Co-Founder of @packagist / https://nitter.cf/t.co/J7OZsciXbE and Co-Creator of #composerphp - he/him - @naderman@phpc.social
Berlin, Germany
Joined January 2008
- Tweets7.9K
- Following1.2K
- Followers5.4K
- Likes23.3K
Nils Adermann retweeted
Just to clarify my current level of security paranoia.
Somebody is making videos of my PRs and sending them to me, and my first thought is: does the Mac/Linux/Windows decoder have an RCE, and is someone trying to hack me?
Nils Adermann retweeted
Cooldown now works for WordPress plugins and themes too! WP Packages records when it first serves each version, and resets the clock if a release is changed after the fact on WordPress.org
roots.io/wp-packages-now-sup…
ALT Terminal running "composer update wp-plugin/query-monitor -vv" with a cooldown policy enabled. Composer reports "2 package version(s) withheld by the cooldown policy": wp-plugin/query-monitor 4.1.0, published 2026-10-26, available in 4 days, and wp-plugin/query-monitor 4.1.1, published 2026-10-27, available in 4 days 11 hours.
Composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update. blog.packagist.com/composer-… #php #phpc #composerphp #supplychainsecurity
Nils Adermann retweeted
Composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update. blog.packagist.com/composer-… #php #phpc #composerphp #supplychainsecurity
Nils Adermann retweeted
I got confirmation that the original version just had an index.html. So there never was any php code executed hahaha.
But they added now an actual .php file (like 18h after they started the challenge. So the 21 hours without successful hack is misleading)
Now it should be exploitable.
But of course it’s incredibly hard to do so when the service gets hammaered and crashing like crazy. Keep in mind, tons and tons of php service don’t get hammered like this. So if somebody gets it now, then that’s actually crazy!
Let me help you @techcrunch: @AWS labeling honeypot hits with PHP_SESSION_UPLOAD_PROGRESS as php2shell is absurd. That field has been in public PHP crash reports and exploit writeups for 10+ years. Likelier: attackers stabbing in the dark with old public info 🧵
Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.
spr.ly/6018BHdOTy
3/ Attackers have also been sending PHP_SESSION_UPLOAD_PROGRESS to servers since Orange Tsai's 2018 HITCON LFI-to-RCE trick blog.orange.tw/posts/2018-10…, which is documented on Exploit-DB exploit-db.com/docs/50157. A honeypot seeing it from an anonymizer IP proves scanning, not php2shell.
Nils Adermann retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php #phpc @ThePHPF
The keyword here is *attempts* and this is getting a bit frustrating, @aws threat intelligence put out a similar statement. But all this is, are requests trying to find a way in, trying to corrupt memory. They don't describe anyone who actually figured out the rest of a chain for RCE. Now, is that concerning, cause clearly quite a few people jump to attacking with AI with even little info? Yes. Is it a sign there was any exploitation, successful RCE before disclosure? No.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
So I guess now is the moment where I start thinking about the fact I'm supposed to give a talk on PHP supply chain security at @MeetMagento_DE tomorow and in the midst of all this haven't really prepared a talk yet? 😆 Guess worst case it's an AMA