Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish? Expert: No, software is constantly evolving. Philomena: So they've been writing the same website for 20 years? Expert: No, different projects. Philomena: Have they tried finishing one before starting another? Expert: That's not how software development works. Philomena: My mate Paul spent 20 years building a shed. Turned out he was just an alcoholic. Expert: Right. Philomena: Is PHP like that?

246

abraxas · Oct 22, 2026 · 4:03 PM UTC

ju4dy retweeted

abraxas

@abraxas_nullOct 22

Look, ma - I'm famous... CVE-2026-111214, CVE-2026-111215, CVE-2026-111216, CVE-2026-111217, CVE-2026-111218, CVE-2026-111219, CVE-2026-111220, CVE-2026-111221, CVE-2026-111222, CVE-2026-111223, CVE-2026-111224, CVE-2026-111225, CVE-2026-111226, CVE-2026-111227, CVE-2026-111228, CVE-2026-111229, CVE-2026-111230, CVE-2026-111231, CVE-2026-111232, CVE-2026-111233, CVE-2026-113605, CVE-2026-113606

888

ju4dy · Oct 21, 2026 · 10:31 AM UTC

ju4dy@jundybabaOct 21

I just completed @Pentesterlab's HTTP Badge!!! lfg

861

433 · Oct 20, 2026 · 10:51 PM UTC

ju4dy retweeted

433

@433Oct 20

Too cold 🥶🥶🥶

150

7,532

157

80,431

658,995

ju4dy · Oct 20, 2026 · 11:04 AM UTC

ju4dy@jundybabaOct 20

Excited to share my first GitHub repository! 🚀 I’ve documented my progress through the @HackTheBox Starting Point track 12 boxes. It includes the scans, the exploitation steps, and the "dead ends" worth remembering. github.com/ju4Dy/htb-startin…

ju4dy · Oct 20, 2026 · 12:06 AM UTC

ju4dy@jundybabaOct 20

I just solved Archetype on Hack The Box! labs.hackthebox.com/achievem… #HackTheBox #HTB #CyberSecurity #EthicalHacking #InfoSec #PenTesting

Owned Archetype from Hack The Box!

I have just owned machine Archetype from Hack The Box

labs.hackthebox.com

ju4dy · Oct 19, 2026 · 1:37 PM UTC

ju4dy@jundybabaOct 19

I just solved Oopsie on Hack The Box! labs.hackthebox.com/achievem… #HackTheBox #HTB #CyberSecurity #EthicalHacking #InfoSec #PenTesting

Owned Oopsie from Hack The Box!

I have just owned machine Oopsie from Hack The Box

labs.hackthebox.com

Hexacon · Oct 16, 2026 · 12:29 PM UTC

ju4dy retweeted

Hexacon@hexacon_frOct 16

The Last Proof of Human Craft by Orange Tsai 🍊 (@orange_8361)

349

31,153

ju4dy · Oct 16, 2026 · 8:16 AM UTC

ju4dy@jundybabaOct 16

I just solved Vaccine on Hack The Box! labs.hackthebox.com/achievem… #HackTheBox #HTB #CyberSecurity #EthicalHacking #InfoSec #PenTesting

Owned Vaccine from Hack The Box!

