North Korea hit by suspected cyberattack, taking down several government websites and disrupting internet access.
ARPSyndicate - Cyber & Open Source Intelligence retweeted
Claude can no longer “Reverse Engineer Anything.”
Anthropic just quietly killed REA.
But Interesting timing.
After a few viral cases of people using Claude to reverse-engineer Samsung TV firmware and identify data-collection services, Anthropic appears to have restricted those reverse-engineering abilities.
WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners.
Bro Rooted a brand-new 2025 Samsung TV after noticing absurdly targeted ads.
Firmware was locked down, so zero-days it was.
Got a root shell.
then found: always-on voice service, ACR, geo, full telemetry pipeline, and four separate DRM systems.
This isn’t a bug, It’s the product bro.
ARPSyndicate - Cyber & Open Source Intelligence retweeted
Why php2shell can't be widely exploited
What limit the php2shell exploitation in practice
berardinellidaniele.com/post…
ARPSyndicate - Cyber & Open Source Intelligence retweeted
I guess you could say the past 48 hours have been a bit busy for cyber defenders
ARPSyndicate - Cyber & Open Source Intelligence retweeted
Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619).
Pure logic bug — no memory corruption,
ASAN-clean, orthogonal to the CVE-2026-109618/19 class.
Receipt: uid=33(www-data) over HTTP, one-shot
#infosec #php2shell #php
Readers added context they thought people might want to know
The claimed RCE on fully-patched PHP 8.5.12 requires a custom lab app with a destructor gadget plus deliberate session.serialize_handler mismatch (php_serialize writes, legacy php reads) and non-default settings like cleanup=Off; this is an app flaw, not core PHP RCE.
github.com/rafalohaki/php…
php.net/manual/en/sess…
ARPSyndicate - Cyber & Open Source Intelligence retweeted
It took 17 minutes to turn the Gitlab RCE to a working HEAP exploit using Gemini 4 Argon and the advisory, then another hour for the complete chain - super fun for someone like me without any binary exp or source code review experience, new cyber era!
Great find by @joaxcar!
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
ARPSyndicate - Cyber & Open Source Intelligence retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
ARPSyndicate - Cyber & Open Source Intelligence retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
ARPSyndicate - Cyber & Open Source Intelligence retweeted
-----BEGIN EC PRIVATE KEY-----
4
-----END EC PRIVATE KEY-----
😬
ARPSyndicate - Cyber & Open Source Intelligence retweeted
Additional mitigation parts,
memory_limit = -1
max_post_size = 1/4 of configured memory_limit
session.upload_progress.enabled = 0
fatal_error_backtraces = 0
expose_php = 0
User SELinux/AppArmor where possible.
ARPSyndicate - Cyber & Open Source Intelligence retweeted
From the PHP Foundation on who found it first 👇
🤯
🚨 BREAKING: Node.js just dropped its OWN security bombshell.
4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.
→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity.
→ REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely.
→ TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions.
→ Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to.
→ THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates.
→ RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches.
→ PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers.
PHP AND Node.js both facing major security disclosures on the SAME DAY.
If you run a website or application, TODAY is the day to check your servers.
And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated.
Don't be the last one to patch.
Well well well.
As if PHP2Shell wasn't enough for one day... now GitLab. 😅
🚨 CRITICAL GITLAB ALERT (CVSS 10.0)
CVE-2026-110264 could allow unauthenticated RCE on self-managed GitLab servers.
⚠️ Potentially affects 12 years of releases, dating back to 2014.
Patches available. Update immediately!
docs.gitlab.com/releases/pat…
#gitlab #cybersecurity
ARPSyndicate - Cyber & Open Source Intelligence retweeted
INTEL DROP
With PHP2SHELL exploitation likely imminent, it's statistically probable that IPs attempting to opportunistically exploit in the last 24hrs will use any POC as well. In that vein, here is our entire list of active exploitation IPs in the Total Insights detection pipeline.
1,187 IPs currently flagged active-exploitation at score 90+, hitting known CVEs across Ivanti, Joomla, Laravel, XWiki, Webmin, phpunit, and hundreds of others. Full IP list follows.
