... get it while its hot... 😈 > CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x) > session.upload_progress UAF > jackalsyn.com/posts/php-up-2… > Courtesy of Me, @acd421 & @Archknight23 #CyberSecurity #infosec #php2shell #php

Auto tech startup claims it traced hack attempt back to rival's IP address theregister.com/cyber-crime/…

it's a beautiful day for curl | sh

PHP is shipping a security release tomorrow, Oct 21, at 10:00 AM ET for two critical vulnerabilities, rated CVSS 9.2 per @ThePHPF. It could land earlier if details go public or exploitation shows up. @watchtowrcyber says details already leaked, that both are remote code execution, and rates them a 10. PHP hasn't confirmed any of that, but plan like it's true. Tonight: find every place PHP runs, check versions with php -v and php-fpm -v, and line up a patch window for the morning. Anything older than 8.2 is end of life, so don't expect a fix there. Every PHP install without an owner is attack surface you can cut today.

For the next few days or weeks, anyone now has a root CA thanks to eMudhra. Time to have some fun with MiTMing unwilling devices!

private keys from 8 intermediate CA certs have been compromised (eMudhra) Happy "Update everything" day to all my pager-carrying friends emudhra.we-have-a-problem.co…

I take the bugs from the clankers and bring them down to the bug bounty programs

TRENDING: University of Chicago students are protesting at the CME, demanding an end to the federal ban on onion futures Student-led group For Our Futures is rallying to call for a repeal of the 1958 Onion Futures Act

Me: "If feds get your unlocked Signal, they can ID everyone you talk to regardless of whether they use usernames" ... several months later ... "Police get one ShinyHunter unlocked Signal then rapidly arrest others" Signal is terrible OPSEC for anonymity.

Few months ago Mythos could only find a single vulnerability in curl repository, now it basically became a CTF. What has changed? Better models? No. Better harnessing and steering by subject matter experts.

Russian Kosmos 2612 and ICEYE-X36 (providing Ukraine military support) are now in perfect sync with each other. The Russian military satellite is intentionally stalking and tracking the Western radar satellite. Keeping a satellite "bumper-to-bumper" in this manner allows Russia to intercept or jam data transmissions, physically inspect Western technology, or quickly pivot to execute a kinetic or non-kinetic anti-satellite (ASAT) attack with very little warning or fuel expenditure. Kosmos 2612 executed a series of highly precise, fuel-heavy maneuvers to force itself into a "coplanar" orbit—matching ICEYE-X36's exact altitude (~555 km), speed, and inclination (~97.8°). The ICEYE-X36 satellite is giving the Ukraine military support.

I figured out how ESPN calculates fantasy football win percentage, it’s bad! ESPN made a stats 101 error when calculating their win percentage which leads to horribly miscalibrated numbers. (🧵 thread)

Sorry to be a fascist or whatever, but beating restaurant owners with crowbars will not bring peace to the Middle East.

Authorities say the wife of Alfozan, the OpenAI employee who allegedly bugged an OpenAI exec conference room, was to leave the U.S. on one flight, then a "member of the Saudi military booked and paid" for another one-way flight to Saudi Arabia for the wife and son.

The British Museum has the opportunity to do the funniest thing

That was both hilarious and utterly retarded. On flying out of UK, if you have > 5 cellphones (I have..8), the screeners will call police counterterrorism detectives to interview you. Same as >$10k. I explained HarmonyOS Next v Jolla v Graphene v Android v iOS to them.

😳