Seth retweeted
Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
You can still focus on detection coverage today.
Security Labs writeup (coverage + guidance): elastic.co/security-labs/…
Most PHP RCEs converge atever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.
• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root
The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.
We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.
The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.
(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)
Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.
Guidance + every rule link below.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
You can still focus on detection coverage today.
Security Labs writeup (coverage + guidance): elastic.co/security-labs/…
Most PHP RCEs converge atever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.
• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root
The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.
We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.
The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.
(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)
Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.
Guidance + every rule link below.
3
22
74
7,134
Seth retweeted
We're hiring a Principal Security Research Engineer (AI Security)! Looking for someone with a strong background in threat research, detection & offensive security, and a passion for detecting and preventing AI threats.
Apply here: tinyurl.com/2pd2u8sr
Apply here: tinyurl.com/2pd2u8sr
3
13
40
5,052
Seth retweeted
FWIW we notified the event organizers before it took place. Not sure if a vetting process is feasible with the amount of events going on. But for future event-goers, please be mindful of what you run on your computer.
For anyone interested in a deep dive: elastic.co/security-labs/….
For anyone interested in a deep dive: elastic.co/security-labs/….
🚨NEW: According to a Singapore police report filed by an attendee, organizers using the names “Apex Accelerator” and “Stone Venture” promoted a crypto security event called “Don’t Get Played” during TOKEN2049 week.
They allegedly pressured attendees to install software that ote control of their computers.
0
5
5
661
Seth retweeted
An Iranian threat actor is still running a GitHub-based loader with low detection rate on VirusTotal, six weeks after first submission.
We went hunting after reading Unit 42's Blinder Tunnel report and found a new variant with infrastructure changes not covered in prior Workers relay, a new GitHub account, and credential-rotation instructions hidden inside HTML comments on Microsoft/vscode issues, encrypted per-victim so only the targeted host can read them.
The loader was delivered via an Inno Setup installer themed as a Dubai Airport careers IT assessment, targeting Iraq.
Technical analysis + decompiled source + IOCs:
github.com/NextronSystems…
We went hunting after reading Unit 42's Blinder Tunnel report and found a new variant with infrastructure changes not covered in prior Workers relay, a new GitHub account, and credential-rotation instructions hidden inside HTML comments on Microsoft/vscode issues, encrypted per-victim so only the targeted host can read them.
The loader was delivered via an Inno Setup installer themed as a Dubai Airport careers IT assessment, targeting Iraq.
Technical analysis + decompiled source + IOCs:
github.com/NextronSystems…
2
27
126
9,970
Seth retweeted
We identified an Iran-aligned actor targeting Middle East critical infrastructure in aviation and telecom. Attackers used Dubai Airports coding lures, a Peaky Blinders theme, weaponized .csproj files and GitHub C2 to deploy a RAT. Read our full analysis: bit.ly/3WhXqLt
2
37
127
10,025
K-shaped (meta)cognition
I’ve taken a surprising number of calls lately from people wanting to understand how human reasoning differs from machine inference.
How do analysts reason through uncertainty? How do we form hypotheses? What makes us notice one piece of evidence and ignore another? Where does intuition come from? How are human judgment and machine inference fundamentally different?
The more we try to understand what LLMs can and can’t do effectively, the more we’re forced to examine the cognitive processes we’ve traditionally taken for granted in ourselves.
Among many who embrace it, that's leading to greater metacognitive awareness... people becoming more conscious of how they reason, not just what conclusions they reach.
#DFIR #AI #LLM #Metacognition
0
0
1
107
Seth retweeted
I’ve taken a surprising number of calls lately from people wanting to understand how human reasoning differs from machine inference.
How do analysts reason through uncertainty? How do we form hypotheses? What makes us notice one piece of evidence and ignore another? Where does intuition come from? How are human judgment and machine inference fundamentally different?
