Computer Security Professional. Tweets are my own. Rooster Teeth Archive Project: https://xitter.cf/t.co/gawoj5ZZyG
Joined April 2009
- Tweets136K
- Following4.8K
- Followers9.5K
- Likes161K
Pinned Tweet
We did it @hacks4bourbon we got your handle into Rank 11 in the #OpenSOC CTF Finals! So glad to be able to be able to honor you this way. I know you would be here had you not passed on 8/1/2020. Rest in peace.😢
#DEFCONSafeMode #defcon28 #DEFCON @Recon_InfoSec @eric_capuano
100% agree this is exactly what I've been saying the last year. And the frontier labs have only been making it more and more difficult to use them for cyber security work.
The way frontier labs have restricted access to cyber capabilities makes no sense. If you're considered a "defender" you're not allowed access to the "offensive" versions of the models (the ones that can do development/validation of malware and exploits).
So for example, if you want to build some sample malware to test a detection system, nope.
Or if there's a major crisis due to a critical vulnerability in PHP and you need to rapidly triage fake exploits to see if there are any real ones floating around so you can warn people, nope.
Want to build a remote code exploit to make sure the detection rules you plan on proposing to the clients actually work? Hard nope.
You gotta call your red team friend and wait for them to do your job for you, because "defender" are only allowed to play in the sandbox with the children.
Not an expert, but I think that the ability to triage in-the-wild exploits during a major crisis affecting 40 million systems is possible maybe important.
And then they want to ban abliterated open weight models, which half of the people are only using because frontier labs will only give them access to lobotomized models.
Dodge This Security retweeted
The way frontier labs have restricted access to cyber capabilities makes no sense. If you're considered a "defender" you're not allowed access to the "offensive" versions of the models (the ones that can do development/validation of malware and exploits).
So for example, if you want to build some sample malware to test a detection system, nope.
Or if there's a major crisis due to a critical vulnerability in PHP and you need to rapidly triage fake exploits to see if there are any real ones floating around so you can warn people, nope.
Want to build a remote code exploit to make sure the detection rules you plan on proposing to the clients actually work? Hard nope.
You gotta call your red team friend and wait for them to do your job for you, because "defender" are only allowed to play in the sandbox with the children.
Not an expert, but I think that the ability to triage in-the-wild exploits during a major crisis affecting 40 million systems is possible maybe important.
And then they want to ban abliterated open weight models, which half of the people are only using because frontier labs will only give them access to lobotomized models.
Dodge This Security retweeted
Lost stealmybitcoin.com by ~1h. We'd designed the winner's chain (PS(id) cookie leak → forged pDestructor to system()). The miss: display_errors=On made us assume memory_limit=-1. It was 128M. And we skipped the fix's test showing the 500× amplifier. gg @killa
#PHP2Shell
Dodge This Security retweeted
"Approximately five hours after this initial execution, Bumblebee deployed an AdaptixC2 beacon (AdgNsy.exe), which established a new C2 channel to 172.96.137[.]160:443. The threat actor then initiated internal reconnaissance using built-in Windows utilities, including systeminfo, nltest /dclist:, whoami /groups, and net group domain admins /dom."
Read the full report: buff.ly/jTXN9HO
#DFIR #ThreatIntel
Dodge This Security retweeted
Florida Attorney General James Uthmeier has proposed requiring age verification in app stores, operating systems, and AI chatbots, turning child protection into a system that identifies every user.
Critics say there is no way to find minors without checking everyone.
A mandatory identity layer for ordinary computing is the foundation of a digital ID system, and once it exists, it can be extended to track, score, and restrict people.
China is the cautionary example they cite most often.
Full story: thelibertysun.com/floridas-s…
Dodge This Security retweeted
Signed "Lway Firmware" - 7th unique cert serial for them 🫥
h/t @malwrhunterteam
Microsoft teams lure -> BabaDeda loader -> CNCMachineRMS RAT
C2: wizardexpensive[.]com:
96.62.218[.]59
rogueauthority.org/signed-te…
Dodge This Security retweeted
Hard disagree.
If you’re familiar with the hugging face situation, how they were attacked by a ChatGPT model while ironically being refused by GPT to help them defend themselves against the attack, so they had to resort to an open model. GLM 5.2.
This elitism system will only get worse overtime.
Intelligence needs to be democratised.
I am okay with Kimi 3.1 deliberately leaving out top-end offensive cyber capabilities from their training data.
Discriminating against use cases is MUCH less bad than discriminating against users. And the world does need all the time it can get to prepare, harden, check old code, (properly) formally verify new code, etc before the full weight of very powerful cyber attacks is upon us.