1.95.73.195
102.201.110.181
102.244.97.185
103.10.54.130
103.10.54.163
103.115.101.3
103.115.158.79
103.122.250.20
103.122.251.117
103.127.29.111
103.127.84.171
103.130.113.177
103.132.179.173
103.132.179.184
103.132.179.189
103.133.201.241
103.133.206.190
103.135.252.72
103.135.254.141
103.135.90.94
103.136.203.23
103.137.40.180
103.137.67.235
103.138.144.223
103.138.173.52
103.141.3.194
103.145.28.99
103.146.10.7
103.146.16.13
103.147.107.50
103.153.170.196
103.153.170.22
103.153.170.26
103.153.210.82
103.153.211.94
103.153.230.110
103.155.27.147
103.159.172.76
103.159.51.70
103.160.205.37
103.160.252.126
103.161.2.42
103.161.2.68
103.166.230.138
103.167.208.215
103.169.158.44
103.178.67.53
103.182.213.192
103.185.25.41
103.187.68.236
103.204.210.153
103.214.201.168
103.216.57.154
103.220.204.169
103.23.207.3
103.242.21.87
103.242.219.88
103.25.249.213
103.25.249.74
103.25.249.77
103.25.249.88
103.25.250.251
103.42.228.86
103.42.228.93
103.46.186.148
103.54.108.11
103.54.108.178
103.56.232.39
103.63.101.24
103.7.120.167
103.7.120.63
103.71.47.166
103.71.47.173
103.73.46.215
103.73.46.6
103.73.47.126
103.75.138.11
103.75.139.8
103.79.184.145
103.81.105.186
103.84.133.173
103.84.133.248
103.84.133.255
103.84.59.230
103.87.250.102
103.87.250.188
103.87.250.49
103.87.250.7
103.87.250.90
103.87.250.99
103.87.251.60
103.96.105.136
103.96.69.78
104.154.26.200
104.196.151.133
104.196.161.44
104.196.17.69
104.196.185.88
104.196.203.105
104.198.91.98
104.199.150.237
104.199.172.176
104.199.218.8
104.199.230.95
104.199.235.85
104.199.243.95
104.234.186.154
107.150.123.48
107.155.48.46
107.167.182.152
107.170.13.163
107.175.132.47
114.130.98.165
115.191.32.57
118.145.104.105
118.145.104.37
118.193.33.239
119.15.169.38
119.28.84.193
120.211.74.131
120.48.152.13
122.155.166.90
123.0.16.38
123.253.36.170
124.158.13.141
13.140.242.159
13.140.80.140
13.143.174.142
13.143.188.149
130.12.180.32
130.211.106.14
136.107.12.44
136.107.147.139
136.107.149.15
136.107.152.22
136.107.167.225
136.107.176.196
136.107.206.240
136.107.207.183
136.107.214.36
136.107.217.202
136.107.27.201
136.107.32.213
136.107.33.145
136.107.38.153
136.107.80.134
136.107.80.78
136.108.100.115
136.108.138.216
136.108.149.185
136.108.154.152
136.108.175.51
136.108.205.8
136.108.228.16
136.108.237.144
136.108.24.58
136.108.53.209
136.108.62.65
136.108.97.105
136.108.98.203
136.109.108.251
136.109.22.166
136.110.108.191
136.110.124.107
136.110.28.221
136.110.49.251
136.110.57.140
136.110.74.220
136.111.211.61
136.116.138.1
136.118.175.7
136.66.134.148
136.66.146.241
136.66.158.66
136.66.53.74
136.66.58.120
136.66.72.44
136.67.102.155
136.67.144.233
136.67.165.186
136.67.219.199
136.67.222.2
136.67.66.135
136.69.135.134
136.69.215.213
136.69.227.88
136.70.12.130
136.70.120.179
136.70.127.7
136.70.138.152
136.70.172.181
136.70.191.162
136.70.194.91
136.70.196.212
136.70.201.136
136.70.62.1
136.70.62.221
136.70.65.144
136.70.72.114
136.70.74.204
136.70.95.65
136.70.99.135
136.71.115.222
136.85.31.180
136.85.42.250
