We built https://xitter.cf/t.co/I98Pc28kjm as the web intelligence service for the modern era. Start for free with features for vibe coders all the way through to Enterprise!
London
Joined July 2026
- Tweets434
- Following336
- Followers266
- Likes284
Pinned Tweet
We just made huge improvements to our AI-powered pentesting feature at decloak.dev. It now confirms SSRF, XXE and command injection with real proof, tests every URL and API call a scan finds, and works on single-page apps.
For anyone in cybcersecurity, pentesting and security compliance, check out decloak.dev
decloak.dev retweeted
🧵 PSA: PHP2Shell is critical. But here's what nobody's telling you.
PHP isn't just on your website.
It's in:
• Your cPanel
• Your Docker images
• Your CI/CD runners
• Your Palo Alto firewall
• Your Citrix gateway
• That old server in the closet
"Do you know every place PHP is running?"
Most teams don't.
Here's how to find out 👇
1/ Two critical PHP flaws leaked a day before their patch.
Exploitation attempts started before the fix shipped.
PHP runs most of the websites whose server-side language is known, and updating WordPress doesn't update PHP.
4/ Same week:
- Two Next.js RCEs, CVSS 9.5. Fixed in 16.4.1 and 15.5.28
- Stolen UpdraftCentral keys used to plant backdoor plugins on WordPress sites
- 9 new CISA KEV entries, mostly VPNs and gateways
5/ Full digest, with what to check for each: decloak.dev/journal/uncloake…
Do you know every place PHP is running in your stack, including inside appliances and control panels?
1/ The EU Cyber Resilience Act's first obligations kicked in on 11 September.
US vendor questionnaires keep asking about NIST CSF.
Decloak now maps every scan finding to both. That's eight frameworks from one scan.
4/ What it can't do, plainly:
The 24h and 72h reporting duties in Article 14 are processes, not scan findings, so nothing maps to them.
A web scan is supporting evidence for the CRA, not a conformity assessment.
5/ It works on scans you already run. No setup needed.
Full write-up: decloak.dev/journal/complian…
Has anyone asked you about the CRA yet?
1/ A scan says: "missing Strict-Transport-Security header."
An auditor asks: "How do you protect data in transit, and can you show me?"
Someone has to translate. Compliance mapping does it automatically.
4/ Decloak maps findings to SOC 2, ISO 27001, NIS2, DORA, LGPD and PCI DSS v4.0. It's a Pro feature that runs on the scan you already do.
What it isn't: a certification. A website scan only sees what's observable from outside. Policies and processes are still on you.
5/ The full guide, including use cases and limits: decloak.dev/journal/complian…
Which framework do your customers ask about most?
1/ AI models now write code that compiles about 100% of the time.
They still fail security tests in nearly half of tasks.
Veracode tracked 100+ models for a year. The average pass rate moved from 55% to 56%.
4/ Fair caveat: Veracode tested raw models, with no agents, guardrails or human review.
So 56% is how often models generate flaws, not how often flaws reach production.
But AI now writes roughly half of committed code, and the failure rate has held steady.
5/ Our take: treat AI-written code as unreviewed code, and check what actually ships.
Full breakdown, including what the report doesn't prove: decloak.dev/journal/uncloake…
Is AI-written code reviewed differently on your team?