Head of Research @nextronsystems #DFIR #YARA #Sigma | detection engineer | creator of @thor_scanner, Aurora, Sigma, LOKI, YARA-Forge | always busy ⌚️🐇 | vi/vim
Frankfurt, Germany
Joined June 2013
- Tweets38.1K
- Following2.7K
- Followers226K
- Likes176K
Pinned Tweet
I've decided to put a screenshot showing the hex editor view of a Turla Kazuar sample behind acrylic glass on my desk to always remind me, why I am doing all this ...
because I 💛 to be a pain in the neck of the bad guys
xitter.cf/cyb3rops/status/115659…
It seems that I have some fans over in Russia 🐻
#TurlaLicksAss
thx to the FireEye analyst who brought this to my attention
virustotal.com/gui/file/4417…
Florian Roth ⚡️ retweeted
#Kimsuky (APT-C-55) is delivering persistent backdoors through multilingual LNK phishing lures
After reading the 360 Threat Intelligence Center's report on APT-C-55's multi-path delivery campaign, we found a cluster of nine related malicious LNK files submitted between September and October 2026, with detection ratios around 10-30 out of 60+ engines.
The LNK files execute a layered attack chain: base64-encoded batch scripts decoded via a renamed copy of certutil.exe, staging in C:\Users\Public, nircmd disguised as ntoskrnl.exe, and scheduled tasks running every 9 minutes for persistence. A parallel variant uses PowerShell with double hex-encoded payloads, and a third path poisons the open-source pybroker Python library as a supply chain attack.
Analysis & IOCs: github.com/NextronSystems/io…
Florian Roth ⚡️ retweeted
The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE
Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.
Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.
Chainguard
coordinated release
but only for themselves
"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."
thephp.foundation/blog/2026/…
Florian Roth ⚡️ retweeted
One-click mitigation for php2shell vulnerability:
If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected.
dash.cloudflare.com/?to=/:ac…
This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
Florian Roth ⚡️ retweeted
Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
You can still focus on detection coverage today.
Security Labs writeup (coverage + guidance): elastic.co/security-labs/thr…
Most PHP RCEs converge on the same outcome, whatever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.
• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root
The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.
We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.
The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.
(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)
Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.
Guidance + every rule link below.
Let’s not forget about this certificate clusterfuck while everyone is busy with the PHP RCE news.
Almost at the same time, another serious security incident became public.
Eight intermediate CA certificates from eMudhra were found to use ridiculously weak private keys. We’re talking about P-384 keys where one private key was literally the number 4. FOUR!
Six of these were TLS CAs, allowing anyone to recover their private keys and potentially issue trusted certificates for arbitrary domains.
Major browsers have already blocked the affected CAs. But what about API clients, backend services, embedded devices, containers, and systems with outdated trust stores?
Many don’t enforce Certificate Transparency or check revocation. Some could remain vulnerable for years.
These weak keys have existed since April 2025. No confirmed malicious exploitation so far, but the implications are serious.
Don’t overlook this one while focusing on PHP.
Technical details and test endpoints:
emudhra.we-have-a-problem.co…
Quote: "an independent security researcher reported that the keys of eight eMudhra Global TLS intermediate Certificate Authorities were cryptographically weak".
Well, yeah, they were weak. A private key should look something like this:
84ac06790886c80c48d31691fd4c0fe9
ce3207f9807f2fe571d6e4ec426d7864
4298fc53df2b92566970e757ac998c34
Instead, their keys looked like this:
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000004
Florian Roth ⚡️ retweeted
phucking patch
php.net/archive/2026.php#202…
github.com/php/php-src/secur…
github.com/php/php-src/secur…
Florian Roth ⚡️ retweeted
The rate of patch bypasses has skyrocketed (8x) this year. 🚀
The good news is that the timing of the increase happens to correlate with Anthropic and OpenAI's security product releases so the increase might be defender-lead.
The bad news are that vulnerabilities that have been reported to be exploited in the wild were bypassed 4x more often, so attackers definitely also got the memo that security patches are highly valuable context for vulnerability research.
For defenders, it's getting important to spend considerable resources on robust and comprehensive patching to stay a step ahead of the attackers.
More stats, like in which linux kernel areas 10%(!) of vulns are directly caused by patches of other vulns, are available in the full report below
Florian Roth ⚡️ retweeted
An ASLR bypass, not click and run but good idea to start on github.com/9bie/php2shell-by…
Florian Roth ⚡️ retweeted
ASD can't stand the heat either! I'm fucking itching to get bad traffic over here tho! :P
#php2shell
Florian Roth ⚡️ retweeted
Testing the POCs in the lab with Claude, whilst drinking tea! (how 2026 of me :P /S cringe)
and.... we have some interesting and useful intel.....
exploitation of these CVEs doesn't appear trivial....