136.85.60.38
136.85.7.70
136.85.70.76
136.85.76.174
136.85.79.130
136.85.92.181
136.86.169.10
136.86.197.123
136.87.101.192
136.87.112.149
136.87.117.82
136.87.123.94
136.87.125.17
136.87.129.47
136.87.135.6
136.87.137.164
136.87.142.150
136.87.154.195
136.87.156.40
136.87.157.25
136.87.60.21
136.87.66.131
136.87.7.143
136.87.81.206
136.87.86.206
136.87.96.139
136.87.98.210
136.90.101.46
136.90.26.92
136.90.28.120
136.90.97.40
136.92.13.137
136.92.18.201
136.92.4.120
136.92.8.91
138.197.85.193
144.225.6.184
144.48.109.34
146.148.122.37
147.15.15.226
147.182.183.163
149.78.186.49
152.32.225.117
152.32.236.102
157.10.186.28
157.245.84.42
160.154.31.234
160.187.108.193
160.202.146.232
160.202.146.236
160.202.146.238
160.236.58.116
160.250.132.238
161.120.181.157
161.120.187.230
161.132.49.125
162.35.28.121
162.4.222.142
163.128.210.228
163.61.17.82
163.7.1.156
165.101.222.104
165.154.173.148
165.154.218.226
165.99.207.153
165.99.216.237
167.254.79.1
167.71.233.141
169.239.75.138
169.58.206.194
171.34.139.222
172.233.190.104
172.234.143.92
172.234.155.181
172.236.233.65
172.68.221.154
172.68.221.162
172.68.221.166
172.68.221.172
177.10.160.46
178.128.97.205
180.181.122.134
180.210.165.179
180.93.54.84
184.154.245.42
185.122.171.146
185.126.202.85
185.177.72.51
190.171.189.85
192.3.90.20
193.148.56.90
195.178.110.22
196.238.51.120
198.12.89.177
202.125.66.58
202.134.10.131
202.134.10.132
202.134.10.137
202.134.11.226
202.134.8.193
202.134.9.130
202.134.9.137
202.134.9.140
202.134.9.141
202.181.16.97
202.86.220.242
202.86.220.30
203.195.82.138
203.20.109.14
203.82.199.74
204.16.174.148
207.175.25.248
207.175.63.13
209.141.51.90
212.18.114.31
217.60.7.209
223.123.65.54
223.83.183.254
27.123.253.167
27.123.253.179
27.123.253.191
27.123.253.194
27.123.253.200
27.123.253.205
27.123.253.206
27.123.253.212
27.123.253.215
27.123.253.68
27.123.253.80
27.123.253.81
27.123.253.84
27.123.253.87
27.123.254.26
27.123.254.27
27.147.224.153
27.147.242.48
34.100.153.150
34.104.138.183
34.104.139.120
34.104.141.20
34.104.148.7
34.104.160.36
34.104.161.170
34.104.171.175
34.104.174.18
34.104.203.249
34.104.217.182
34.104.223.96
34.107.110.212
34.107.116.240
34.107.34.79
34.107.35.18
34.107.43.64
34.11.126.229
34.11.75.74
34.118.138.82
34.118.154.211
34.118.154.37
34.118.155.197
34.118.172.224
34.118.177.60
34.118.181.111
34.118.196.103
34.12.113.29
34.12.141.85
34.12.156.255
34.12.170.82
34.12.234.112
34.12.246.247
34.12.249.202
34.12.86.52
34.12.95.191
34.12.96.179
34.123.171.95
34.124.138.175
34.124.155.214
34.124.158.187
34.124.161.58
34.124.163.2
34.124.179.4
34.124.186.84
34.124.210.232
34.124.221.40
34.124.235.67
34.124.247.79
34.126.108.82
34.126.123.203
34.126.135.191
34.126.153.45
34.126.174.200
34.127.6.25
34.13.137.190
34.13.153.188
34.133.232.249
34.138.78.102
34.138.82.100
34.139.199.80
34.139.246.167
34.139.254.5
34.139.34.3
34.140.49.95
34.141.15.231
34.141.150.44
34.141.42.31
34.141.69.105
34.141.93.225
34.142.212.50
34.142.226.63
34.142.235.203
34.143.140.172
34.143.149.128
