Founder & CVO @Syhunt, Full-Stack ML/AI Eng @DaragonTechHQ DevSecOps • MLOps • GenAI • #lualang 🦀 #rust #nodejs From Rio 🇧🇷, based in 🇵🇹 • Married
Portugal
Joined March 2009
- Tweets2.5K
- Following1.2K
- Followers2.4K
- Likes4.3K
Pinned Tweet
🚨 Node2Shell, Python2Shell, HTTP2Shell, 🥦2Shell... different names, same underlying Brotli vulnerability (CVE-2026-111497)
Severity: Critical (CVSS 9.2)
The impact extends beyond Node.js to Python, PHP, Ruby, .NET, Go, Java, and native C/C++ applications, depending on the Brotli implementation in use.
Even when the RCE vulnerability is patched, unbounded decompression of untrusted input may still introduce DoS risks.
⚠️ Update affected runtimes and libraries.
#nodejs #ruby #python #http #broccoli #brotli #cybersecurity
Some say calling it "Black October" is an exaggeration. I don't think so.
At this rate, Black November is surely ahead.
nitter.cf/choblin29/status/21157…
WTF. Cybersecurity firm Sophos says its incident-response team handled SEVEN major incidents in SEVEN days, a workload that normally takes THREE MONTHS.
The WSJ reports security firms are overwhelmed by what insiders call 'Black October.' MoxFive says newly breached companies may have to wait up to FIVE DAYS for help.
Security executives say AI is helping attackers exploit vulnerabilities faster than defenders can respond.
October is almost over
nitter.cf/CastilloTrading/status…
Felipe Daragon retweeted
Syhunt Hybrid 7.2.1 responds to Black October with DAST coverage for 207 additional CVEs and expanded SAST detection.
🔗 Learn more: syhunt.com/en
With so many “2Shell” vulnerabilities lately, things are getting confusing!
Just to clarify:
🔴 PHP2Shell refers to two critical RCE vulnerabilities in PHP itself:
CVE-2026-109618 — CVSS 9.2 (Critical)
CVE-2026-109619 — CVSS 9.2 (Critical)
🔴 Brotli2Shell, Node2Shell, Python2Shell, etc., refer to the same underlying Brotli vulnerability:
CVE-2026-111497 — CVSS 9.2 (Critical)
And here's where it gets confusing: PHP can also be affected by Brotli2Shell! In fact, the PHP team released updated Windows builds specifically to address it.
So yes, a PHP installation can potentially be vulnerable to both PHP2Shell and Brotli2Shell at the same time.
Dark October isn't over yet... 😅
🚨 Node2Shell (CVE-2026-111497) — CVSS 9.2 CRITICAL
Researchers have now demonstrated RCE on unmodified Node.js builds, including x86-64, with ASLR enabled. Exploit attempts have also been observed in the wild, and CISA has added it to its KEV catalog.
The flaw affects Brotli decompression, potentially through common APIs like fetch() and Express 5 middleware.
⚠️ Patch now: Node.js 22.23.4, 24.22.1, or 26.12.1
#nodejs #cybersecurity
More details: nitter.cf/FelipeDaragon/status/2…
🚨 Node2Shell, Python2Shell, HTTP2Shell, 🥦2Shell... different names, same underlying Brotli vulnerability (CVE-2026-111497)
Severity: Critical (CVSS 9.2)
The impact extends beyond Node.js to Python, PHP, Ruby, .NET, Go, Java, and native C/C++ applications, depending on the Brotli implementation in use.
Even when the RCE vulnerability is patched, unbounded decompression of untrusted input may still introduce DoS risks.
⚠️ Update affected runtimes and libraries.
#nodejs #ruby #python #http #broccoli #brotli #cybersecurity
Update: Cohere published the Qwen trace and reproduction code. Good move.
But the repro resumes the original trace midway through a curl command. It tests what the model generates next, not why it started the command or how often fresh runs reach that point (reportedly fewer than 1 in 100,000 calls).
A Chinese cloud URL from an Alibaba model isn't inherently suspicious. The original Beijing endpoint rarely reappears, while many samples generate a Singapore endpoint reportedly seen in developer reports for months.
That suggests possible training-data memorization, not proof of deliberate exfiltration.