"Most likely why: the authors targeted a specific build (“Ubuntu php 8.5.4 profile-21”) with hard-coded struct offsets and a build-specific address delta. Vanilla upstream 8.5.4 either doesn’t carry that exact reachable path or the heap groom depends on that build’s allocator state. I’ll also be candid: this CVE pair is described in the PoCs themselves as leaked/pre-embargo/”presumed,” and I can’t independently verify it maps to a reproducible upstream bug."
#PHP
Two very useful posts on monitoring and hardening PHP services, plus an Nmap command to help find them in your environment:
1. Discovery with Nmap
Common and alternative web ports; HTTP headers that may expose PHP versions:
nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true'
Look for X-Powered-By: PHP/.... Fast inventory check; hidden PHP deployments can be missed, and version banners don’t confirm vulnerability.
2. Huntress: Monitoring and detection
• Confirmed facts and remaining questions
• Suspicious PHP child processes, shells and downloaders
• Webshells and other post-exploitation activity
• My process-watcher for Linux process visibility
huntress.com/blog/php2shell-…
3. Vincent Schmalbach: Hardening and patching
• Temporary nginx/Apache filters and upload-progress settings
• WAF/origin bypass checks
• Package and backport verification
• PHP-FPM/worker restarts, container rebuilds
• Side effects and checks for compromise
vincentschmalbach.com/cve-20…
Temporary measures are stopgaps. Prepare to apply the official fixes as soon as available.
PHP
Patch, take it offline, or put it behind a WAF and hope it filters the exploit requests. I wouldn’t count on a configuration-only fix unless one is confirmed.
For inventory, this Nmap command can reveal PHP versions exposed in HTTP headers:
nmap -sT -sV --version-light -T4 --max-retries 1 --open -p 80,81,443,8000-8010,8080-8090,8181,8443,8880,8888,9000,9001,9080,9090,9443 --script http-headers --script-timeout 10s --script-args 'http-headers.path=/index.php,http-headers.useget=true'
Only scan systems you’re authorized to test. This finds advertised versions, not every PHP server, and doesn’t confirm vulnerability.
Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.
Florian Roth ⚡️ retweeted
An enterprise environment emits billions of log events every day. During an incident, the responder rarely needs all of them. They need the few hundred or thousands that tell the story: the burst of 4625 failures followed by a single 4624 success, the encoded PowerShell spawned by winword.exe, the new service installed at 03:12 on a domain controller. Logs analysis is the discipline of getting from the first number to the second fast enough to matter.
That job has become harder in two directions at once. Attackers using AI tooling generate evidence at machine speed and pad real actions with benign-looking activity. Meanwhile, the obvious shortcut of pushing logs into an LLM runs into guardrails, context-window limits and data-protection obligations. Hugging Face’s responders hit exactly that wall in July 2026, when roughly 17,000 , later to be claimed 3 billion events (still healthy daily workload) were refused by frontier models and had to be processed on a local model instead.
Below, we cover log analysis end to end, then look at LogTotal, SOC Prime’s free answer to the incident-time version of the problem. socprime.com/blog/log-analys…
Florian Roth ⚡️ retweeted
Exploiting Reversing (ER) Series | Article 11: Windows: Missing Bounds in the Print Spooler.
The article has 60 pages, free. A user-mode target this time instead of a kernel one, worked end to end: from a missing bound check to a SYSTEM shell, with the service still running afterwards.
Published on:
blackstormsecurity.com/resea…
What it covers:
[+] The bug: a heap overflow (CWE-122) in the Print Spooler's form-enumeration path, reached
through InternalEnumForms → CopyIniFormToFormInfo → PackStrings → memcpy.
[+] It is still unpatched. I submitted it to Microsoft in March 2026 and MSRC assessed it as below the bar for
immediate servicing, because the PoC requires administrative rights. Re-confirmed working in October against current mainstream and Canary builds.
[+] The exploitation, which is two thirds of the article, with four stages: groom, corrupt, control, execute. The process never crashes: spoolsv.exe is left running and the planted form deleted.
[+] Important note: I had already notified the MSRC months ago that I would write an article about the vulnerability and publish it.
I would like to thank Ilfak Guilfanov ( @ilfak ) and Hex-Rays SA ( @HexRaysSA ) for the continuous
support.
This article will be published on exploitreversing.com/ next week.
Hope you enjoy the read!
#Windows #PrintSpooler #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #HeapExploitation
Florian Roth ⚡️ retweeted
Here's a project I've been quietly working on for months but finally got around to properly releasing: FrankenMermaid. It's a complete ground-up, memory-safe, hyper-optimized Rust implementation of MermaidJS that compiles into wasm. It's over 100x faster!
frankenmermaid.com/
