If you guys get bored check out Jay's work. She is a pro @synack
my turn , here is my poc for CVE-2026-109618 / CVE-2026-109619 ,exact build PHP 8.5.11 / Apache mod_php .
Includes fresh-leak validation, evidence handling and an execution diagram.
Exact-build only not a universal PHP exploit.
For authorized lab research.
github.com/jayy-hub1490/php8…
#AppSec #PHPの脆弱性だと思うもの #infosec #PHP
Corporate gatekeeping strikes again.
April 2026: I told @github their lockdown "trusted bot" check (PR #2361, commit 227f73e, lockdown.go:137) auto-trusts github-actions[bot], one global ID (41898282) across all of GitHub, with zero origin or permission checks.
Report 3692170: open an issue, the target own workflow fires under its own GITHUB_TOKEN, and attacker controlled bot comments self-retrigger across every open issue. One trigger made 16 comments across 4 issues. Cross repo injection, token exfil, poisoned trusted bot URLs. Working PoCs attached.
Report 3686503: the post Invariant sanitizer skipped 8+ content paths. Blind Stripe key exfil in a live agent audit. Both defenses failed at once.
I flagged #2361 before it merged. They merged anyway. They validated both reports, then closed them "known / not significant" and hid behind open source scope to pay me $0.
Six months later: @github docs still call the bot exception intentional. @NeuralTrustAI wrote the vector out on Oct 23 with no credit ("If a workflow copies outside text into a bot comment, that text will pass the filter"). @radware hit 61 repos via Issues into Actions secret dumps. @wiz_io Gheist planted 13,500+ secret dumping branches. @BeyondTrust showed hidden Issue comments hijacking Copilot. @github Oct 28 scanner flags untrusted content reaching agents, and still does not mention the bot exception.
Validated, then denied to dodge the bounty. "We didnt know" does not survive timestamps.
#infosec #AppSec #supplychainsecurity #bugbounty #promptinjection #DevSecOps
>Be me
>drop money on @Kalshi
>convince people to do same
>have everyone vote the House #Red #GOP
>Have everyone vote Senate #Blue #Democrats
> Know no matter what happens nothing will get done by our government due to deadlocks until next #Election
>Profit
>Vote with your voice and your wallet for the proper win. Convince your friends it is the only way.
>Collect that 25k on 560 at a 37x odds.
I am not saying rig an election. I am just saying make the outcome favorable in the NOW and not some invisible political apparatus that does nothing but drop bombs and go deeper in debt funding those bombs for others to drop.
Boom
my turn , here is my poc for CVE-2026-109618 / CVE-2026-109619 ,exact build PHP 8.5.11 / Apache mod_php .
Includes fresh-leak validation, evidence handling and an execution diagram.
Exact-build only not a universal PHP exploit.
For authorized lab research.
github.com/jayy-hub1490/php8…
#AppSec #PHPの脆弱性だと思うもの #infosec #PHP
Glorious @AnthropicAI yall still the worst of the AI companies 😄 🤣 😂 😆
中国社区逆向拆解了Claude的封号机制。以下是他们的发现
Claude使用积分制。注册时账号获得初始分数，之后根据行为加分或扣分。低于阈值直接封号。回分很难
影响分数的因素:
注册
> 干净IP是最重要的因素。不一定要家宽，但必须干净
> Gmail已经不是最优选，有权重更高的邮箱服务
> 注册时直接弹KYC的号可以扔了
> 用手机App注册会加分
支付
> 刚注册就订阅会扣分
> 直接上Max会大幅扣分。最好等两天先订Pro
> 支付时弹KYC说明账号在考察期，但不一定会封
> 国外实体银行卡加分。Google Play也行。虚拟卡扣分
使用
> 不要一次把限额用完。宁可两个号轮换也不要一个号撸到底
> Desktop客户端有少量加分。尽量少用网页端
> 手机端也有少量加分
> 开启记忆功能加分。记忆文件越多分越高
IP和设备
> 稳定性是关键。不要跳IP，尽量一直用同一个
> 代理必须全局模式并开启TUN
> 多设备登录大幅扣分。理想状态是一台电脑一个客户端
> 频繁换IP、频繁登录、高并发都会大幅扣分
账号年龄
> 老号有巨大的容错空间。2023年的号明显更高
> 分数随时间增长，但很慢
其他
> Windows和macOS没区别。Linux会扣分
> 时区和语言基本不影响。不会因为北京时间就封号
> 跟Claude说自己是中国人没问题，记忆不会触发封号
> 大量使用Fable会扣分
> 升级Max大概率进入观察期，除非是高权重老号
观察期和封号
> 接近阈值时账号可能进入观察期。典型特征是掉登录
> 观察期继续扣分就会封号
> 高分号可以扛过多次观察期
关注我，拆解你每天在用的服务背后到底怎么运作的
These are the good groups.
#ALERT ‼️ The BYOD ransom group who claimed the attack on UNM medical has made a statement, they claim they will give decryption key and compensate victims of the attack (WITH PROOF) with up to $2500 USD.
#Cybersecurity #ransomware @UNM @UNMHospital
When I find the right mitigations and published prepatch "leaked document" Like wtf? Where did it leak? I feel like that would be real news......PHP never ceases to amaze me on ownership of their issues. About as accountable as Lindsay Clancy.................
You know with all the #PHP2Shell and stuff....I am truly curious have people started auditing crypto software and ledgers? Like a #crypto2shell 😆 🤣 😂 😹 You guys like burning things down as much as I do and #XRPL just had that huge 0 day patch that could've crippled it overnight. I think its time we start look at friendly related chains like #ETH #LTC #Cryptocurrency of any type really. If it could exist in XRP that long everywhere else likely has some super old flaw missed. If you find something tag me. I will verify and repost if valid. Or DM first if unsure. I am always working side work for people reviewing their stuff. It's for the lore for me.
Validated Conditional 2FA Bypass 0 day. Huge! Love it! always trust @abraxas_null #PHP dying out here in real time.
🔐 ⚠️ phpMyAdmin 5.2.3 - 2FA Bypass! 0day++! ⚠️ 🔐
🚨 WebAuthn signatures are parsed but never COSE-verified against credentialPublicKey 🚨 Arbitrary bytes pass the structural checks, so 2FA falls over after password auth 💀
Exploit:
> CWE-347/287 ⚠️ CVSS 8.1
> 🐙 github.com/abraxas/PMA-5.2.3…
🧩 Root cause: web-auth/webauthn-lib is only a dev/suggest dependency 📦 The distributed tarball is built with `composer install --no-dev`, so `WebAuthn::createServer` instantiates `CustomServer` instead of `WebauthnLibServer` 👀
🔍 How? 🤦♂️ `CustomServer::parseAndValidateAssertionResponse` enforces structural checks only: clientData type, session challenge, origin host, rpIdHash, user-present, allowed credential id 📋 `response.signature` is decoded and never verified ❌ `credentialPublicKey` is never read 🕳️
💥 Impact: a well-formed assertion carrying correct structural fields and an arbitrary signature yields a full authenticated session 🔓 Impact is unauthorized database access through the application, not host-level code execution 🗄️
