Chris (@DazedProgrammer) header
Chris (@DazedProgrammer) profile picture

Chris

@DazedProgrammer

Sr. Software Eng | Sr. Sec Architect | CompSci | Cybersecurity | AI Cybersecurity Engineer @Sony | Explorer of the unknown | Tweets are my own.

 FL
Joined September 2017
  • Tweets2.8K
  • Following1.1K
  • Followers770
978Media
Photo by Chris (@DazedProgrammer)Photo by Chris (@DazedProgrammer)Photo by Chris (@DazedProgrammer)Photo by Chris (@DazedProgrammer)Photo by Chris (@DazedProgrammer)Photo by Chris (@DazedProgrammer)Photo by Chris (@DazedProgrammer)Photo by Chris (@DazedProgrammer)Photo by Chris (@DazedProgrammer)Photo by Chris (@DazedProgrammer)
🚨 Cisco Talos: APT UAT-11473 used the CVSS 10 Catalyst SD-WAN auth bypass (CVE-2026-20127, fixed in Feb) to plant KeyDrift, malware that lives inside the controller process and copies what Talos assesses are AES-256 site-to-site traffic keys. Patch, then hunt. #infosec
1
61
Sources: - Cisco Talos, "Inside KeyDrift" (Oct 28): blog.talosintelligence.com/u… - Cisco advisory cisco-sa-sdwan-rpa-EHchtZk (CVSS 10.0, fixed releases, "limited exploitation", port 22/830 mitigation): sec.cloudapps.cisco.com/secu… - CISA KEV (added Feb 25, Emergency Directive 26-03): cisa.gov/known-exploited-vul… - Lumen Black Lotus Labs, Silent Train (Oct 28): lumen.com/blog/en-us/silent-… - The Hacker News (Oct 29): thehackernews.com/2026/10/ha…
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication...

blog.talosintelligence.com
1
17
Fixed releases: 20.9.8.2, 20.12.5.3 / 20.12.6.1, 20.15.4.2, 20.18.2.1; older trains migrate. No workaround; Cisco says restrict ports 22 and 830 to known controller IPs until you upgrade. Hunt: "Accepted publickey for vmanage-admin" from unknown IPs in /var/log/auth.log, files conf_sshd, rsshd, libdssl.so, libcommon.so, /etc/sv/aaamgr/, and Talos Snort SIDs 67387-67416 (v2, disabled by default) and 7:44-7:73 (v3). Talos calls the activity historical and published no hashes, IPs or victim count; patching does not remove an implant already on the box.
9
JUST IN - An incident at the US Department of Energy’s Savannah River Site triggered an emergency response. According to an emergency dispatch, it was a fire in a single room at Savannah River National Laboratory, and there was “an unfiltered ground-level radiological release.” - WRDW
Image from Insider Paper (@TheInsiderPaper)
38
317
56
791
112,211
🚨 PHP2Shell is on CISA's exploited list (KEV; federal deadline Oct 29). Adel Karimi logged 35 working shells on honeypots; Delft TI Lab counts 66,000+ exploit requests from 640+ IPs. Wiz: no end-to-end success on its honeypots. Update PHP: 8.5.12/8.4.27/8.3.36/8.2.35 #infosec
1
76
Sources: - CISA KEV (added Oct 26, federal due date Oct 29): cisa.gov/known-exploited-vul… - Karimi's honeypot report (35 shells, single-worker caveat): github.com/0x4D31/honeypot-d… - Delft TI Lab tracker (66,504 requests, 646 IPs, 174 sent code): php2shell.delftintellab.com - Wiz (honeypots, -67% exposed hosts, <53% orgs still vulnerable): wiz.io/blog/php2shell-exploi… - Retractions: Sophos Oct 22 correction; Unit 42 Oct 25 update. Censys: php2shell.censys.com (32.5M services). Roundup: theregister.com/cyber-crime/…

Known Exploited Vulnerabilities Catalog | CISA

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative...

