There is a difference between posting IOCs and TTPs for behaviors found and investigated. Not querying a hunting platform who collected data or from platforms indexing past occurrences. Go follow behaviors, discover GENUINELY NEW INTEL! That is the joy of the hunt!

IMHO, the Brotli bug (think zlib 20 years ago) is a bigger deal than PHP2Shell and all the "oooh, AI found it! AI found it!" hype.
Node2Shell is a terrible name.
I’m calling it Broccoli. 🥦

RT @MalwareBibleJP: PHPのWebフレームワーク「Laravel」で、TokenGuardによる認証の回避と、読み取り用APIからのデータ消去につながる2件の脆弱性が公表されています。特に「CVE-2026-114509」は、MySQL／MariaDBを使う…

the s in php stands for security

This is all just a very aggressive Cybersecurity Awareness Month campaign

So these guys are smishing heavily today, but their nginx backend is not working. Where can I submit a complaint? 🤔

threat intel is really just an excuse to become a data hoarder

Ruby’s turn 😅

Remember the GitLab bug? Well now it moved upstream into Ruby.

Multiple 10.0 CRITICAL exploits.

Patch now 🚨

Happy Friday 🤠

ruby-lang.org/en/news/2026/1…

Lack of consideration will kill whatever bond you have

‼️ StealC's seller is back, four months after Europol's Operation Endgame took the infostealer down.

The new remote access trojan, Stadia, reuses StealC's code and adds hidden desktop control and a live shell, Varonis says.

Former customers get a free month on the $900 tier.

trying to tell offline friends that the internet apocalypse is happening rn

Project Swarm from @GreyNoiseIO let's you get ground truth on exploitation in the wild. You can deploy your own honeypots to collect reconnaissance, exploitation, and post-exploitation artifacts. It's a dollar.

greynoise.io/project-swarm

One of your production certificate keys is just the number 4.

the beatings will continue until the labs give independent researchers easy access to SOTA uncensored models

Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.

foxio.io/blog/header-ac…

As if PHP2Shell wasn't enough for one day... now GitLab. 😅

🚨 CRITICAL GITLAB ALERT (CVSS 10.0)

CVE-2026-110264 could allow unauthenticated RCE on self-managed GitLab servers.

⚠️ Potentially affects 12 years of releases, dating back to 2014.

Patches available. Update immediately!

docs.gitlab.com/releases/patch…

#gitlab #cybersecurity

Today’s tune…. 🤷🏻‍♀️

so dark websites need a patch too since most of them are running php 😂

-----BEGIN EC PRIVATE KEY-----
4
-----END EC PRIVATE KEY-----

😬