I have just owned machine Vaccine from Hack The Box

labs.hackthebox.com

abraxas · Oct 15, 2026 · 6:44 PM UTC

ju4dy retweeted

abraxas

@abraxas_nullOct 15

🚨❤️‍🔥💀 13 NEW remote RCEs on pfSense CE 2.9.0 💀❤️‍🔥🚨 These are BRAND NEW and not from Tuesday's earlier drop! 🔥 1. Wireless clone ifconfig • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: run a root ifconfig command from a stored wireless clone interface • 🔗 github.com/abraxas/pfsense-w… 🔥 2. Assign Interfaces Add • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: run a root command from Assign Interfaces Add • 🔗 github.com/abraxas/pfsense-a… 🔥 3. IPv6 gateway %zone • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: run a root dpinger command from an IPv6 gateway zone • 🔗 github.com/abraxas/pfsense-g… 🔥 4. Timezone php.ini prepend • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: run root PHP on the next FPM request via php.ini auto_prepend_file • 🔗 github.com/abraxas/pfsense-t… 🔥 5. sshguard THRESHOLD CRLF • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: run a root sshguard command via THRESHOLD CRLF • 🔗 github.com/abraxas/pfsense-s… 🔥 6. L2TP RADIUS mpd.conf • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: run a root mpd helper from L2TP RADIUS • 🔗 github.com/abraxas/pfsense-l… 🔥 7. PPPoE ptpid crontab • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: run a root cron job from PPPoE ptpid • 🔗 github.com/abraxas/pfsense-p… 🔥 8. PPPoE mpd.secret bang helper • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: run a root bang-helper from PPPoE mpd.secret • 🔗 github.com/abraxas/pfsense-p… 🔥 9. Captive Portal HA pfctl • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: run root pfctl from Captive Portal HA host • 🔗 github.com/abraxas/pfsense-c… 🔥 10. Unbound sock-queue-timeout • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: inject an Unbound include and run unbound-control as root • 🔗 github.com/abraxas/pfsense-u… 🔥 11. Unbound ACL CRLF • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: inject an Unbound include through ACL CRLF • 🔗 github.com/abraxas/pfsense-u… 🔥 12. OpenVPN connect_async eval • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: eval a RADIUS username as root in OpenVPN connect_async • 🔗 github.com/abraxas/pfsense-o… 🔥 13. OpenVPN learn-address CN • 🎯 Class: RCE • 🌐 Remote • 💀 What an attacker can do: run su -c as root from an OpenVPN learn-address CN • 🔗 github.com/abraxas/pfsense-o… 🧨 First drop (Tuesday) - 5 RCE's - pfSense: • 🔗 nitter.cf/abraxas_null/status/21… 🧨 Second drop (Wednesday) - pfSense API: • 🔗 nitter.cf/abraxas_null/status/21… 📖 Full series: • 🔗 abraxaslabs.tech/research/pf…

🤖 Made with AI

abraxas

@abraxas_nullOct 15

🚨 🧯 Even MORE pfSense 0day? How??? 🧯 🚨 🧨 🚒 Exclusively pfSense API Exploits 🚒 🧨 Nine leftovers in Netgate’s pfSense Plus MIM API toolkit (public OpenAPI + official samples). Loopback labs. Full write-up at the end. 🔥 1 • Privilege leftover • Remote • Shape controller JSON so enrollment SSH runs as admin on every listed firewall • github.com/abraxas/pfsense-a… 🔥 2 • Privilege leftover • Remote • SSH MITM of first-contact enroll steals the SSH user and plants a hostile controller • github.com/abraxas/pfsense-a… 🔥 3 • Privilege leftover • Local • Any local uid that can open the device unix socket enrolls a hostile controller and dumps identity • github.com/abraxas/pfsense-a… 🔑 4 • Privilege leftover • Remote • With a read-shaped MIM JWT, download CA and leaf private keys and PKCS12 with no password • github.com/abraxas/pfsense-a… 🔑 5 • Privilege leftover • Remote • GET /services/acme returns the Let’s Encrypt account key and issued private keys • github.com/abraxas/pfsense-a… 🪪 6 • IDOR • Remote • One controller JWT lists every device and, if the role includes console, php/shell any enrolled box • github.com/abraxas/pfsense-a… 🪪 7 • IDOR • Remote • A stolen or derived ACB userkey fetches full Auto Config Backup blobs • github.com/abraxas/pfsense-a… 📂 8 • File read • Remote • GET Snort rules {file} may join outside the ruleset after %2F decode • github.com/abraxas/pfsense-a… 🔓 9 • Privilege leftover • Remote • Official samples disable TLS verify, so MITM of :8443 steals the JWT and replays 4–6 / php/shell • github.com/abraxas/pfsense-a… abraxaslabs.tech/research/pf…