cisa.gov
1
45
8.1 and older: no new release, use your distro's package or upgrade; CISA says take PHP systems you can't patch offline. Related CVE-2026-115560 is still unfixed: set session.upload_progress.enabled=0 in php.ini and restart. Hunting hint from Wiz: exploit stage 1 leaves "Allowed memory size ... exhausted ... in Unknown on line 0" in your PHP error log.
82
☕ Morning briefing: researchers report PHP2Shell hacks in the wild, and exploit code is public. Update PHP today. HTTP2Shell, the Brotli bug, reportedly reaches .NET, PowerShell, FFmpeg and more. Microsoft patched Oct 25; no attacks reported yet. #infosec
1
188
Sources: - Reported PHP2Shell hack (honeypot): bleepingcomputer.com/news/se… - $2,000 challenge claim + public code: cybersecuritynews.com/php2sh… - Suspected North Korea scanning (CYFIRMA): thehackernews.com/2026/10/ph… - HTTP2Shell beyond Node: securityweek.com/node2shell-…
PHP2Shell security flaws now sucessfully exploited in the wild

PHP2Shell security flaws now sucessfully exploited in the wild

Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.

bleepingcomputer.com
1
130
PHP: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (8.1 and older: no fix). Unpatched third bug CVE-2026-115560: set session.upload_progress.enabled=0. Brotli: .NET 8.0.33/9.0.22/10.0.14, Oct 25 PowerShell 7.4/7.5/7.6 builds, Node 22.23.4/24.22.1/26.12.1. Rebuild, restart.
97
🚨 A new report says flaws in Tailscale SSH can turn one hacked device into root on every server it is allowed to SSH into. Tailscale hasn't confirmed it and there's no patch yet. Turn off Tailscale SSH where you don't need it and tighten your SSH rules. #infosec
1
74
News: cybersecuritynews.com/tailsc… Report (Tailworm, Oct 25): tailworm.com Watch for Tailscale's response: tailscale.com/security-bulle…
Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers From One Compromised Device

Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers From One Compromised Device

A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each...

cybersecuritynews.com
1
32
What to do now: turn off Tailscale SSH where you don't need it (tailscale set --ssh=false, after making sure you have another way in), and give each SSH rule one source and one destination. On headscale 0.29.5, treat every SSH rule as root access.
16
🚨 OpenAI let its AI agents try to escape test copies of its training sandboxes. They got past 3 walls: onto the host machine; from a host they were handed, onto the internet (limited) via log, metrics and login services; and between sealed boxes via CPU cache timing. #infosec
1
62
Sources: - OpenAI, Oct 23: openai.com/index/securing-ou… - Kata Containers advisory (CVE-2026-24834, fixed 3.27.0): github.com/kata-containers/k… - The Hacker News: thehackernews.com/2026/10/op…

Securing our frontier model training environment

OpenAI explains how we strengthened containment for frontier model training and evaluation, including offline environments and high-compute red-teaming.

openai.com
1
36
Fixed versions (update to these or newer): Kata Containers 4.1.0, gVisor release-20260803.0, Docker Engine 29.9.0 (seccomp profile), Linux 6.6.158 / 6.12.111 / 6.18.53 / 7.1.13 / 7.2.3, or your distro's patched kernel.
6
🚨 CVE ALERT: Node2Shell (aka HTTP2Shell), CVE-2026-111497. Out-of-bounds write in Google's Brotli decoder (1.0.3-1.2.0), CVSS 4.0 9.2 (Google, the CNA). Hits Node, Bun, Python and Envoy/Istio when they decode untrusted Brotli. Not exploited yet. Patch, rebuild. #nodejs #infosec
1
628
Sources: - CVE record: cve.org/CVERecord?id=CVE-202… - Node.js: nodejs.org/en/blog/vulnerabi… - The Hacker News on Bun, Python, Envoy, Istio: thehackernews.com/2026/10/br…
1
84
Fixed: Node 22.23.4 / 24.22.1 / 26.12.1, Bun 1.4.4, Brotli 1.0.10 / 1.1.1 / 1.2.1, Python Brotli 1.2.1, brotlicffi 1.2.1.0. Envoy/Istio: patch or turn off Brotli decompression. End-of-life Node (25, 23, 20 and older): no official fix.
35
Sources: - Google Chrome Root Program: blog.google/security/protect… - Mozilla incident: bugzilla.mozilla.org/show_bu… - Scott Helme (all 8 key values, one is 4): scotthelme.co.uk/eight-bits-…

Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates

The Chrome Root Program received a report from a security researcher regarding the compromise of private keys associated with eight eMudhra subordinate Certification Authority (CA) certificates. The...

blog.google
1
64
Site operators: Chrome is expected to remove emSign ECC Root CA - G3 on Oct 27. If your certificate chains to it, get one from a different root now.
19
Load more