Meow. Probably the closest thing to an APT without breaking the law. 0x50 Bugchecks make me happy. VR, Kernel Exploits, Firmware Feline. Proverbs 20:17
The Nether
Joined January 2023
- Tweets7K
- Following513
- Followers4.7K
- Likes1.2K
None of you are entitled to an exploit which allows you to touch any target you want.
I release code because it's fun.
You blue team motherfuckers crying for now three days because exploits drop fail to see the point, without people dropping exploits, you have no job. There is no defensive without offense. Stop fucking crying, and do the job you're paid to do. I do not give a fuck about your weekend and I quite enjoy your crying. Also; just so you're aware, I've been up front. I never claimed this thing touched nginx. The fucking demo used lab env (look at the demo) + LAN addresses, FPM on 9xxx
What part of that do you not understand?
A proof of concept is just that: something that proves a concept. Most people submitting a bug for review would stop at a crash dump. If you read the readme, before I nuked the github, you'd know. proof an exploit in lab conditions is possible, and exploiting it in the wild are two different things. I read everything that comes out. Github is full of PoC's on this issue. Multiple reports PHP (patched) is still vulnerable. having fpm behind your httpd isn't a patch. There's still a double free in the code base, still a UAF that has a block to actual exploitation. Multiple serialization bugs. Swoole is also an issue. You people can eat a dick.
Show me on the doll where the PHP2SHELL CVE's show up in our code?
is php2shell php2shell2shell?
If you want a villain who's also an asshole you've got him now.
Dragging my fucking name, threatening my Life, my family, and now, telling me and people I follow you wanna wear our skin like a suit and rape our mothers while you make us watch? Now trying to reach out and touch me?
Thanks 2FA. ;)
Speaking of, if anyone shows up here, my 2FA becomes my 2A. I didn't spend 550 on a Glock to get into a fist fight.
I've been a pretty nice guy until today. You're gonna see a side of me, none of you are going to like.
You're gonna need to call LE and your boss, you fuckers are in for a long weekend.
oh and @SchizoDuckie posting screenshots of my deactivated account while i cool off like you won some internet trophy? and loudly complaining about how it'll ruin your weekend if it was true? calling it AI slop?
You mean? Make you do your job? You mean force you to get off your overweight underpaid ass and actually do some fucking work? Sad man. It's almost like that's called.... Having a job.
Managing infrastructure qualifies you to be a fucking dick?
If infra ran smoothly, you wouldn't need to manage it, you snide, condescending cock bite.
_SiCk retweeted
みんなデスドルノートとかいうクソ二流ゴシップアカウントに騙されて @J4ck3LSyN を総攻撃してるのヤバい
この人は確かにモラルには欠けていたかもしれないけど、今回の PHP 騒動の直接的な原因でも諸悪の根源でもないよ……
本当に害悪度 SSS+ なのは誤情報を平気で流してるデスドルノート本人だろ
The uaf doesn't fire. Session poisoning and LFI is the winner.
my shitty prediction, mass exploitation of everything won't occur but a product or two might get pwn3d.
e.g. QNAPs as an example... or some other type of appliance with uniform configuration/hardware etc.
I don't like reading cyber tea leaves but I think it's sensible to remain grounded:
Exploit complexity
Exploit reliability
Attacker Capability/Resources/Skills
Attack Surface Diversity
Compensating Controls
Patching
Monitoring
EDR
Network egress configs
Network ingress (WAF)
all of these things play into the game of mass exploitation.
#PHP2SHELL
Bingo.
Circulating php2shell PoCs and videos are FAKE. Independent audits prove the alleged UAF does not trigger on stock PHP.
Why? The source code has a Z_TRY_ADDREF protection line that prevents the memory free. "Researchers" literally had to delete this protection line and recompile PHP to get their "verified" RCE.
The real risk remains application-level: LFI + Session Poisoning.
Source code proof & audit:
🔗 github.com/jaiswalakshansh/R…
Still patch & mitigate: Disable session.upload_progress.enabled and update to PHP 8.4.27+. Don't panic, verify. #CyberSecurity #PHP #CVE
for those curious since i woke up; the fucking exploit doesn't target FPM which is sitting behind your httpd
nginx in this case has FPM bound to 127.0.0.1.
this means that you'd need to have your FPM port reachable by the exploit which doesn't happen on nginx.
the exploit yaps in raw fastcgi.
LAN? Doable.
Point at nginx and pop a shell? Not yet.
Probably a good idea. I didn't release mine. The screenshot is a warning. I hope all of you stay safe. It's a weird world. 🌍🌪️💔
Genau deshalb ist "wir patchen nächste Woche" keine Strategie. ⚠️ Codeausführung als www-data auf einem frischen 8.5.12-Build. Wer #PHP betreibt: jetzt WAF-Regeln setzen, sofort patchen und Zugangsdaten wechseln. 🔐
_SiCk retweeted
Quick reminder: releasing an exploit isn’t hacking. Courts have treated code as speech for 25+ years, and the CFAA punishes unauthorized access, not publication. Open source ships “AS IS” with zero warranty, too. The law is not the problem here.
Publishing exploit code is not a crime in the US. Code is protected speech (Bernstein, Junger), there’s no federal law against releasing a vuln, and the CFAA covers accessing systems you don’t own, not writing about bugs or releasing code. Law’s on the side of the researcher.
If you wanna lose a 1A case and pay me you're welcome to take that fuckin' L. I'll walk out of that court room owning your MANGA collection.
No Such Accuracy.
Patch what? :)
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