The more we try to understand what LLMs can and can’t do effectively, the more we’re forced to examine the cognitive processes we’ve traditionally taken for granted in ourselves.
Among many who embrace it, that's leading to greater metacognitive awareness... people becoming more conscious of how they reason, not just what conclusions they reach.
#DFIR #AI #LLM #Metacognition
How do analysts reason through uncertainty? How do we form hypotheses? What makes us notice one piece of evidence and ignore another? Where does intuition come from? How are human judgment and machine inference fundamentally different?
The more we try to understand what LLMs can and can’t do effectively, the more we’re forced to examine the cognitive processes we’ve traditionally taken for granted in ourselves.
Among many who embrace it, that's leading to greater metacognitive awareness... people becoming more conscious of how they reason, not just what conclusions they reach.
#DFIR #AI #LLM #Metacognition
2
5
26
5,978
Seth retweeted
Our team recently did a full teardown on #RevStealer. The malware is full of features and super interesting, unlike a lot of AI-generated stuff we are seeing nowadays.
Blog: elastic.co/security-labs/…
Whitepaper: assets.contentstack.io/v3/assets/blte…
Blog: elastic.co/security-labs/…
Whitepaper: assets.contentstack.io/v3/assets/blte…
0
31
64
4,613
H/t again to @ValidinLLC and @500mk500. We got some great pivots through banner hashes and bouncing finds off maltrail.
Also some white glove assistance from @SreekarMad.
Also some white glove assistance from @SreekarMad.
Hijacked YouTube channels are pushing an emerging infostealer.
We're tracking #REVSTEALER: at least 17 compromised channels advertising free game cheats, funneling viewers to 2 malicious domains.
The stealer itself is built for long-term operation:
- Sandbox scoring: 10 erminates at a score of 7+
- App-Bound Encryption bypass: reads the decrypted key from browser memory under debugger control
- EtherHiding: fallback C2 stored in a Polygon smart contract, swappable without touching the binary
- Gaming focus: session cookies from Steam, Battlenet, and Roblox, feeding account resale markets
- 4,700 related samples hit VirusTotal in the past year.
Our team observed 4 follow-on modules that haven't been publicly documented until now.
Full analysis, whitepaper, YARA rule, and an IDAPython string decryption tool by @k33b0i, @soolidsnakee and @DanielStepanic:
Blog: go.es.io/4iJZRQe
Whitepaper: go.es.io/4xcanmZ
1
3
6
674
Seth retweeted
Cybersecurity is basically Clue. Except instead of Colonel Mustard, it's a compromised service account...
1
2
3
287
Seth retweeted
yo anyone want to come do cool AI Security Research on my team @elastic? Got an open spot. DM me if your interested.
jobs.elastic.co/jobs/engineeri…
jobs.elastic.co/jobs/engineeri…
3
3
8
946
Seth retweeted
My team is hiring a Principal Threat Hunting & Emulation Engineer @elastic 🔍 Lead hypothesis-driven hunts, run adversary emulation, and use AI to find what automated detection misses. jobs.elastic.co/jobs/engineeri…
0
4
7
304
Seth retweeted
Here is our analysis of the Shai-Hulud keyv supply chain compromise and CHAINDROP payload. Happy hunting!
#malware #supplychain
elastic.co/security-labs/…
#malware #supplychain
elastic.co/security-labs/…
0
4
9
1,081
Seth retweeted
@bluish_red_ Thanks for the tag! We pivoted off of the indicators in the main ElasticSecurity post and shared more findings here: x.com/ExpelSecurity/…
In this version, CylindricalCanine still downloads the second stage from a text file hosted in the CDN. However, the files don't have normal extensions anymore.
Looking in the directory shared by @elasticseclabs, we found two new certificates of interest.
🧵1/5
2
1
3
253
Good stuff. And h/t to @ExpelSecurity and Aaron Walton (sorry, couldn't find X handle)
Really thorough reporting.
