Luis Dalmolin retweeted
Kids today will never understand the power this little icon held back in 2014
808
6,341
57,948
2,304,398
Working on _very_ legacy projects before AI was very time consuming, but I must say, it gets very fun with AI
0
0
0
97
Luis Dalmolin retweeted
The PHP vulnerability wasn't easy to exploit, but please know that it *is* exploitable.
Please make sure you patch if you're running your own servers!
dreamgroup.com/blog/chained-p…
Please make sure you patch if you're running your own servers!
dreamgroup.com/blog/chained-p…
5
9
145
10,412
Luis Dalmolin retweeted
Vazaram dados de 148 milhões de brasileiros.
podemos dizer que somos um país open source?
podemos dizer que somos um país open source?
🚨 148 Million Brazilian PII Records Exposed
A misconfigured Elasticsearch instance was discovered, potentially exposing over 148 million records containing Brazilian citizens' personally identifiable information (PII).
The exposed data includes:
- CPF (Brazilian taxpayer ID) Dates of birth
- Residential addresses and postal codes
- Phone numbers
Validation: Sample records were cross-checked against Brazil’s official CPF registry, confirming matching identity details.
The dataset shares similarities with previously reported Brazilian data leaks, including the massive 2021 breach. However, its original source remains unconfirmed. Reported to the hosting provider.
⚠️ Risks: Identity theft, financial fraud, targeted phishing, and social engineering.
#ThreatIntel #CyberSecurity #DataBreach
53
192
2,549
46,188
Luis Dalmolin retweeted
This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26.
github.com/0x4D31/honeypo…
From:
x.com/0x4D31/status/…
github.com/0x4D31/honeypo…
From:
x.com/0x4D31/status/…
‼️ wow, confirmed more from the same IP, plus a new IP with a different payload that might be a different actor… and this is showing up in multiple regions now.
probably better not to burn the honeypots with a full report just yet. if i know you, DM me for the full report. will share a shorter version soon.
> That new alert materially expands the case: I’ll verify the three AP-northeast shell events and the curl connection independently, then compare them with the EU-west sequence.
5
66
285
20,279
Let's see what OpenAI daybreak can find. If it doesn't keep flagging my sessions like Opus 5.5, it's a win already
0
0
0
167
Our agent log analyzer reported this, so I guess there are some people trying to actively exploit php2shell
2
0
9
903
It seems, indeed, the PHP CVEs are not so easy to exploit as X made it seem (unsurprising). You should, of course, rush to patch any servers you have. Laravel Forge just announced there are patches available all the way up from PHP 5.6.
You won't get them in older versions of s likely what you are running if you are still running versions below 8.2 of PHP.
However, you can ask your agent to build that version from source, directly from Github. For example, in an old leftover server from a client, we upgraded PHP 7.4 by using the PHP-7.4-CVE-2026-109618-109619 branch in Github. Not sure if PHP is going to actually publish those versions, but the branch itself has the fix.
Also, please don't waste this moment and the timing: Make sure you migrate away and to newer versions. When possible, I'd also recommend going to managed services like Cloud.
You won't get them in older versions of s likely what you are running if you are still running versions below 8.2 of PHP.
However, you can ask your agent to build that version from source, directly from Github. For example, in an old leftover server from a client, we upgraded PHP 7.4 by using the PHP-7.4-CVE-2026-109618-109619 branch in Github. Not sure if PHP is going to actually publish those versions, but the branch itself has the fix.
Also, please don't waste this moment and the timing: Make sure you migrate away and to newer versions. When possible, I'd also recommend going to managed services like Cloud.
I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:
Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:
a) a world-class an extreme case of imposter syndrome.
b) currently looking at some very confident-sounding but wrong LLM output.
I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.
I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).
The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".
People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.
So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.
What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).
The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.
LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
4
0
8
1,669
Luis Dalmolin retweeted
I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:
Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:
a) a world-class an extreme case of imposter syndrome.
b) currently looking at some very confident-sounding but wrong LLM output.
I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.
I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).
The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".
People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.
So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.
What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).
The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.
LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:
a) a world-class an extreme case of imposter syndrome.
b) currently looking at some very confident-sounding but wrong LLM output.
I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.
I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).
The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".
People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.
So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.
What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).
The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.
LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
139
581
3,634
361,662
E dizem que o PHP morreu. Agora pergunta se os jornalistas sabem o que é Rust
Falhas de segurança - Governos e empresas de vários países, incluindo o Brasil, tiraram milhares de sites do ar preventivamente após a identificação de duas falhas críticas na linguagem de programação PHP, usada por cerca de 70% dos sites da internet.
As vulnerabilidades podem ackers e permitir o acesso a sistemas internos e bancos de dados.
Agências de segurança cibernética do Reino Unido e dos Estados Unidos emitiram alertas e recomendaram que organizações que utilizam a tecnologia retirem os sites do ar até que as falhas sejam corrigidas. Países como Bélgica, Holanda, Finlândia, França e Alemanha também adotaram medidas preventivas.
A empresa Cloudflare afirmou ter identificado milhares de tentativas de exploração das vulnerabilidades, mas disse que, até o momento, não há sinais de um ataque cibernético em massa. Especialistas trabalham para implementar as correções e reduzir os riscos.
#tecnologia #Cloudflare #bomdiabrasil #bdbr
0
0
6
425
I've been enjoying morning walks with @bot, chatting about my day and my morning brief.
I tried ChatGPT's Dot, but Grokbot fits my workflow better: multiple bots for specific purposes. Probably one reason SpaceX beat earnings expectations yesterday is Grokbot being so good.
I tried ChatGPT's Dot, but Grokbot fits my workflow better: multiple bots for specific purposes. Probably one reason SpaceX beat earnings expectations yesterday is Grokbot being so good.
1
0
3
159
As if there weren't enough reasons to migrate to Laravel Cloud, on situations like today, they've patched every app running in there automatically with no action required on the users end. Great work. Can't wait for the write-up on that.
3
4
32
3,074
Luis Dalmolin retweeted
The build is done 🥳
Patch up and get protected. Security fixes are now available with serversideup/php v5.0.2
github.com/serversideup/d…
Patch up and get protected. Security fixes are now available with serversideup/php v5.0.2
github.com/serversideup/d…
6
7
56
4,758
Told you
Cloudflare is amazing and necessary. Related, I’m not financial expert or anything, but with the recent drops, I’d say is a great time to buy some $NET
0
0
1
180