34.143.149.88
34.143.153.195
34.143.163.137
34.143.176.226
34.143.189.119
34.143.208.238
34.143.226.143
34.143.233.155
34.143.254.176
34.145.248.40
34.146.109.172
34.146.131.23
34.146.152.31
34.146.157.194
34.146.159.157
34.146.164.12
34.146.185.119
34.146.189.40
34.146.198.30
34.146.217.90
34.146.224.240
34.146.231.90
34.146.244.192
34.146.28.3
34.146.34.69
34.146.45.160
34.146.72.70
34.146.75.136
34.146.80.211
34.146.86.137
34.147.7.247
34.147.9.103
34.147.9.145
34.148.118.59
34.148.12.173
34.148.202.139
34.148.236.59
34.148.248.253
34.148.49.9
34.148.67.124
34.150.136.2
34.150.216.166
34.150.239.190
34.151.192.129
34.151.196.35
34.151.201.141
34.151.204.44
34.151.205.161
34.151.218.215
34.151.219.113
34.151.221.183
34.151.224.220
34.151.234.92
34.151.235.181
34.151.235.215
34.151.247.79
34.151.249.231
34.151.252.220
34.152.21.75
34.152.25.68
34.152.28.138
34.152.33.225
34.152.35.118
34.152.41.129
34.152.45.192
34.152.9.109
34.153.200.191
34.153.201.44
34.156.103.50
34.156.111.120
34.156.118.247
34.156.119.80
34.156.128.197
34.156.139.4
34.156.16.104
34.156.178.157
34.156.194.143
34.156.209.1
34.156.236.236
34.156.61.57
34.158.181.129
34.158.38.172
34.158.41.183
34.159.105.175
34.159.107.14
34.159.114.82
34.159.121.36
34.159.128.35
34.159.148.122
34.159.153.97
34.159.167.237
34.159.172.153
34.159.175.254
34.159.191.127
34.159.199.254
34.159.2.77
34.159.213.187
34.159.235.26
34.159.55.185
34.159.58.63
34.159.70.147
34.159.86.33
34.159.9.120
34.168.204.250
34.168.215.71
34.168.218.1
34.168.22.16
34.168.228.28
34.168.248.96
34.169.137.52
34.171.154.46
34.172.9.102
34.177.95.38
34.177.97.172
34.177.97.180
34.178.113.211
34.178.116.217
34.178.119.101
34.178.133.15
34.178.163.194
34.178.172.50
34.178.177.192
34.178.195.242
34.178.215.179
34.178.235.123
34.178.60.69
34.178.62.0
34.179.142.84
34.179.143.104
34.179.153.201
34.179.180.167
34.179.185.147
34.179.210.121
34.179.222.58
34.179.248.182
34.179.252.44
34.180.109.195
34.180.122.99
34.180.68.8
34.180.73.113
34.180.80.74
34.180.82.252
34.180.89.65
34.180.96.128
34.181.136.181
34.181.152.153
34.181.167.57
34.181.177.216
34.181.179.9
34.181.213.128
34.181.218.133
34.181.218.43
34.181.234.204
34.181.249.63
34.182.140.203
34.182.146.200
34.182.155.7
34.182.241.91
34.185.136.201
34.185.144.20
34.185.177.165
34.185.178.103
34.185.187.167
34.185.196.17
34.185.218.203
34.186.112.104
34.186.113.100
34.186.201.69
34.186.203.161
34.186.207.146
34.186.55.183
34.187.119.56
34.187.169.24
34.187.210.221
34.187.25.73
34.187.48.107
34.19.138.127
34.19.148.2
34.19.156.226
34.19.179.78
34.19.189.191
34.19.206.202
34.19.208.243
34.19.210.25
34.19.212.97
34.19.219.104
34.19.226.199
34.19.230.199
34.19.239.226
34.19.241.30
34.19.244.248
34.19.252.55
34.19.254.241
34.21.104.226
34.21.109.199
34.21.143.44
34.21.151.181
34.21.17.117
34.21.189.99
34.21.197.23
34.21.222.75
34.21.31.241
34.21.5.217
34.22.168.4
34.22.183.181
34.22.226.10
34.23.229.138
34.23.55.184
34.23.56.252
34.23.73.163
34.24.126.168
34.24.178.204
34.24.190.69
34.24.37.154
34.24.48.66
