wannabe hacker... he/him 🌱 grow your hacking skills @hextreeio
Internet
- Tweets 10,328
- Following 1,276
- Followers 164,218
- Likes 6,643
Pinned Tweet
Where to find me:
🔴 Hacking Videos: piped.video/LiveOverflow
📜 Articles: liveoverflow.com
💻 Start Hacking? liveoverflow.com/start-hacki…
🥰 Support: liveoverflow.com/support
📹 2nd Channel: piped.video/LiveUnderflow
🤳 Instagram: instagram.com/liveoverflow
15
107
651
If you use AI for "safety", at least do it with some due diligence. This checker is not accurate and will report false positives.
If you are wondering whether your website is affected, we have packaged a Codex skill to help check.
Point your Codex at this repo to guide you through it: github.com/openai/php2shell-…
2
2
54
5,212
Made a quick video (aka 5h of work), about my experience racing to find php2shell.
piped.video/watch?v=7CiZmq2l…
5
35
251
13,518
LiveOverflow 🔴 hextree.io retweeted
Omg I found a copy of the original memory_limit advisory. marc.info/?l=bugtraq&m=10898…
9
44
271
46,360
LiveOverflow 🔴 hextree.io retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
48
248
1,748
145,251
I don't know the php ecosystem. Is this useful for anything?
This fell off the clanker-train while looking for php2shell
8
3
223
34,318
Official update instructions recommend a third-party provider that adds telemetry? 🤨
40
22
617
71,976
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac (posted in august)
(related)
8da579ec498d57c20977c8d186d7f6cd4c04f46ffa1b436dd646ec19b99bdf47
cb4c8532c245ff7e05d6e270fca5742bb3271f541ef80f0071ca3d4307eb2b53
957f8cc21b18483f80a9d723aa4f9ded26e456424ffd065a044d1ed9d58a4fbc
4f93976ef105f0d9ff2d60f35d48958c8bba9d9eb2873cd93b3f7105fa4716a6
Despite all the doom and gloom from InfoSec we are how many months are into people throwing endless tokens at various OSS projects? Hows Apache? Nginx? OpenSSH doing? Any public point and shoot RCEs in RDP/SMB in Windows? All of the above technology getting wrecked in the wild?
25
9
166
61,860
There we go
wiz.io/blog/php2shell-php-rc…
4
49
418
30,745
I don't think this is real? Or it's a different issue? Did anybody check this properly?
... get it while its hot... 😈
> CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x)
> session.upload_progress UAF
> jackalsyn.com/posts/php-up-2…
> Courtesy of Me, @acd421 & @Archknight23
#CyberSecurity #infosec #php2shell #php
14
4
56
18,084
1000% OpenAI is doing this. It refuses even to setup fuzzing in the related area.
I am wondering if you can use the guardrails as an oracle to figure out where the vuln is 🤔
But I have to go to bed now. So reply with any findings pls so I can read in the morning. kthx
A prompt like this would never be refused by Daybreak blue before. I am wondering if OpenAI set guardrails specific to this vuln to slow down rediscovery.
12
6
123
15,727