These pop-up 🇨🇳 "technology" companies being handed certs often enough to see campaigns this big emerge is starting to undermine the trust ecosystem.
Really thorough reporting.
These pop-up 🇨🇳 "technology" companies being handed certs often enough to see campaigns this big emerge is starting to undermine the trust ecosystem.
Elastic Security Labs is tracking Golden Gh0st RAT targeting Western companies, expanding beyond its previously documented targeting of financial organizations in the Asia-Pacific region.
Same TTPs as @ExpelSecurity CylindricalCanine research post: go.es.io/3TEZ0G6
The ivered as a fake screenshot with a .pif extension, signed with a revoked certificate and hosted on myphotos[.]s[.]gy.
Follow-on payloads were staged in a public Google Cloud Storage bucket at storage[.]googleapis[.]com/nikeupdat/.
Multiple stages, and every one is either validly code-signed or never exists on disk as an executable.
Abused code-signing certificates, all valid at time of use.
Two are EV, same CA, both dated 2026-07, issued to two different "Private Organization" subjects:
- 杭州思维宇宙科技有限公司 (Hangzhou Siwei Yuzhou Technology), thumbprint: 14E0FCA3F0F656D1AF6EA66E1B2B7C6B4ACD8E2D
- Dongguan Jieshan Technology Co., Ltd, thumbprint: C29C3C494A348EA879ABFF50DD56B85E9CB6366A
IOCs:
api[.]probref[.]com:5188 (C2)
storage[.]googleapis[.]com/nikeupdat/
myphotos[.]s[.]gy
5ef6019fb6ee1db1201ee479a68669b47eb0d5d82770dbd30b05f46ccbc68f4f
b6cb6d5de2c62aa1351b1b240dc223c3d6fa95083cf43b2866d84a8a6c4d0446
2
1
4
869
@ExpelSecurity Fun VT hunt:
```
"signature:"Certum Extended Validation Code Signing 2021 CA" and tag:overlay and p:5+ and signature:"Technology Co., Ltd."
```
```
"signature:"Certum Extended Validation Code Signing 2021 CA" and tag:overlay and p:5+ and signature:"Technology Co., Ltd."
```
0
1
2
153
Seth retweeted
The application forms are up! Sharing them here for anyone interested.
AI Security - Principal Security Research Engineer I: jobs.elastic.co/jobs/engineeri…
macOS / Container Security - Senior Security Research Engineer: jobs.elastic.co/jobs/engineeri…
Principal Security ML Research Engineer: jobs.elastic.co/jobs/engineeri…
If you don't meet the location requirement, feel free to DM me, and we can see if we can make something work.
AI Security - Principal Security Research Engineer I: jobs.elastic.co/jobs/engineeri…
macOS / Container Security - Senior Security Research Engineer: jobs.elastic.co/jobs/engineeri…
Principal Security ML Research Engineer: jobs.elastic.co/jobs/engineeri…
If you don't meet the location requirement, feel free to DM me, and we can see if we can make something work.
My team (Threat Research and Detection Engineering) is hiring for three remote security roles at @elastic.
🤖AI Security - Principal Security Research Engineer I
🍎macOS / Container Security - Senior Security Research Engineer
📊Machine Learning - Principal Security ML Research Engineer I
If you are interested and have deep technical security expertise and a background in any of the above, feel free to reach out for details!
0
3
7
1,245
Seth retweeted
🤔GenAI CLIs and IDE agents are starting to look a lot like LOLBins on developer laptops.
I shipped LOL-GAI (Living Off Legitimate GenAI): open catalog of 123 tools with binaries, signing, artifacts, abuse recipes, MITRE, and a JSON/CSV API.
lolgai.io
I shipped LOL-GAI (Living Off Legitimate GenAI): open catalog of 123 tools with binaries, signing, artifacts, abuse recipes, MITRE, and a JSON/CSV API.
lolgai.io
0
6
8
441