34.24.9.239
34.26.104.177
34.26.225.1
34.26.95.76
34.32.171.197
34.32.254.232
34.34.101.184
34.34.112.8
34.34.150.169
34.34.28.161
34.34.43.160
34.34.55.86
34.34.60.252
34.34.81.102
34.38.241.44
34.38.87.66
34.38.88.239
34.39.129.246
34.39.131.95
34.39.136.220
34.39.140.128
34.39.163.213
34.39.169.21
34.39.170.223
34.39.187.208
34.39.189.230
34.39.196.106
34.39.197.235
34.39.210.128
34.39.211.156
34.39.214.95
34.39.216.210
34.39.217.2
34.39.217.225
34.39.220.247
34.39.231.98
34.39.237.75
34.39.237.86
34.39.248.94
34.40.106.240
34.40.113.52
34.40.115.38
34.40.12.26
34.40.120.76
34.40.23.218
34.40.56.211
34.40.60.74
34.40.65.192
34.40.97.154
34.44.213.188
34.45.46.15
34.47.0.253
34.47.16.34
34.47.26.173
34.47.28.211
34.47.29.192
34.47.30.101
34.47.43.120
34.47.46.122
34.47.51.141
34.47.51.191
34.47.60.169
34.47.62.242
34.48.162.128
34.48.185.81
34.48.2.95
34.48.204.65
34.48.223.214
34.48.51.38
34.52.220.122
34.52.251.185
34.53.147.48
34.53.162.201
34.53.214.124
34.53.245.46
34.53.252.42
34.53.92.198
34.57.109.38
34.57.18.143
34.58.177.143
34.6.17.166
34.6.17.32
34.6.190.73
34.6.208.148
34.6.252.157
34.6.37.38
34.6.84.234
34.6.99.237
34.62.151.162
34.62.167.195
34.62.203.66
34.62.224.17
34.62.232.103
34.62.250.177
34.62.34.3
34.69.72.242
34.7.150.75
34.7.228.89
34.7.251.242
34.7.46.81
34.7.77.17
34.7.94.217
34.73.103.198
34.73.250.231
34.74.118.71
34.74.15.154
34.74.40.252
34.74.79.239
34.74.87.143
34.75.129.110
34.75.131.83
34.75.155.23
34.75.16.222
34.75.66.23
34.76.124.47
34.77.232.64
34.77.7.212
34.79.56.125
34.80.121.128
34.80.135.175
34.80.182.192
34.80.187.7
34.80.200.168
34.80.202.207
34.80.236.90
34.80.254.44
34.80.67.33
34.81.137.64
34.81.178.159
34.81.186.246
34.81.190.147
34.81.191.236
34.81.221.84
34.81.222.161
34.81.23.140
34.81.251.52
34.81.27.13
34.81.33.248
34.81.45.85
34.81.46.151
34.81.5.43
34.81.6.171
34.81.94.10
34.82.130.149
34.82.235.150
34.83.2.251
34.83.60.58
34.83.66.181
34.84.117.79
34.84.125.196
34.84.142.236
34.84.162.244
34.84.215.31
34.84.248.173
34.84.28.17
34.84.84.184
34.85.110.188
34.85.121.180
34.85.162.235
34.85.215.123
34.85.217.40
34.85.23.32
34.85.37.21
34.85.68.154
34.85.81.102
34.86.15.76
34.86.150.159
34.86.248.10
34.86.26.236
34.86.92.95
34.86.97.97
34.87.129.90
34.87.137.23
34.87.144.69
34.87.154.171
34.87.171.251
34.87.21.213
34.87.26.215
34.87.43.128
34.87.85.82
34.87.90.216
34.89.162.226
34.89.170.20
34.89.180.184
34.89.185.117
34.89.194.51
34.89.213.199
34.89.214.5
34.89.229.69
34.89.235.29
34.89.245.114
34.89.252.118
34.9.116.86
34.9.92.98
34.90.107.164
34.90.108.204
34.90.15.4
34.90.174.88
34.90.204.87
34.90.207.149
34.90.246.60
34.90.254.179
34.90.87.206
34.91.102.163
34.91.133.21
34.91.204.7
34.91.233.34
34.91.3.211
34.91.33.184
34.91.87.129
34.91.87.50
34.95.134.17
34.95.148.192
34.95.148.68
34.95.150.200
34.95.166.25
34.95.168.235
34.95.169.189
34.95.177.83
34.95.18.75
34.95.188.6
34.95.197.50
34.95.200.208
34.95.206.136
34.95.213.121
34.95.214.130
34.95.24.80
34.95.243.221
34.95.43.65
34.95.48.207
34.95.49.219
