Pinned Tweet
I've decided to put a screenshot showing the hex editor view of a Turla Kazuar sample behind acrylic glass on my desk to always remind me, why I am doing all this ...
because I 💛 to be a pain in the neck of the bad guys
x.com/cyb3rops/statu…
because I 💛 to be a pain in the neck of the bad guys
x.com/cyb3rops/statu…
It seems that I have some fans over in Russia 🐻
#TurlaLicksAss
thx to the FireEye analyst who brought this to my attention
virustotal.com/gui/file/4417c…
183
244
2,185
Today, 25 years ago, Windows XP was released
25 years later, somewhere in a factory, it’s still running a critical system
youtu.be/GAv1EwoRnec?is…
25 years later, somewhere in a factory, it’s still running a critical system
youtu.be/GAv1EwoRnec?is…
4
2
21
2,894
Florian Roth ⚡️ retweeted
Just in: France's Prime Minister asked telecom companies to prepare to block social media platforms. "I wish to have the ability to temporarily suspend access to these services in case of a repeat of urban violence," he wrote. @blast news broke the story.
Information exclusive Blast : le Premier ministre a préparé la coupure des réseaux sociaux pour le 24 octobre
Deux jours avant la manifestation du 24 octobre, le Premier ministre Sébastien Lecornu a demandé à Orange, SFR, Free et Bouygues Telecom de se tenir prêts à couper l’accès à TikTok, Instagram ,Snapchat et X. Blast révèle la lettre et le compte rendu de la réunion qui a suivi, où les opérateurs ont exprimé leurs doutes. Le gouvernement avait déjà utilisée cette mesure liberticide en Nouvelle-Calédonie en 2024, avant d’être désavoué par le Conseil d’État.
Par @yanmdi.
blast-info.fr/articles/2026/…
276
2,035
5,567
308,416
Florian Roth ⚡️ retweeted
Essa descoberta foi bizarra, mas vindo da NVIDIA que capava as GPUs na época de mineração de cripto, não é surpresa nenhuma.
Todas as 3090 estão com metade da capacidade bloqueadas por FIRMWARE. Ou seja, se você tiver uma e aplicar o patch, vai desbloquear a outra metade e ficar com uma GPU quase 2x mais potente que antes.
VSF NVIDIA.
Todas as 3090 estão com metade da capacidade bloqueadas por FIRMWARE. Ou seja, se você tiver uma e aplicar o patch, vai desbloquear a outra metade e ficar com uma GPU quase 2x mais potente que antes.
VSF NVIDIA.
Confirmed that 3090 unlock is successful
with 360watt power wall, I got 75T -> 135T (measured in Pytorch)
Which is insane
I used github.com/Zagitta/gpu-un… with commit a9b0c75
167
656
10,597
412,285
Florian Roth ⚡️ retweeted
CrowdStrike Intelligence has reproduced variants of remote code execution (RCE) tied to PHP2Shell.
Why hasn't widespread exploitation been confirmed?
Our researchers explain the technical obstacles and what organizations should know: crwdstr.ke/6014BHbC12
Why hasn't widespread exploitation been confirmed?
Our researchers explain the technical obstacles and what organizations should know: crwdstr.ke/6014BHbC12
15
38
136
15,540
Florian Roth ⚡️ retweeted
Everyone who owns hardware with abominable software (like Sonos players) owes a debt of gratitude to Venkatraman Srinivasan and the rest of the eMudhra gang in Bengaluru, Karnataka. Without their gross negligence, it'd be a lot harder to counterfeit certificates and fix the sw🙏
89
373
4,871
217,417
Florian Roth ⚡️ retweeted
@Suhailard several OAI people say there are unfixable bugs in hardware that are exploitable by AI models directly speaking machine code so even if we could solve software that’s not enough. We need defense to move faster than offense if that’s even possible we may just have a new normal that requires adapting to insecure software (bank transfers require going into a branch and taking a dna test 🤣😬)
186
277
4,673
1,306,510
Florian Roth ⚡️ retweeted
An update to our threat brief on PHP CVE-2026-109618 & CVE-2026-109619: We observed an attack using agentic AI platforms for rapid post-exploitation and access to MFA secrets within 2 hours. Read the updated brief for analysis and hunting queries: bit.ly/4z7Txr2
8
37
132
12,635
Florian Roth ⚡️ retweeted
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/products/…
🔗 Technical details from Wiz: wiz.io/blog/php2shell…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/sizing…
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/products/…
🔗 Technical details from Wiz: wiz.io/blog/php2shell…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/sizing…
12
115
490
119,804
Florian Roth ⚡️ retweeted
⚠️ Python packages are vulnerable to remote code execution via the same node2shell CVE-2026-111497.