And if this first big wave of AI risk is not handled well, then we may well get a dystopia of highly locked down models, KYC gating on everything, highly intrusive surveillance on everything, a society where you may be a second or third or fourth-class citizen in terms of model access based on your credentials and nationality.
Dodge This Security retweeted
Update:
well well, the challenge is solved by @killa and the challenge code is open source, so let's check if i was right?
1. it was indeed running php's cli dev server. what they didn't share is the first ~10 hours, when it was only serving a static index.html and the bug wasn't even reachable.
2. it is indeed php -S straight behind nginx
3. i said one worker, it was 8 workers with 1.5 cpu and 1 GiB ram. (yeah, tomayto, tomahto???)
i will let you decide how realistic this setup is and how common this is, the challenge was indeed unsolved for first 10 hours, later DDoS'd by small workers, even killa's exploit was unusable, he got flag quiet early, but the bitcoin wallet has no money so when he tried to find other wallet he couldn't solve for next 4-5 hours.
the stealmybitcoin[.]com (php2shell) challenge is shit, and everyone already predisposed to dismissing ai's cyber capabilities is jumping on the bandwagon to call the bug unexploitable and overhyped.
like bro, did you even try to solve it?
i think the challenge can be solved in under five hours. whoever made stealmybitcoin just slopped it up like crazy, wasting an insane amount of people's time and tokens because of their sloppiness.
just from a blackbox perspective, for the first ~10 hours, they seemed to be serving something like index.html through a wildly uncommon setup:
nginx -> proxy_pass -> php -S -> index.html
if you look at the PHP CLI server code, without a router, it doesn't even initialize php for static files, so you can't trigger the vulnerable multipart parser in the first place.
after @LiveOverflow called this out, they updated the server to expose an actual PHP endpoint:
stealmybitcoin.com/php-versi…
this is still a crazy setup, running php's single-threaded development server behind nginx, but apparently the exploit works reliably now.
except everyone who wanted to prove php2shell was fake made the challenge go viral, and the server basically got dosed by everyone else who want to solve. now you can barely even make a request to it.
Dodge This Security retweeted
We updated the blogpost.
After the original post:
- I saw the malware in the network I monitor
- Others reached out to me to share TTP
- Others have published about it
- We've connected it to other signers and malware
All the signers have been added to CertGraveyard
Interesting malware signed “Guangzhou Guoying Communication Technology Co., Ltd.” and now revoked.
Functional PDF editor with backdoor. My report has 3 C2, but have seen more:
rogueauthority.org/quartzlin…
Dodge This Security retweeted
Tailworm(tailworm. com) is a security assessment of Tailscale v1.104.2 and headscale v0.29.5 that details multiple high-severity vulnerabilities, primarily in Tailscale SSH (running as root):
authorized sessions can exploit unix-socket forwarding (ssh -L/-R) through race conditions and missing privilege drops to access or replace privileged sockets such as Docker or systemd, achieving root control, stealing enrollment keys, and enabling rapid worm-like spread across the network.
Further issues include app-connector features that bypass network ACLs to reach cloud metadata or internal services, remote exposure of the local admin API via the serve feature, and unauthenticated denial-of-service or memory exhaustion attacks against headscale and the DERP client.
Dodge This Security retweeted
UPDATE: Palo Alto Networks Unit 42 has retracted its earlier assessment linking the European government agency attack to PHP2Shell exploitation.
The attack involved a vulnerable PHP application, but Unit 42 says it cannot confirm initial access was tied to the specific PHP2Shell CVEs.
We've updated our report ↓
🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European government entity in just 2 hours.
That's not all.
→ Signs of agentic AI use in post-exploitation activity
→ Suspected Lazarus-linked operators scanning 216 targets worldwide
Full details ↓ thehackernews.com/2026/10/ph…
Dodge This Security retweeted
Claude rejected my request to debloat my Samsung TV but DeepSeek-4.1-Flash-1017, the normal one, not the uncensored one, happily took care of it for me.
Why is Anthropic like this?
Dodge This Security retweeted
Mass surveillance and age verification (which leads to digital ID) are the two biggest threats we face today.
Do you agree?
Dodge This Security retweeted
Adversaries may gain access to NSS and DIB network devices through SNMPv1 and SNMPv2c read-write community strings. Keep your networks secure by upgrading to SNMPv3 which includes encryption and authentication. media.defense.gov/2022/Jun/1…
ALT The image shows a comparison of three types of Simple Network Management Protocols (SNMP). SNMPv1 and SNMPv2c are marked with red "X" symbols, indicating disapproval. SNMPv3 is marked with a green check mark, indicating approval.
