We are seeing a tsunami of attempts...🤣
73 unique IPs and no validated exploitation in the wild.
73 unique IPs and no validated exploitation in the wild.
2
1
13
678
We have the first confirmed PHP compromise that I'm aware of (safe to assume there are more undisclosed). To be honest, what else do we expect? This is more normal as opposed to widespread lurking agent swarms we were told exist.
Sorry folks, we have a confirmed PHP compromise with post-exploit activity. Still not the widespread outbreak we all braced for, but it’s actively exploited in the wild. Updated threat brief:
unit42.paloaltonetworks.com/cve-2026-10961…
2
1
11
4,308
GS-InfoSec retweeted
an example of why understanding the world, architecture and organisations....
In Shodan there's over 2 million exposures for X-POWERED BY PHP
but only ~20K of those are X-Powered-By: PHP/8.3.26
and well.... there's lots of different versions....
So this part alone makes a cape.
Attack surface, diversity and how things are tired together (architecture) matter when it comes to understanding how much, or how little, impact, a vulnerability might have.
In Shodan there's over 2 million exposures for X-POWERED BY PHP
but only ~20K of those are X-Powered-By: PHP/8.3.26
and well.... there's lots of different versions....
So this part alone makes a cape.
Attack surface, diversity and how things are tired together (architecture) matter when it comes to understanding how much, or how little, impact, a vulnerability might have.
4
7
50
2,880
🤔
In the 4 days since php2shell was published:
* 1,448 more CVEs published.
* No published exploit code for any in Metasploit or Exploit-DB.
* VulnCheck added 25 on its KEV list. 24 are old bugs.
* CISA added just 1 to its KEV list, the only new bug anyone has seen adversaries exploit.
Nothing in the record shows AI or anything else driving up how many vuln adversaries exploit, or how fast. Adversaries keep working a small set of bugs until those stop paying, and only then move on.
Patch php2shell because there are too many eyes are on it not to. Then apply the same rule to everything else, prioritize patching all systems against what adversaries exploit. It sounds simple, and the evidence says it’s what we still haven’t done that actually works.
0
0
0
52
I think the privacy violations have been normalized, are way out of hand, and I don’t generally have high expectations for tech like some privacy critics… I mean, it would be nice, but it’s complicated.
This feels quasi-criminal to me.
I'm no lawyer, but I am not ok with criminal shit being done, without anyone's knowledge, and then it being somehow made un-criminal because it was in the 4,000 page terms and conditions and technically there's a way to opt out.
Super gross.
0
0
1
166
GS-InfoSec retweeted
AI has really reduced the friction for novices to create a lot more work for experts. This php2shell event is just a widescale example of it.
6
7
66
3,019
I think this is the case with many uses of these “AI tools.” A professional guides and uses it as a tool. If you don’t know what you don’t know, AI is steering you. You are the tool? 🤣
We’ve seen plenty of people try to vibe code the php exploit who have no experience in the domain. Failure. Over and over. Then people who know what they are doing in exploit dev, marginal success.
People would say anyone with a frontier LLM can just say “hack this site, make no mistakes” and I won’t argue, some shallow bugs will fall out this way for a while. But the most successful applications of LLMs are coming from experts who at least know how to dissect the problem, change the models thought direction, and have put engineering into harnesses and skills. I’ve seen this across several sub sections of cyber. And that requirement will only get more mandatory as all the shallow bugs shake out. Just my 2c and observation.
🫶
(Also beware of influencers trolling with opinions on this topic. It’s often just for fake clout and clicks)
0
0
3
393
This is terrible imo. Besides the tutor, I prefer the human element. Live music?! I’m not watching robots play live music.
@Olking07utomate jobs and concentrate wealth at the top, shrinking the middle class. Human elements become exclusive luxuries:
1. Real human customer service
2. Human-cooked restaurant meals
3. Live performances by real artists
4. Face-to-face doctor visits
5. Human tutors for kids
6. Handcrafted clothes and goods
7. Spacious quiet homes
8. True offline privacy
9. Clean air environments
10. In-person therapy sessions
Most will get AI substitutes.
0
0
2
48
GS-InfoSec retweeted
@i0n1c I’m amused at how people who think everything can’t be overhyped and still be an issue.
Because the whole: if not X must be Y makes no sense to me.
The world is grey. It’s complex.
Because the whole: if not X must be Y makes no sense to me.
The world is grey. It’s complex.
1
2
18
2,798
Threat intelligence is a decision support. TI doesn’t make decisions. Business leaders weigh their options and make business decisions. Reality, cybersecurity isn’t top of the list.
Since people are yelling at threat intelligence professional for "downplaying the severity of the PHP vulnerability" (communicating clear concise information about what they're actually seeing). It feels necessary to explain what threat intelligence actually is.
Consider a hypothetical hospital or a power company. A lot of systems are built using very old PHP versions. It's not uncommon for PHP to add/remove/change features from version to version. So if you're a certain number of versions behind, updating to the latest version will break your software by removing or changing functionality it needs.
In that case, the provider has two options:
1) take their software offline until they can update the code to match the latest PHP version.
2) panic install the patch and break their software, leading to a massive outage.
In both cases, that is basically a 100% chance of an outage. On the other hand, maybe they get hacked, maybe they don't. Maybe that hack causes an outage, maybe it doesn't. Realistically, under these circumstances, the chance of an outage is actually higher with patching than with not patching.