You may be affected if you are using the Brotli library. Note this is a very popular dependency (⬇️100m/month)
Other major services likely affected. We will communicate ASAP when detects this. Patches available.
You may be affected if you are using the Brotli library. Note this is a very popular dependency (⬇️100m/month)
Other major services likely affected. We will communicate ASAP when detects this. Patches available.
26
149
667
70,512
Could Fortinet please have one of the latest LLMs review and unfuck the source code they ship? The tokens would probably cost less than one of their appliances. And every customer would benefit from the fixes.
Network edge devices can give threat actors a direct path into an organization.
In a campaign linked to threat actor #k0t, Group-IB and NyxLab observed large-scale targeting of internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems, with more than 70,000 exposed credentials and related data identified.
The operators combined vulnerability exploitation and brute force activity to gain initial access, then moved deeper into victim environments using tools such as NetExec, Mimikatz, and Impacket, while MeshCentral and AdaptixC2 provided persistence and command-and-control. The investigation also observed data exfiltration through Rclone to Wasabi S3 and MEGA.
Overlaps with organizations later listed by #ransomware groups including #Qilin and #TheGentlemen raise the possibility that the operators may be acting as Initial Access Brokers, although the relationship remains unconfirmed.
Read the full technical analysis: link.group-ib.com/4yDaMQY
15
20
168
11,501
Florian Roth ⚡️ retweeted
I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:
Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:
a) a world-class an extreme case of imposter syndrome.
b) currently looking at some very confident-sounding but wrong LLM output.
I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.
I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).
The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".
People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.
So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.
What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).
The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.
LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:
a) a world-class an extreme case of imposter syndrome.
b) currently looking at some very confident-sounding but wrong LLM output.
I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.
I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).
The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".
People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.
So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.
What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).
The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.
LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
135
574
3,586
343,390
Florian Roth ⚡️ retweeted
Blackhat 2027 vendor hall is going to be disgusting:
Two giant booths in the center, selling gated access to “cyber” specialized models. Around them smaller booths selling wrappers around those models at extra token cost.
If they ban non-US models, we are fucked.
Two giant booths in the center, selling gated access to “cyber” specialized models. Around them smaller booths selling wrappers around those models at extra token cost.
If they ban non-US models, we are fucked.
openai restricted astra access to security researchers, i think it is a mistake. there is a temporary capability gap that defenders could take advantage, and we shouldn't waste it.
put researchers through daybreak, vet them all you want, but remove the red/blue distinction. give 1000 vetted researchers access to the best models and monitor the hell out of their usage to detect abuse.
12
10
167
6,154
Our OSS artifact scanning picked this up too
The funny part, at least for us, is that this is a side project built around the scanner and detection rules we already ship for endpoints. Its initial LLM triage costs about $3 a day.
We download packages from public registries, eir files through THOR Thunderstorm. The generic detection rules flag suspicious code, obfuscation and recurring attacker tradecraft. Only artifacts with findings reach the LLM, which gets the matched strings and surrounding context to assess what’s going on.
Across roughly 114,000 artifacts a day, about 4% reach that initial LLM pass. The rest never generate a token bill.
In this case, an existing generic Python rule flagged the malicious sitecustomize.py. We already had the detection logic; we’re just applying it to packages downloaded from registries as well as files found on endpoints.
And that’s what amuses me about this. Supply-chain security attracts substantial funding, and specialist vendors are reporting this compromise. We picked it up by reusing years of endpoint detection engineering in an internal project, with an initial LLM triage bill averaging $2.88/day.
Pretty useful bycatch.
We described the pipeline here:
nextron-systems.com/2026/06/19/oss…
The funny part, at least for us, is that this is a side project built around the scanner and detection rules we already ship for endpoints. Its initial LLM triage costs about $3 a day.
We download packages from public registries, eir files through THOR Thunderstorm. The generic detection rules flag suspicious code, obfuscation and recurring attacker tradecraft. Only artifacts with findings reach the LLM, which gets the matched strings and surrounding context to assess what’s going on.
Across roughly 114,000 artifacts a day, about 4% reach that initial LLM pass. The rest never generate a token bill.
In this case, an existing generic Python rule flagged the malicious sitecustomize.py. We already had the detection logic; we’re just applying it to packages downloaded from registries as well as files found on endpoints.