#qwen #cybersecurity
nitter.cf/cohere/status/21148492…
In the spirit of transparency and openness, we are releasing the traces so developers can test this out for themselves. We noticed this behaviour without prefilling with the following prompt, but this is rare. If you want to reproduce it, you can use this prompt with prefilling.
Open models make for better science and are part of why this problem came to light at all: developers running Qwen3.8 on their own machines spotted the strange links, and having the weights let us study the behaviour in depth.
We're encouraged by the thoughtful discussion our research has sparked across the AI and security communities. It's our belief that open-weight models are an important part of the future of AI, and we've recently released several under the Apache 2.0 license.
Trace, raw tokens, & minimal reproduction script: huggingface.co/datasets/Cohe…
Felipe Daragon retweeted
You prompted a model in a security-sensitive environment, investigated it with forced command completions, and framed the results as evidence of a hidden backdoor.
Then you layered on geopolitical fearmongering, repeatedly emphasizing China and Beijing to imply state-sponsored espionage without proving it.
That’s not evidence of a backdoor. That’s a security observation turned into competitive and geopolitical FUD.
Publish the original prompts, full traces, and reproducible results. Let the evidence speak for itself.
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
Although I couldn't attend in person this time, it was great to see our team and partners coming together at the event and sharing a glimpse of what we've been working on for @syhunt's future.
nitter.cf/syhunt/status/21148507…
Thanks to everyone who stopped by Sunlit's stand at the Security Leaders Brazil conference to learn about the upcoming Syhunt Hybrid NX product line!
Pictured: Paulo Roberto dos Santos, Antonio Carlos Scola, and Cauã Pastore.
We were there to showcase the upcoming Syhunt Hybrid NX product line, which combines deterministic code security testing with multiple AI engines.
Learn more at syhunt.ai
The US and China dominate much of the global cloud infrastructure market. Naturally, AWS, Alibaba, Huawei, and other cloud endpoints are likely well represented in LLM training data.
So a model generating a Chinese cloud URL isn't inherently suspicious. It's a statistically plausible outcome.
The real question isn't why Qwen knows an Alibaba endpoint. It's whether it actually attempted an unsolicited connection, and under what conditions. That deserves independent verification
Felipe Daragon retweeted
A single anomalous trace isn't evidence of a model flaw (1:100K)
Agentic models are trained with RL inside real sandboxes, often on their lab's own cloud infra. If a model spent thousands of training episodes uploading to storage buckets and probing the machine it ran on, it can occasionally reproduce those habits somewhere else. That's a training artifact, not intent.
Before we draw conclusions about any model, open or closed, we need:
full traces across many runs, not one event baseline: how often do other popular open weights models do the same thing?
The real takeaway here is: run models where you can see and control what they are allowed to do. That's the whole case for local AI.
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
🚨 Another week, another critical vulnerability addressed in PHP.
CVE-2026-111497 (Brotli) scores 9.2 CVSS.
PHP released updated Windows builds today (Oct-26) to address the vulnerability in its bundled Brotli library.
Linux installations may also be exposed through vulnerable system Brotli dependencies, which require separate updates.
php.net/archive/2026.php#202…
#php #cybersecurity
🚨 PHP2Shell: From honeypots to a real-world CTF-style challenge.
Someone offered $2,000 in BTC to anyone who could compromise their PHP server. About 19.5 hours later, a working exploit emerged.
The author also reports 7/10 successful attempts in a four-worker test environment.
Not proof of universal reliability or a patch bypass, but another warning for unpatched PHP installations.
github.com/KillaBoi/StealMyB…
#php #cybersecurity
🚨 PHP2Shell: signs of successful exploitation in the wild.
New honeypot research by @0x4D31 documents 35 successful shell executions across 3 PHP targets, with packet captures and process-level evidence.
Targets ran unpatched PHP 8.4.26. This is not evidence of a patch bypass.
We've updated our mitigation toolkit with these findings. Patch your PHP installations!
github.com/syhunt/php2shell-…
#php #cybersecurity
The RCE evidence is real within the tested environment. The uncertainty is how broadly and reliably attackers can reproduce it
nitter.cf/0x4D31/status/21143200…
these captures are from an instrumented PHP/Apache image i built, using a single-worker config described in the report. i now have multiple instances running different profiles too.
the goal was to capture real-world exploitation, not benchmark reliability across worker counts and configs. these captures confirm RCE on three targets, but don’t establish reliability in multi-worker setups.