Dodge This Security retweeted
KOSA does not “help parents keep their kids safe.”
It’s a federal digital ID and surveillance infrastructure disguised as “child safety.”
Really disheartening to see Florida republicans using government surveillance as their election talking points - I guess at least they don’t hide it. 😏
Dodge This Security retweeted
🧲 Community torrents · 26 Oct 2026
470 model torrents added:
• mudler/Laguna-XS-2.1-APEX-GGUF
• nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-NVFP4
• Comfy-Org/Flux-1-Schnell
• mradermacher/Qwen3.8-27B-Fable-5-Coding-Distilled-GGUF
• mistralai/Ministral-3-14B-Reasoning-2512
• Qwen/Qwen3-14B-Base
• mradermacher/Huihui-Qwen3.6-35B-A3B-abliterated-GGUF
• HauhauCS/Gemma4-31B-QAT-Uncensored-HauhauCS-Balanced-MTP
• HauhauCS/Gemma4-26B-A4B-Uncensored-HauhauCS-Balanced
• unsloth/Qwen3.5-9B-MTP-GGUF
• QuantStack/Wan2.2-S2V-14B-GGUF
• cahya/wav2vec2-large-xlsr-indonesian
• google/metricx-24-hybrid-xl-v2p6
• Comfy-Org/Chroma1-HD
• Qwen/Qwen2.5-Coder-32B-Instruct-GGUF
• mradermacher/Qwen3.8-9B-Distill-uncensored-heretic-GGUF
• openbmb/MiniCPM-V-4.7-35B-A3B-int4
• Qwen/QwQ-32B-GGUF
• nvidia/Qwen3-14B-FP8
• styly-agents/Wan2-2-pixel-animate
• Qwen/Qwen2-Audio-7B
• LiquidAI/d1-omni-600M
• tencent/Hy4-preview
• google/metricx-24-hybrid-large-v2p6
• zai-org/CogVideoX-2b
• google/gemma-4-12B-it-qat-q4_0-unquantized
• JetBrains/Mellum2-12B-A2.5B-Instruct
• bartowski/granite-embedding-107m-multilingual-GGUF
• dariolopez/roberta-base-bne-finetuned-msmarco-qa-es-mnrl-mn
• google/flan-t5-xxl
• mradermacher/Qwen3.5-9B-Claude-4.6-HighIQ-INSTRUCT-HERETIC-UNCENSORED-GGUF
• fleetml/Qwen3.8-27B-Uncensored-DSpark-RTX5090
• bartowski/FINAL-Bench_Darwin-27B-RSI-GGUF
• prithivMLmods/Gliese-Qwen3.5-9B-Abliterated-Caption
• nvidia/Alpamayo-R1-10B
• freakyskittle/RED-SNOW-5.3-FLASH-GGUF
• TokenTinkerer/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive-TTQ-GGUF
• efficient-speech/lite-whisper-large-v3-acc
• eliasalbouzidi/distilbert-nsfw-text-classifier
• eai6/whisper-base-bungoma.en
• anuashok/ocr-captcha-v2
• google/owlvit-large-patch14
• mlx-community/gemma-4-12b-coder-fable5-composer2.5-4bit
• InternScience/Sage-A1.5-F16-GGUF
• ellamind/propella-1-0.6b
• llmfan46/gemma-4-12B-it-uncensored-heretic-GGUF
• dx8152/Qwen-Edit-2509-Light-Migration
• eagle618/eagle-deepseek-v3-random
• DataSign/gliner-ja-pii-v1
• bofenghuang/asr-wav2vec2-ctc-french
• + 420 more
Browse new magnets ↓
Dodge This Security retweeted
rea v6.8 is now live
170+ contributors, 497 merged PRs!
much more adjustable & comfortable for agents to use
bug fixes & many new features + support
rea environments: point rea to agents and create new environments for training your own local models
github.com/morluto/rea/relea…
Dodge This Security retweeted
I *strongly* suggest disabling "idle compaction" in @claudeai until @AnthropicAI fixes their low-IQ safety-(mis)classifiers. Idle compact in unlucky place = distilled session that looks cyber. All prompts fail.
Dodge This Security retweeted
The best cyber defense is to continuously attack-test your own infrastructure before real attackers do. Find your weaknesses before your adversaries do.
Dodge This Security retweeted
❗️ A Florida police lieutenant is charged with using her police laptop to pull CCTV of her deputy chief leaving the day he was relieved of duty and texting it to 2 subordinates.
Warrants hit her phone, iCloud and ChatGPT logs.
The Proton user who reported her stayed anonymous.
