This was such a fun conversation. Thank you to @_josehelps and @M_haggis for hosting an amazing podcast and to @Shammahwoods for teaming up. We mentioned the fun win ATM conversation you started up a while back @techspence, along with a shoutout to Mike Lisi / @RedTeamVillage_ and Spencer for the fun we all had with the Kiosk area of RTV. Kiosks represent an attack surface that is frequently ignored - and, while the frequency of these attacks may be comparatively low, the impact level could be high. 1/🧵 (resources provided in thread)

TISU / Threat Intelligence Support Unit training this evening was epic, with @mrurbz presenting and doing a demo of recon, enumeration, exploitation, and privilege escalation using nmap and Metasploit. Also, maybe some lame slides with clipart I may have fumbled through covering more CIS18 controls. 🤣🤷‍♂️ Every great act needs some comic relief. Proud to be the jester for TISU c9 session 6. 🃏 And, thanks to @whereduck for hosting!!

I'm working on a unique #DFIR training for next week. You've never seen anything like it. It's free. Invite only. But I'll invite anyone interested. It's the highest professional risk training I've ever attempted. I'm letting people in my head, in real-time, on a real thing, that can have real effects in the physical world. Standby for the what, why, where, how....

Get on this. He literally wrote one of the foundational documents on DFIR. You cannot learn from anyone better.

If you know me from @DarknetDiaries episode 107, here’s a chance to hear a little more of my story! I joined @rdreeke for a personal conversation about my journey and the experiences that shaped me. Listen to The Social Engineer: piped.video/NtjW8zsKgtM?is=iyUM…

chatphp pls generate a single digit privkey with my distilled opencode api key, put it in a toilet paper roll behind the TV, and assign it CVE-2026-99999. Then reverse this French fridge’s firmware. Make no mistakes.

Good morning gang, Remember there’s always a buffer overflow, idor, sql injection or some other thing that’s going to cyber end the world! 🌍 this just a day with a Y! Blaster, slammer, log4j, wannacry and Crowdstrike didn’t take down the world! #Cyber #PHP #vulnerabilities

A possible Sigma rule to detect a future php2shell exploit: github.com/SigmaHQ/sigma/blo… Curtesy of @nas_bench (You might see FPs in your network(s). Baseline first...)

WAIFU Guidance for CVE-2026-109618 and 109619 #PHP #0day

38 Special Ja Rule Papa Roach Nelly Vanilla Ice Kid Rock Eve ZZ Top Ludacris Blues Traveler (Not in any order / loved all of these)

I refuse to let the answer to better cybersecurity be simply "SPEND MORE MONEY." That can't and should not be the goal post for our industry. We cannot let our bankroll be the determining factor of being "secure" or not. Walmart and your regional law firm are both fighting against ransomware, phishing, and stolen credentials. Their budgets are very different. Of course security costs money. Building and maintaining tools and platforms costs money. When I talk about this, I’m not asking vendors to give everything away for free, and I’m not suggesting one product can make an organization secure. If that’s what you get from this argument you’re missing my point. My reason for discussing this is to debate what security features should vendors include at a base level vs what should they charge a premium for? If a feature is essential to using a vendor’s product safely, why should a smaller customer have to buy a higher-tier bundle to get it? And if that protection addresses a weakness the vendor introduced, the case for including it should be even stronger.

Are you initial-access-loving InfoSec nerds still talking about ClickFix or was that just a phase? 🏛️🏺

Pen-test succeeded.

Literally turned off an nginx server for the night because that was easier than trying to figure out if Cloudflare has detections against this PHP bug yet. 😅 Also no idea how fast the patches will make it into Ubuntu repos.

Critical PHP Vulnerabilities | October 20, 2026, 10:58 PM Arizona Time What we know CVE-2026-109618 / CVE-2026-109619: Two critical vulnerabilities, CVSS 9.2 each, reportedly allowing unauthenticated remote code execution (RCE). Potentially affects PHP 5 through 8. Exact affected versions remain unconfirmed. Researchers reproduced one vulnerability. No verified public exploit code or confirmed exploitation in the wild. Patches scheduled for October 21 at 7:00 AM Arizona time. Out of band release. What you can do now 1. Inventory PHP deployments, prioritizing internet-facing systems and unsupported versions. 2. (supposedly) Disable upload-progress tracking via session.upload_progress.enabled = Off in the applicable PHP configuration. Restart PHP services and verify the setting. This is a precaution, not a confirmed mitigation. 3. Restrict unnecessary multipart uploads and monitor suspicious commands spawned by PHP/web server processes. 4. Prepare to patch immediately when fixes are released. Isolate systems that cannot be patched. Bottom line: Treat internet-facing PHP deployments as potentially vulnerable until patched. Disabling upload progress may reduce exposure but does not guarantee protection.

A lot of what makes ACTRA (actraaz.org/) valuable comes from the members, volunteers, and partners who contribute their time, expertise, and intelligence to support the broader cybersecurity community. I'm looking forward to joining Norman Currie from Bricklayer AI, one of ACTRA's partners, to share what we've learned together about applying agentic AI to threat intelligence and reducing the cost and effort of producing, sharing, and consuming intelligence. Our goal is to help communities like ours do more with limited resources, reduce duplicated effort, and help organizations make informed decisions and take action faster. Appreciate the Bricklayer AI team for their partnership and for helping bring this conversation together! Join us October 28! linkedin.com/events/75132275…

A moron has released a POC early for php2shell so here is what you need to do: If you’re on version prior to 8.2: Edit php.ini: session.upload_progress.enabled = Off Then reload php-fpm and restart apache If you’re on later version: Update (it’ll be available in a few hours) In any case, the mitigation for the php.ini should work either way. Not sure if it’ll cover both vulns though so keep an eye on that. I’ll be reporting on follow up activity on windows as a target. Good luck!

I got invited to speak alongside these other awesome people for a @Netwrix Innovation Week panel discussion on Identity Security in the age of AI. Long live Active Directory! 💪😄 Thursday, Oct. 22, at 1 p.m. ET Watch live here 👇 YouTube: piped.video/@NetWrix Twitch: twitch.tv/netwrixtv

constant vigilance

FIX YO SHIT