If that outage would result in the hospital having to shut its doors or a power company's infrastructure going offline, what is the correct move? Chance being hacked, or knowingly cause an outage that threatens lives?
Cybersecurity is important and all, but there are risks far greater than being hacked. I would absolutely love it if I could just log onto IDontKnowWhyTheyRenamedThisSite dot Com, be like "vulnerability bad, pls patch" and everyone installs the patch. That is not the world we live in.
Now, if I start seeing people building ransomware that can copy itself from system to system using the PHP vulnerability, and I communicate that, it changes a lot of people's risk calculations. Their option shift towards either a 100% chance of an outage, or an extremely high chance of an outage + catastrophic data loss. In this case they would most likely pull the trigger on patching or taking their software offline.
While the hypotheticals I gave are extreme cases, many organizations accept being hacked as a cost of doing business. Taking offline software that's critical to organizational function is not an easy decision to make, and does not get taken lightly.
We don't live in LaLa land where every org installs every patch for every vulnerability the day it goes live. Cybersecurity is expensive and time consuming. Getting people to even patch systems at all is an endless uphill battle.
Most orgs know that something like 1 out of ever 10,000 critical vulnerabilities actually gets exploited. And probably less than 50% of these "this is the worst of the worst vulnerability ever, the sky is falling" type vulnerabilities leads to significant damages.
It takes a lot of time to build trust, and very little time to lose it. Overhype a couple of vulnerabilities and people will very quickly stop listening to you. It's extremely easy to end up being the boy who cried wolf. There's only so many times you can spin security teams into a frenzy before they stop listening to you entirely.
Orgs also have limited resources, so when you yell fire, there is a good chance they're committing resources they don't have. Making people stay up all night, pulling people off other issues, bringing in outside help. You probably don't want to be responsible for some org getting ransomwared because they redirected all their security resources to some vulnerability you think is really cool.
Nobody is downplaying anything. They are communicating exactly what they see/know about the issue so that organizations can make the most informed risk management decisions possible. That is the game, and that is what threat intelligence exists for.
If you want to handle an organization's security for them and personally take on the risk of potentially costing them billions or killing their customers, join an MSSP or a critical infrastructure provider. I can promise you it's way more stressful than you think.
It's not our job to decide organization's own risk models for them. It's our job to give the most information possible to the people who do. And just because some vulnerability researcher thinks we're not hyping up the vulnerability enough doesn't make them right.
Last I checked, only something like 9.3 million out of 42 million systems had installed the patch. This is the reality we live in. If we yell fire, then maybe we can bump that number up to 10 million, but if nothing happens, it'll be at the cost of maybe 2 million less systems getting patched next time around.
These are real risks we have to live with. These aren't one-off incidents. People will remember how accurate our advice was the next time around. And more or less people may decide to install security fixes based on how accurately we communicated the risks during previous incidents.
Threat intelligence is an extremely complex numbers game where there is never any right answer.
0
0
9
340
GS-InfoSec retweeted
@arekfurt It's very hard for me to believe anyone that cares about security is still vulnerable. Our industry cannot stay laser focused on this one set of vulns forever. The job is actually already done. Everything else is incident response and intelligence.
1
1
9
459
This is why we’re here. Do it with your sunglasses on.
who remember HAFNIUM?
who remembers MSBLASTER?
who remembers WANNACRY?
who remembers LOG4SHELL?
who remembers {INSERT SOME OTHER NAME}
guys: this is the job! in 10 years time there will be more names to add to the list, and then in 10 years after that... even more.
This is the game!
1
0
3
345
Think clearly. Dig into the info. Translate it to risk. People are acting like a patch is an incident.
@ZackKormanw@zetalyraet if we throw millions, potentially billions, of dollars at finding bugs in software, we’re going to find bugs. It’s almost a self fulfilling prophecy.
The security industry has spent decades operating under the assumption that we’ll never eliminate every bug. Instead, we’ve built layers of mitigations that raise the cost of exploitation and shift the economics in favor of defenders.
1
0
5
267
The industry lacks risk assessment capability amid AI hype.
Nothing so illustrates the erosion of vulnerability intelligence than the apparent widespread inability, or rather loss of prior capability, to understand and assess the engineering task array required for reliable portfolio weaponization, as distinct from PoC demonstration. And at what threshold even a partially reliable portfolio may be effective under what CONOPs.
0
0
9
432
This is the underlying problem, if you were digging into Node2Shell the last few days.
Expect to see more broad impacts like this, which begs the question... Did your org have a hard time with this the last few days?
You need to think about risk based prioritization, how you measure risk, and how you respond. Is it external facing, is it actively accepting requests, are there controls in place, what are your supply chain risks, etc.
Prioritization and resource management is going to be the hot item moving forward as evidenced in CISAs advice weeks ago for risk based prioritization. A lot of us have been saying this for a long time.
broccoli2shell.com
Expect to see more broad impacts like this, which begs the question... Did your org have a hard time with this the last few days?
You need to think about risk based prioritization, how you measure risk, and how you respond. Is it external facing, is it actively accepting requests, are there controls in place, what are your supply chain risks, etc.
Prioritization and resource management is going to be the hot item moving forward as evidenced in CISAs advice weeks ago for risk based prioritization. A lot of us have been saying this for a long time.
broccoli2shell.com
0
0
4
78