Pinned Tweet
Drughub vendor usernames now tracked and added to threatactorusernames.com
#osint #threatintel #cti #cybersecurity #infosec #dnm
#osint #threatintel #cti #cybersecurity #infosec #dnm
12
8
161
19,491
the ShinyHunters and BreachForums larping and drama continues. this time with lulagain.
2
5
68
6,123
initial access broker selling Indonesian city gov VPN access. Fortinet SSL-VPN + cPanel access.
2
3
30
1,661
CTI Updates retweeted
Crypto Influencer “Kimchi” allegedly RUGS for $6.4M 🚨
Kimchi allegedly rugged his community after deleting all posts about his pump.fun collab. A new coin he launched minutes earlier crashed. He was reportedly given $6.4M in the rugged token.
Kimchi allegedly rugged his community after deleting all posts about his pump.fun collab. A new coin he launched minutes earlier crashed. He was reportedly given $6.4M in the rugged token.
0
1
15
686
CTI Updates retweeted
Uninvited guest: How a GRU spy connected to state hackers broke into the African Union’s diplomatic residence in Ethiopia
A video version of @Dobrokhotov and @michaeldweiss’ latest investigation.
A video version of @Dobrokhotov and @michaeldweiss’ latest investigation.
6
218
677
95,534
the Qilin ransomware group has listed Labaid Cancer Hospital & Super Speciality Centre (Bangladesh) on its leak site.
Labaid describes itself as a complete integrated cancer hospital focused on accurate diagnosis and quality cancer care in Bangladesh.
Labaid describes itself as a complete integrated cancer hospital focused on accurate diagnosis and quality cancer care in Bangladesh.
1
0
2
451
A forum user named 0xLinear is soliciting stolen API keys (AI services) and .env files, offering payment or revenue-share for leaked credentials.
3
1
17
835
the Akira ransomware group has listed 3 new victims this morning
»-(¯`·. SCHWAB-SYSTEM
»-(¯`·. Bravilor Bonamat
»-(¯`·. Bankruptcy Software Specialists
»-(¯`·. SCHWAB-SYSTEM
»-(¯`·. Bravilor Bonamat
»-(¯`·. Bankruptcy Software Specialists
0
0
12
553
an initial access broker named divisibly is selling access to two LATAM companies in the manufacturing industry. VPN access on both.
0
0
10
622
CTI Updates retweeted
I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:
Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:
a) a world-class an extreme case of imposter syndrome.
b) currently looking at some very confident-sounding but wrong LLM output.
I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.
I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).
The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".
People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.
So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.
What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).
The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.
LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:
a) a world-class an extreme case of imposter syndrome.
b) currently looking at some very confident-sounding but wrong LLM output.
I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.
I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).
The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".
People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.
So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.
What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).
The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.
LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
134
571
3,561
337,563
the Wallstreet ransomware group has listed Prism Medical Products on their DLS.
"Prism Medical Products is a U.S. home medical supplies provider specializing in wound care, along with ostomy, urological, compression, and other prescribed supplies. It works with clinicians ate coverage and deliver supplies directly to patients’ homes"
"Prism Medical Products is a U.S. home medical supplies provider specializing in wound care, along with ostomy, urological, compression, and other prescribed supplies. It works with clinicians ate coverage and deliver supplies directly to patients’ homes"
0
2
6
504
CTI Updates retweeted
Apparently Twitter allows zalgo text in hashtags so posts have started showing up with hashtag hyperlinks that escape from the posts borders.
Check this out. #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵
Check this out. #̢̛ͥ̀̽̽ͨ̌̓͆̇̀̽ͦͨͫͯ̏̎̇̈̚͜҉̕͢͏͡҉̸̶̛͢͡҉̵̨̭̳̘̹̫͔͖̜̠͖̫̲̖̱̤̻̖͉͢͞͡ͅͅ͏̸̷̢͑̊̀̐ͣͭͭ̉͂ͨ̽͒̊̎͛ͪ̊̎ͩͧ̀͝͠͠͏̸̵̵̷̵
9
7
96
3,958
the Patched hacking forum has been offline for an entire month. They have finally released a statement as to why.
"On September 23, a Russian drone strike on telecommunications facilities in Ukraine damaged the data center hosting our servers. We later learned that the data ups had also been damaged. Our servers and backups were with two separate hosting providers, but the attack did not affect just one provider; several hosting companies in the region were impacted.
We kept backups in three places: two separate physical devices and one cloud storage service. According to our providers, the drives are in good condition and are waiting in the queue to be copied. Thousands of drives are being recovered, which is why the process has taken so long."
"On September 23, a Russian drone strike on telecommunications facilities in Ukraine damaged the data center hosting our servers. We later learned that the data ups had also been damaged. Our servers and backups were with two separate hosting providers, but the attack did not affect just one provider; several hosting companies in the region were impacted.
We kept backups in three places: two separate physical devices and one cloud storage service. According to our providers, the drives are in good condition and are waiting in the queue to be copied. Thousands of drives are being recovered, which is why the process has taken so long."
1
5
35
7,839
some interesting stats from the Cloudflare CEO about the recent PHP vuln and the volume of exploitation attempts
1
3
13
2,449
