security researcher good guy hacker AI tinkerer OSCP certificate owner ADHD Brain owner https://nitter.cf/t.co/6AvGIhVjFJ
Joined July 2015
- Tweets65.4K
- Following831
- Followers3.6K
- Likes2.5K
Pinned Tweet
Other places to get RedPacket Security updates:
Telegram:
t.me/RedPacketSecurity
Discord:
discord.gg/xZY94PXXs4
Reddit:
reddit.com/r/RedPacketSecuri…
LinkedIn:
linkedin.com/company/redpack…
Mastodon:
mastodon.social/@RedPacketSe…
RedPacket Security retweeted
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
RedPacket Security retweeted
"compromised DevOps engineer's laptop" I swear to god if this was Contagious Interview, I'm moving to North Korea and stealing bitcoin for a living.
For context, Contagious Interview is one of DPRK's techniques where they reach out to developers in the target organization and offer them higher paying jobs.
They then tell them the job offer is contingent on them completing a "coding skills assessment" to prove their ability.
The source code is backdoored with malware, and the targets sometime run it on their work laptop, because why wouldn't you run untrusted code some random internet dude gave you on your work laptop.
RedPacket Security retweeted
He’ll never know this but Patrick Stewart showed countless boys how to be men. He showed that strength didn't have to mean intimidation, that intelligence should come with humility, and that you could - and should - stand up for what was right even when it cost you something.
RedPacket Security retweeted
The official @AnthropicAI Claude Code VSCode extension hosted on @openvsx was compromised today. Version 2.1.313 includes an extension.js file that opens a tunnel to the IP address 134.209.82[.]225 and adds a persistence mechanism.
Read more here: opensourcemalware.com/blog/t…
RedPacket Security retweeted
Well @MSFT365Status, just received an email from office365alerts at microsoft[.]com, source IP 2a01:111:f403:c406::3, that passed DMARC and SPF that contains multiple phishing URLs at shared-cloud-manager[.]folio[.]io[.]vn. You might want to check that out
#RIP @SirPatStew . Thank you for many happy childhood star trek memories.
In lieu of flowers, memorial contributions may be made to:
Johns Hopkins Alzheimer’s Disease Research Center Fund
alzresearch.org/giving/
Alzheimer’s Foundation of America Caregiver Resources
alzfdn.org/donate/
Photo Credit: Tommy Garcia
RedPacket Security retweeted
Holy balls the latest update to macOS *ROLLED BACK* the eMudhra cert removal from /etc/ssl/!
What the hell are you doing over there, Apple friends?
RedPacket Security retweeted
🤷♂️
1/ We tore apart a #macOS C2 implant that's currently sailing past engines on VT - 0 detections as of today. Shared by @malwrhunterteam.
Written in Zig, and engineered like red-team infrastructure.
Here's what makes it interesting 👇
RT @Scott_Helme: "Sorry we didn't get back to you yet, we've been too busy on Twitter and trying to keep our investors happy"
Unbelievable…
RedPacket Security retweeted
The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously.
I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months.
I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies.
When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack.
The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code.
Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off.
Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions.
A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs.
Here's what this run looked like.
We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.
RedPacket Security retweeted
More private keys by the Indian certificate authority have been discovered. These are all small numbers.
People are suspecting that they interpreted 384 bit keys to mean that they should pick numbers from 1-384 to use as their private keys.
RedPacket Security retweeted
HOLY SHIT: This is huge. Amazon found a PHP2Shell exploit attempt on OCT 17, FOUR DAYS before the AI-discovered vulnerabilities were publicly disclosed.
It hit an AWS honeypot from an anonymized IP. Amazon says it doesn't know how the actor learned about the still-embargoed flaws.
Then Cloudflare watched the explosion:
>10 hours BEFORE disclosure: thousands of attempts
>45 minutes AFTER: tens of thousands
>2 hours AFTER: hundreds of thousands
>Later: MILLIONS
Researchers had spent two months coordinating fixes. Governments took websites offline.
And Censys found ~1.5 MILLION of 2.6 million identified PHP hosts running versions with NO PATCH available for those versions.
RedPacket Security retweeted
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
RedPacket Security retweeted
Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.
foxio.io/blog/header-accordi…
Aaaaaaaaaand this is exactly why monthly patching cycles are dead.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
RedPacket Security retweeted
php2shell の検証ついでに、パッチを追う中で session.upload_progress の filename 注入 + LFI を自分でPoC化してみた！
8.5.4 でも 8.5.12（パッチ版）でも www-data でコマンド実行までいけた
既知の手法で LFI 前提だけど、この経路はパッチ後も塞がってない
#php2shell #PHP #CVE2026109618
RedPacket Security retweeted
Great work by the @TalosSecurity team getting this out quickly! If anything in your business runs on PHP, this is critical info and requires every company to move quickly. The old habit of baking patches into the next general purpose release isn't going to survive the AI era.
Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset blog.talosintelligence.com/t…
