security researcher good guy hacker AI tinkerer OSCP certificate owner ADHD Brain owner https://xitter.cf/t.co/6AvGIhVjFJ
Joined July 2015
- Tweets65.3K
- Following831
- Followers3.6K
- Likes2.4K
RedPacket Security retweeted
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
RedPacket Security retweeted
Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.
foxio.io/blog/header-accordi…
RedPacket Security retweeted
php2shell の検証ついでに、パッチを追う中で session.upload_progress の filename 注入 + LFI を自分でPoC化してみた！
8.5.4 でも 8.5.12（パッチ版）でも www-data でコマンド実行までいけた
既知の手法で LFI 前提だけど、この経路はパッチ後も塞がってない
#php2shell #PHP #CVE2026109618
RedPacket Security retweeted
Great work by the @TalosSecurity team getting this out quickly! If anything in your business runs on PHP, this is critical info and requires every company to move quickly. The old habit of baking patches into the next general purpose release isn't going to survive the AI era.
Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset blog.talosintelligence.com/t…
RedPacket Security retweeted
BREAKING: US spy agency urged organizations to take websites offline if they cannot immediately fix two serious security flaws in PHP, a programming language behind a large share of the world's websites
insiderpaper.com/nsa-fix-php…
RedPacket Security retweeted
This might be the most watched GitHub Actions build in the history of the platform: github.com/docker-library/ph…
RedPacket Security retweeted
🚨 PHP2Shell may begin with malicious requests that blend into routine scanning, but the activity that follows should be more recognizable.
ReliaQuest assesses that threat actors will use code execution to expand access by spawning shells, running discovery commands, downloading tools, establishing persistence, and moving laterally. This can turn a PHP exploit into broader server compromise, data theft, and operational disruption.
Patching closes the vulnerability but will not remove existing access. Organizations should patch immediately, rotate exposed secrets, and use behavioral detections and retrospective hunting to identify post-exploitation activity.
Read the full assessment:
ow.ly/ySiy50ZZOmA
#ReliaQuest #ThreatResearch #AgenticAI
RedPacket Security retweeted
🚨 Fixes are out for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
Security researchers: If you find affected assets within program scope, submit validated findings with clear evidence and impact.
Details: bit.ly/4z1vVUX
RedPacket Security retweeted
Los que se reían de PHP esta mañana, revisad vuestro Node.js.
Node.js ha parcheado hoy 4 vulnerabilidades de gravedad alta. El mismo día que PHP. Aquí no se libra nadie.
La más grave, CVE-2026-111497, está en el decodificador Brotli y, según Node.js, permite ejecutar código en remoto.
Pero la que más me preocupa es otra: dos fallos permitían saltarse la comprobación del nombre de host en TLS.
Tu aplicación puede dar por bueno un certificado que no es del servidor con el que habla.
El candado sigue ahí, pero ya no garantiza nada.
Si tienes algo en Node.js:
➡️ Ejecuta node -v. Si es anterior a la v22.23.4, la v24.22.1 o la v26.12.1, actualiza
➡️ Si despliegas con Docker, reconstruye la imagen. Actualizar tu equipo no cambia lo que está en producción
➡️ Si sigues en Node.js 18 o 20, no hay parche para ti: toca migrar
RedPacket Security retweeted
🚨 Nightmare day for cybersecurity
Multiple major security incidents, active exploits, supply chain compromises...
If you run production systems, start patching NOW.
PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW
LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets.
eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores.
Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs.
TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff.
Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors.
BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign.
And that's not even the full list.
Patch. Audit. Rotate. NOW.
RedPacket Security retweeted
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
For more⬇️
ncsc.gov.uk/news/critical-se…
RedPacket Security retweeted
Damn, this is really bad.
Mainstream browsers will probably be fine, but there is a long tail of other stuff that will be affected by this:
scotthelme.co.uk/eight-bits-…
RedPacket Security retweeted
Ofcom Concedes Defeat in the 4chan Case
prestonbyrne.com/2026/10/20/…
RedPacket Security retweeted
⚠️ 𝗜𝗻𝘁𝗲𝗿𝗲𝘀𝘁𝗶𝗻𝗴 𝗼𝗻𝗲 𝗳𝗼𝗿 𝗳𝗲𝗹𝗹𝗼𝘄 𝗱𝗲𝗳𝗲𝗻𝗱𝗲𝗿𝘀.
A domain registered just 𝟭𝟯 𝗱𝗮𝘆𝘀 𝗮𝗴𝗼, closely resembling a Microsoft Copilot FQDN. VirusTotal at capture time: 𝟬/𝟵𝟮 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻𝘀.
Sharing for awareness. 🛡️
#ThreatHunting
RedPacket Security retweeted
Some sample: https://updatestates.blob.core\.windows.net/files/WindowsDefender.msi
A file named "WindowsDefender.msi" coming from Microsoft's network, with no AV vendor detecting it on VT and was signed using an SSL Corp given cert with name "SOPHISTICATED SOFTWARES (PTY) LTD" must be legit, right?
😂
🤷♂️
RedPacket Security retweeted
‼️ UPDATE: Calif showed one-tap attacks on Signal and iMessage on iOS, which make it possible to run code on an iPhone with a booby-trapped PDF.
On iOS 26.5, opening one in iMessage sent the phone's messages to a server.
Calif says everything will be released "in due time."
