Scott Arciszewski retweeted
October Trail of Bits Tribune: Releasing a PHP exploit demo, new plugins for patching, and package-integrity research. Plus Brotli-checker, SequenceHash, and six new public security reviews.
Read the Tribune: mailchi.mp/trailofbits/octob…
Scott Arciszewski retweeted
We achieved RCE via Brotli in Linux labs:
• Node.js 24.22.0 + Express 5.3.0 (x86-64/ARM64) through its standard JSON parser
• Electron 41.10.7 (x86-64) using a custom-built decoding service
Getting it to work requires a carefully matched setup and can take repeated attempts.
We’re still testing how exploitable the Node.js/Brotli bug is, but we’ve found that it’s surprisingly hard to tell whether you’re even affected.
So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries.
github.com/trailofbits/brotl…
Scott Arciszewski retweeted
Month of "04" as cryptographic secret.
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Scott Arciszewski retweeted
Many of you don't understand how serious this is, so let me break it down.
In computer science there is a famous kind of puzzle called 3-SAT. You are given a long list of yes-or-no switches and a set of rules about how they must be arranged, and you have to find a combination that satisfies every rule. The obvious way to solve it is to try every combination, but each new switch doubles the number of possibilities, so a puzzle with a few hundred switches would take longer than the age of the universe to brute force.
For decades, the smartest people in the field found clever tricks that made this a little faster, but every trick still hit the same wall: the time required kept exploding as the puzzle grew.
About 25 years ago, two computer scientists, Russell Impagliazzo and Ramamohan Paturi, working with Francis Zane, turned that wall into a formal idea.
They proposed the Exponential Time Hypothesis, which says this explosion is not a failure of human cleverness but a law of nature. No algorithm, however brilliant, will ever solve 3-SAT without the time blowing up exponentially. Nobody could prove it, but almost everyone believed it, and it became one of the foundations of modern computer science.
Researchers used it as a measuring stick. If you could show that solving some other problem quickly would also crack 3-SAT quickly, you had shown that problem was hopelessly hard too. Hundreds of papers, across scheduling, graphs, logic and much more, rest on this one assumption.
Now an internal AI model at OpenAI claims to have broken it. It says it found an algorithm that solves these puzzles meaningfully faster than the hypothesis allows, and it has checked the proof in a computer verification system called Lean.
And here is the remarkable part: the very people who proposed the hypothesis, Impagliazzo and Paturi, along with MIT's Ryan Williams, are now leading the public review of whether a machine has disproved their own idea.
So what happens next? If the disproof holds, a large part of theoretical computer science has to be revisited.
Every result that said "this problem cannot be solved faster, assuming ETH" loses its foundation, and researchers will have to work out which of those walls were real and which were simply where we stopped looking. It does not mean everything becomes easy. The new algorithm is still slow in absolute terms and this is not the famous P versus NP problem being solved.
But it means our map of what is possible was wrong in a place we were very confident about, and it was an AI that redrew it. If the disproof fails, the hypothesis survives and the field breathes out, but we will still have watched an AI produce serious, checkable work on one of the deepest questions in the discipline, closely enough that the founders of the idea had to take it seriously. Either way, something has shifted.
Working on some cool stuff =)
But since it's not ready to share just yet, check this little addition to Trailmark out
github.com/trailofbits/trail…
Scott Arciszewski retweeted
Replying to @matthew_d_green @OpenSSLFact
What I’m seeing right now is a lot of people thinking in “before” terms, when they need to be thinking in terms of “after”. What happens when everyone else is panicking too? What does the next Core Infrastructure Initiative look like?
Scott Arciszewski retweeted
Replying to @matthew_d_green @OpenSSLFact
The point I’m trying to make is that there’s a distinct “before” and “after” when it comes to events. Things that were inconceivable prior to an event can become obvious after. But it’s important to think about what should be obvious *before* important people are panicking.
Scott Arciszewski retweeted
People think that attacking independent women gives them status.
It doesn't give you status, it reveals that you don't have it - and depend on lowering others to fake it
Scott Arciszewski retweeted
Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpBB.
We’ve confirmed exploits work on pre-patch releases of PHP 8.2–8.5. If you haven’t updated, assume attackers can compromise your server, and that exploitation will only get easier.
Update: Our PHP exploit is now production-grade.
* stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load
* ARM64 + x86-64 targets
* MediaWiki, WordPress, phpBB, Laravel
* Apache/mod_php and nginx/php-fpm -> root
nitter.cf/dguido/status/21131291…
I'm very thankful for CVE identifiers because some of the attempts to brand vulnerabilities are quite cringe.
Scott Arciszewski retweeted
Which brings me back to a point I wanted to make about the vulnpocalypse: if someone knowledgeable takes any amount of time and tells you that your code *looks* potentially vulnerable, then fix your code. Don’t sit on your hands til someone smarter finds an exploit.
Scott Arciszewski retweeted
Lessons for all the new researchers:
1. Write your own posts. Everyone knows what slop looks like.
2. Don't buy a domain name for a bug. It's 2026.
3. Learn the difference between bugs and architecture risks
4. Get friends. They should tell you your bad ideas suck
Scott Arciszewski retweeted
Exploit development is one of the most frustrating components of computer security, not because it’s bad (I am in awe of people who can do it) but because too many vendors make working exploits a requirement for patching things.
Scott Arciszewski retweeted
Yep. Because you can't just prompt "find me all the vulnerabilties". Maybe in awhile but we're nowhere near that now.
Skilled researchers, custom harnesses, and other techniques are changing the bug depth game, in addition to bringing down the cost.
wait, PHP was actually scanned by Anthropic’s Claude Mythos earlier this year. they also had access to OpenAI’s Daybreak Red for validating exploits.
the PHP Foundation revealed this JUST yesterday.
keeping frontier cyber models in the hands of a selected few doesn’t seem to be working well for the internet.
thephp.foundation/blog/2026/…
There was no payout because PHP2Shell came out of Patch the Planet (trailofbits.com/patch-the-pl…), a pro bono initiative where we (Trail of Bits, OpenAI, Calif and HackerOne) use AI to audit and secure open source software for free.
If we were paid for every bug from PTP we’d all be driving Lambos by now.
Scott Arciszewski retweeted
as a person who lives with a computer architect, 'yes? how did you think we made the computers so fast?'
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Scott Arciszewski retweeted
We’re still testing how exploitable the Node.js/Brotli bug is, but we’ve found that it’s surprisingly hard to tell whether you’re even affected.
So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries.
github.com/trailofbits/brotl…



