35.185.111.215
35.185.118.188
35.185.165.161
35.185.3.140
35.185.77.35
35.186.146.137
35.187.231.47
35.188.49.43
35.189.135.71
35.189.191.246
35.190.130.255
35.190.146.89
35.193.29.161
35.194.121.79
35.194.130.82
35.194.210.76
35.194.214.9
35.194.247.186
35.195.132.81
35.195.4.194
35.196.128.16
35.196.153.23
35.196.190.119
35.196.2.53
35.196.252.168
35.196.41.154
35.198.11.22
35.198.113.32
35.198.136.30
35.198.14.227
35.198.16.57
35.198.17.248
35.198.187.101
35.198.201.80
35.198.210.241
35.198.27.124
35.198.29.58
35.198.32.128
35.198.37.200
35.198.46.45
35.198.6.142
35.198.6.169
35.198.60.29
35.198.64.79
35.198.79.68
35.198.85.212
35.198.9.61
35.198.92.138
35.199.108.206
35.199.114.18
35.199.120.56
35.199.51.238
35.199.68.204
35.199.72.82
35.199.82.150
35.199.85.150
35.199.99.150
35.200.12.8
35.200.19.250
35.200.25.156
35.200.5.54
35.200.66.99
35.201.131.36
35.201.173.66
35.201.243.0
35.201.254.66
35.202.182.249
35.203.102.11
35.203.105.207
35.203.22.103
35.203.24.86
35.203.26.153
35.203.33.76
35.203.37.154
35.203.48.109
35.203.53.250
35.203.63.146
35.203.97.87
35.204.112.146
35.204.198.10
35.204.20.70
35.221.0.20
35.221.101.183
35.221.109.53
35.221.122.164
35.221.126.243
35.221.178.81
35.221.222.255
35.221.249.60
35.221.67.186
35.221.75.146
35.221.82.178
35.221.91.113
35.222.167.213
35.229.153.176
35.230.170.140
35.230.175.26
35.230.96.215
35.231.226.99
35.231.230.44
35.233.112.19
35.233.214.179
35.233.42.237
35.233.5.72
35.234.103.121
35.234.171.110
35.234.187.58
35.234.19.132
35.234.29.111
35.234.43.68
35.236.140.188
35.236.171.223
35.236.226.48
35.236.243.208
35.237.0.55
35.237.181.76
35.237.226.153
35.237.23.249
35.237.74.73
35.238.249.149
35.240.134.159
35.240.137.206
35.240.156.31
35.240.156.86
35.240.183.117
35.240.199.59
35.240.217.183
35.240.217.222
35.240.39.194
35.241.154.172
35.241.164.37
35.241.216.180
35.242.222.173
35.242.248.44
35.243.100.85
35.243.101.196
35.243.111.1
35.243.116.141
35.243.155.113
35.243.161.121
35.243.74.14
35.243.98.200
35.245.104.86
35.245.131.226
35.245.203.0
35.245.236.124
35.245.32.249
35.246.152.18
35.246.203.72
35.246.206.36
35.246.214.28
35.246.231.211
35.246.236.15
35.246.237.40
35.246.248.152
35.247.129.72
35.247.146.93
35.247.162.222
35.247.187.2
35.247.195.30
35.247.203.57
35.247.218.3
35.247.228.169
35.247.245.80
35.247.247.159
35.247.247.220
36.255.81.222
36.255.82.139
36.255.82.170
36.255.82.187
36.255.82.190
36.255.82.235
36.255.82.246
36.255.82.253
36.255.82.255
36.50.250.37
37.111.215.95
37.111.218.108
37.111.218.169
37.111.218.182
37.111.218.207
37.111.218.29
37.111.222.57
37.120.186.231
37.120.213.13
38.148.20.75
41.223.139.111
42.0.7.193
42.0.7.204
42.0.7.213
42.0.7.219
42.0.7.235
42.0.7.240
42.0.7.248
42.0.7.250
43.108.120.121
43.155.183.44
43.173.38.56
43.226.36.132
43.230.211.12
43.246.202.106
45.118.68.56
45.124.15.230
45.137.194.154
45.140.193.140
45.141.26.3
45.148.10.15
45.148.10.95
45.153.34.122
45.153.34.149
45.156.87.16
45.156.87.6
45.203.220.220
45.33.28.47
45.43.36.172
45.43.37.254
45.56.103.154