And that’s what amuses me about this. Supply-chain security attracts substantial funding, and specialist vendors are reporting this compromise. We picked it up by reusing years of endpoint detection engineering in an internal project, with an initial LLM triage bill averaging $2.88/day.
Pretty useful bycatch.
We described the pipeline here:
nextron-systems.com/2026/06/19/oss…
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
5
12
39
5,824
Florian Roth ⚡️ retweeted
Unsurprisingly, DeepSeek V4.1 Flash 1017 is mogging all other models on our cybersecurity benchmark
- At pass@3, it rediscovered 87.5% of the benchmark CVEs (28/32). That ties DeepSeek V4 Pro 0813 for 2nd place, behind only GPT-6 Astra (90.6%)
- Single-run recall is 70.8%, k 4.7. The previous Flash was at 65.6%
- Precision went from 78.9% to 86.4%, so most false positives are now gone
Cost: $2.40 per CVE found. That’s 27x cheaper than Opus 5 ($64.96) and 56x cheaper than Astra ($135.23)
@deepseek_ai keeps pushing the Pareto frontier
1/4 🧵
- At pass@3, it rediscovered 87.5% of the benchmark CVEs (28/32). That ties DeepSeek V4 Pro 0813 for 2nd place, behind only GPT-6 Astra (90.6%)
- Single-run recall is 70.8%, k 4.7. The previous Flash was at 65.6%
- Precision went from 78.9% to 86.4%, so most false positives are now gone
Cost: $2.40 per CVE found. That’s 27x cheaper than Opus 5 ($64.96) and 56x cheaper than Astra ($135.23)
@deepseek_ai keeps pushing the Pareto frontier
1/4 🧵
31
63
724
53,759
Florian Roth ⚡️ retweeted
"The previous update (October 22 16:18 UTC) reported that Sophos observed successful exploitation of PHP2Shell in customer environments. Upon further analysis, we are correcting that assessment as Sophos customer telemetry shows scanning and a small number of failed exploitation attempts. As of this update, there is no evidence of a successful compromise due to these vulnerabilities." sophos.com/en-us/blog/pro…
0
24
86
8,202
Florian Roth ⚡️ retweeted
‼️ Fortinet atklājuši vairākas kritiskas un augstas bīstamības ievainojamības savos produktos FortiOS, FortiManager un FortiAnalyzer. Atjauninājumi paredzēti šodien (22.10.2026.). Ražotājs aicina tos uzstādīt nekavējoties pēc publicēšanas. Vairāk: cert.lv/lv/2026/10/iev…
1
22
34
10,040
Florian Roth ⚡️ retweeted
We wrote up how to find every PHP service you run, including the ones on odd ports, under sub-paths, inside appliances and containers, and how to patch and verify them.
Commands plus prompts for your coding agent.
We also started SecureTheWeb.org
It checks Chaos for ected version and emails their security@ inbox for free, with the fix.
We are enriching Chaos over the coming months so the next time a bug like this lands, the affected services are mapped fast and remediation starts sooner.
Read: go.projectdiscovery.io/SIC1Tut
Commands plus prompts for your coding agent.
We also started SecureTheWeb.org
It checks Chaos for ected version and emails their security@ inbox for free, with the fix.
We are enriching Chaos over the coming months so the next time a bug like this lands, the affected services are mapped fast and remediation starts sooner.
Read: go.projectdiscovery.io/SIC1Tut
5
52
209
25,585
I think this is more serious than many people realize.
Not every Node.js server is vulnerable, of course. The application needs to process untrusted Brotli-compressed data.
But how common is that? Well, common middleware configurations in Express 5 can already expose the hout developers explicitly using Brotli anywhere in their code.
So we’re potentially looking at a pretty large attack surface, although nobody really knows how many deployments are exploitable yet.
I wouldn’t be surprised to see automated scanning and exploitation attempts targeting this very soon.
Patch your Node.js runtimes.
Not every Node.js server is vulnerable, of course. The application needs to process untrusted Brotli-compressed data.
But how common is that? Well, common middleware configurations in Express 5 can already expose the hout developers explicitly using Brotli anywhere in their code.
So we’re potentially looking at a pretty large attack surface, although nobody really knows how many deployments are exploitable yet.
I wouldn’t be surprised to see automated scanning and exploitation attempts targeting this very soon.
Patch your Node.js runtimes.
Liked PHP2Shell? You’re gonna love Node2Shell.
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shel…
8
72
254
27,863
Florian Roth ⚡️ retweeted
Liked PHP2Shell? You’re gonna love Node2Shell.
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shel…
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shel…
45
262
1,414
235,832