HD Moore retweeted
Bonus: I've also flipped the chain and popped MS Edge from calc.exe 😆
youtube.com/watch?v=Bh1zglq4…
Code-execution flaw in UEFI firmware affects most servers on planet Earth: arstechnica.com/security/202…
Great work by Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google)!
Python's certifi package provides the trusted root CAs for a huge portion of the Python ecosystem. It's also a great example of how complex dependencies can get. Ultimately, these certs are sourced from Mozilla, but they go through 5 hops to get there:
gist.github.com/hdm/2e5ebbff…
HD Moore retweeted
Additional mitigation parts,
memory_limit = -1
max_post_size = 1/4 of configured memory_limit
session.upload_progress.enabled = 0
fatal_error_backtraces = 0
expose_php = 0
User SELinux/AppArmor where possible.
HD Moore retweeted
You’ve been Israelized ¯\_(ツ)_/¯
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: nitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
HD Moore retweeted
For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:
HD Moore retweeted
Also, once a vuln has been announced but not patched (eg. PHP RCE), everyone's got an electron-tunneling microscope to point at the codebase. The old ways of embargo and coordinated disclosure are more perilous.
HD Moore retweeted
In a world of AI slop blogs, presentations, images and write ups...
Calif is an excellent example of how to harness it correctly. Accuracy, Art, Asthetic all supporting excellent AI assisted research. 👏
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
HD Moore retweeted
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
HD Moore retweeted
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
The PHP 8.5.12 release fixes the two specific CVEs (via state/bailout changes) detailed in official advisories; referenced "surviving paths" (e.g. var_destroy UAF) are separate pre-existing unserialize issues unrelated to this patch.
php.net/archive/2026.p…
github.com/php/php-src/se…
github.com/php/php-src/se…
github.com/dinosn/php-8.5…
HD Moore retweeted
the good thing about the eMudhra CA private key mess is that we can finally use https on localhost
HD Moore retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: nitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
HD Moore retweeted
You've gotta patch your dependencies super fast because they're full of vulns (PHP, Node, eMudhra, etc), but not _too_ fast because they're full of backdoors (LiteLLM). Good luck!
HD Moore retweeted
Releasing my lab as well PHP RCE github.com/dinosn/php-cve-20… , use it as a guidance and further reference for work upon. Patches are available at this moment PATCH!
If you're looking for the most detailed AND *entertaining* way to read about the php2shell bugs, the Calif post is epic: calif.io/php2shell/
HD Moore retweeted
... get it while its hot... 😈
> CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x)
> session.upload_progress UAF
> jackalsyn.com/posts/php-up-2…
> Courtesy of Me, @acd421 & @Archknight23
#CyberSecurity #infosec #php2shell #php
HD Moore retweeted
As it's already known, I will be releasing a lab on the CVE-2926-109618,9 PHP RCE upon embargo release. Until then, patch to the latest.