45.8.132.75
47.77.204.57
50.114.236.142
51.159.4.12
58.145.185.136
58.145.186.196
58.145.187.200
58.145.188.177
58.145.188.202
58.145.189.233
59.153.202.112
59.153.202.113
62.146.226.80
64.226.84.77
64.64.255.170
65.109.215.207
66.175.208.166
69.164.207.173
79.124.58.82
8.220.129.148
8.228.119.125
8.228.70.0
8.228.76.85
8.228.88.238
8.229.135.44
8.229.211.55
8.229.27.200
8.229.48.35
8.229.78.183
8.229.9.185
8.234.147.244
8.234.190.46
8.234.201.4
8.234.204.234
8.234.214.137
8.235.113.39
8.235.76.14
82.156.186.122
89.126.211.166
89.247.33.110
92.242.198.105
93.123.109.163
93.123.109.228
93.123.109.247
93.152.221.26
95.130.227.78
96.126.117.80
97.107.140.120
103.199.108.142
103.199.108.208
103.199.111.94
123.253.3.13
144.91.81.102
169.58.111.93
185.18.215.184
23.94.144.9
27.220.190.221
43.128.100.146
103.14.33.168
115.187.18.20
160.187.211.233
104.160.176.32
185.194.178.92
50.31.235.100
120.79.15.49
103.163.139.125
121.43.148.69
172.105.109.85
173.249.6.158
185.177.72.50
194.163.173.251
102.129.255.213
103.140.235.56
103.59.160.245
144.31.7.15
147.93.171.213
157.66.54.190
172.235.245.36
34.118.134.92
35.247.211.10
38.60.216.218
50.31.235.102
103.31.153.253
129.146.23.7
140.245.33.214
140.245.43.35
140.245.61.25
160.187.211.90
185.201.227.49
217.142.187.160
38.126.46.110
85.203.21.100
85.203.21.116
85.203.21.135
85.203.21.139
85.203.21.14
85.203.21.150
85.203.21.170
85.203.21.197
85.203.21.21
85.203.21.24
85.203.21.25
85.203.21.27
85.203.21.30
85.203.21.38
85.203.21.53
85.203.21.93
85.203.21.96
#TotalInsights #ThreatIntel #CVE #PHP2SHELL
team-cymru.com/total-insight…
ARPSyndicate - Cyber & Open Source Intelligence retweeted
We're now seeing upload progress probes for PHP’s critical RCE vulnerability, CVE-2026-109618.
Our honeypots captured three HTTP requests from two source IPs, including PHP test code embedded in upload filenames.
Timeline (UTC):
• 20 Oct, 19:45: Previdian early-warning email sent.
• 21 Oct, 13:05: First attempt captured by our sensors.
• 21 Oct, 13:27: Follow-up warning emailed.
• 21 Oct, 13:30: PHP security fixes released.
• 21 Oct, 15:15: Previdian’s temporary virtual patch available.
Our initial warning preceded our first sensor observation by approximately 17 hours 21 minutes.
The evidence and IoCs:
• Observed source IPs: 166.1.90[.]109 & 43.134.82[.]85
• Multipart POST requests to /
• Fields: PHPSESSID and PHP_SESSION_UPLOAD_PROGRESS
• Two requests used the upload filename: <?php echo 1;?>.txt
Attackers did not manage to execute PHP or upload files in these first instances.
Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or your vendor’s patched package.
Now includes its self-leaking ASLR-bypass variant:
github.com/ARPSyndicate/veda…
#php2shell
CVE-2026-109618, CVE-2026-109619 and 15k CVE Nuclei Signatures.
github.com/ARPSyndicate/veda…
#php2shell #nuclei #suricata
ARPSyndicate - Cyber & Open Source Intelligence retweeted
CVE-2026-109618, CVE-2026-109619 and 15k CVE Nuclei Signatures.
github.com/ARPSyndicate/veda…
#php2shell #nuclei #suricata