I will never get bored of cyber security and international politics.
Joined November 2013
- Tweets1.7K
- Following641
- Followers61
- Likes1.8K
Cyber_Sec retweeted
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.
In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: cursor.com/blog/claude-code-…
Cyber_Sec retweeted
CISA ordered US federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.
bleepingcomputer.com/news/se…
Cyber_Sec retweeted
⚠️🚨 you all need to patch brotli2shell/http2shell!⚠️🚨
we keep finding vulnerable versions in production during our client red teaming engagements. these bugs are usually at the application level, so most of your monitoring won't even catch them, and the impact could be whatever matters most to your organization.
Cyber_Sec retweeted
We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer. cfl.re/4iqHaQ1
Cyber_Sec retweeted
🚨 Palo Alto Networks confirms active attacks exploiting PHP2Shell flaws in internet-exposed PAN-OS management interfaces.
The flaws allow unauthenticated remote code execution. Multiple PAN-OS versions are affected, with some fixes still pending.
Read ↓ thehackernews.com/2026/10/at…
Cyber_Sec retweeted
US media reports Washington has warned Gulf allies to prepare for possible renewed strikes on Iran after the November midterm elections, with officials warning of a short, intense campaign and potential Iranian retaliation.
🔴 LIVE updates: aje.news/oexi5z
Cyber_Sec retweeted
GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619).
On 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor.
"We’re seeing successful exploitation of these CVEs, but the conditions make it difficult for a threat actor to scale. Fifty different servers in various configurations can be vulnerable to these CVEs, but the same exploit may not work universally against all of them. Actors need to tailor their exploit for each respective configuration which makes mass exploitation challenging."
- @ImposeCost, SVP of Adversary Operations at GreyNoise
This live activity report is derived from GreyNoise data and updates as we observe new activity: php.events.greynoise.io/
Cyber_Sec retweeted
🚨 PHP2Shell exploited in real-world attacks.
An attacker chained PHP2Shell with a Linux kernel flaw to gain root access to 25 servers across four countries, including three in a U.S. government-affiliated environment.
The intrusion extended into the internal network, where the attacker targeted Active Directory.
Suspected China nexus. Signs of AI-assisted tooling.
Read the full report: thehackernews.com/2026/10/ph…
Cyber_Sec retweeted
The Brotli RCE in Node.js is brutal! CVE-2026-111497 affects all three supported major lines: 22.0.0-22.23.3, 24.0.0-24.22.0, and 26.0.0-26.12.0.
One sleepless night with GLM-5.3 and DeepSeek V4.1 Flash 1017, plus $26.80 in tokens, and I had a reliable PoC across those versions on Linux arm64 and x86_64 with ASLR and UV_THREADPOOL_SIZE independent vectors for all 84 builds.
But I wouldn't call it suitable for blind black-box testing. I ran 14,877 fresh exploit attempts - every ARM target against every ARM and x86 profile, each in a fresh lab. Wrong profiles are destructive: 58.3% crashed the lab (56.4% ARM profiles, 60.2% x86 profiles replayed on ARM). And HTTP-only fingerprinting was useless: all 87 builds returned byte-identical responses, so you cannot safely guess the profile without force/out-of-band info. Bug bounty hunters, please do not spray profiles at production :)
Nine years ago, when I started my career as a Node.js SWE, I never imagined that an ordinary body-parser setup on a Node.js runtime could become an RCE entry point.
2026 keeps surprising me. And it's making me look at attack surfaces differently...
Huge respect to the researchers who found this bug
Cyber_Sec retweeted
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
bleepingcomputer.com/news/se…
Cyber_Sec retweeted
🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild.
Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64.
Patch now → 22.23.4 / 24.22.1 / 26.12.1
Read ↓ thehackernews.com/2026/10/re…
Cyber_Sec retweeted
Thousands turned out to celebrate in the Serbian capital after the country's student protest movement ousted Aleksandar Vucic from power in a landmark election reut.rs/4dZacol
Cyber_Sec retweeted
‼️ Palo Alto firewalls are exposed to the Brotli flaw that hit Node.js last week.
Only units that decrypt TLS and inspect Brotli traffic are at risk. Palo Alto rates it critical and knows of no exploitation.
Fixes are due by 30 October. Until then, turn Brotli inspection off.
Cyber_Sec retweeted
Thousands gathered on the streets of the Serbian capital Belgrade for a second night to celebrate the victory of the student-led protest movement in parliamentary elections.
The result removed the party of former president Aleksandar Vucic from power.
Cyber_Sec retweeted
Senior officials from Iran, Pakistan, Turkiye and Saudi Arabia meet in Tehran to discuss regional security, military aggression, and support for the Palestinian and Lebanese peoples.
Cyber_Sec retweeted
This is the closest I've seen to a realistic public Node.js/Express 🥦 Brotli exploit.
No fake RCE. Author is honest about what works and what doesn't. Even with non-PIE, heap layout, multiple arenas remain obstacles. ☝️ However...
github.com/Arkango/CVE-2026-…
Cyber_Sec retweeted
🚨🇦🇪 Reze ransomware begins leaking documents allegedly stolen from Dubai International Financial Centre (DIFC)
The Reze ransomware group has published a new batch of files linked to DIFC, a major financial hub in Dubai, following an earlier $5 million ransom demand.
The release includes documents labeled as passport copies, visa records, work permits, telecommunications approvals, and contact information.
Reze warns that it will continue publishing additional files daily, accusing DIFC of ignoring the breach.
The authenticity of the documents and the extent of the alleged compromise have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Cyber_Sec retweeted
Microsoft releases emergency .NET patches for critical Brotli flaw
bleepingcomputer.com/news/mi…
bleepingcomputer.com/news/mi…
