🚨 #PHP2Shell (CVE-2026-109618, CVE-2026-109619): everyone is staging the leaked PHP RCE, no one has landed it 🫠
We mapped the exposed PHP footprint and went into the attacker open directories after the Oct 21 leak.
What we found:
→ 683,922 IPs leaking a PHP version in one day of scans, mostly end-of-life builds
→ ~a dozen open-dir workspaces staging php2shell tooling, zero victims or shells in any of them
→ one mass operator sprayed up to 123 servers via a ~97-proxy farm, zero shells
→ scanning started ~20 min after the patch, driven by an existing Mirai-style botnet
→ no public PoC lands code exec on x86-64 yet (OOM corruption vs ASLR)
Patch now: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.
Full research + network observables: hunt.io/blog/php2shell-cve-2…
the ultimate exploit
🚨 #PHP2Shell (CVE-2026-109618, CVE-2026-109619): everyone is staging the leaked PHP RCE, no one has landed it 🫠
We mapped the exposed PHP footprint and went into the attacker open directories after the Oct 21 leak.
What we found:
→ 683,922 IPs leaking a PHP version in one day of scans, mostly end-of-life builds
→ ~a dozen open-dir workspaces staging php2shell tooling, zero victims or shells in any of them
→ one mass operator sprayed up to 123 servers via a ~97-proxy farm, zero shells
→ scanning started ~20 min after the patch, driven by an existing Mirai-style botnet
→ no public PoC lands code exec on x86-64 yet (OOM corruption vs ASLR)
Patch now: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.
Full research + network observables: hunt.io/blog/php2shell-cve-2…
avery retweeted
We hacked the hackers infrastructure because they left their AI tool expose /tmp for exploit delivery.
Read how: China-Linked Hackers Targeted Governments Across Asia
vulone.com/blog/a-china-link…
During routine threat actor infrastructure hunting I identified a suspicious APAC-hosted VPS running an autonomous AI intrusion platform with its entire working directory exposed to the open internet on port 9000. No authentication. 150+ live campaign files sitting there.
I published my initial findings. @vulonehq then took it further.
@vulonehq obtained authorized access to the server, pulled 16.4 GB of evidence including recovered deleted container layers, and mapped the full scope of the campaign.
Read Here: vulone.com/blog/a-china-link…
#china #vietnam #indonesia #india #cybersecurity #intrusion
In particular what's curious about this "Ultimate" exploit is the attack chains that are supposedly utilized:
avery retweeted
Interesting reporting on APT28/Fancy Bear by @symantec
"Russian Espionage Group Targets Defense Firms in Two NATO Countries"
security.com/threat-intellig…
👇
avery retweeted
❗️ Hackers spied on government Linux servers for months using AI-written code, and left the AI's chats behind, Unit 42 says.
A fake sudo prompt saved admin passwords to a bogus SolarWinds log and a script combed government mailboxes for Facebook emails.
avery retweeted
目前反朝鲜黑客最成功的案例之一,是荷兰的反诈骗博主 Deeveeaar 曝光的画面,他之前一直在抓那些,假装能远程做程序员的骗子。
结果有位黑客在领英上,盯着这些骗子时,黑进了对方电脑,打开摄像头一看,发现不是普通骗子,而是一群穿着朝鲜军装的年轻人。
这些人住在军队宿舍里,屋里有晾衣架、床铺什么的。他们一边擦军靴、互相开玩笑,一边对着电脑干活。
电脑上开着 VPN 藏着位置,用英文和俄文写代码,还用 AI 帮忙编假简历和信息,然后去各种求职招聘网站,找美国或欧洲的远程工作。
最终入职后,这些人会找机会盗取公司金库(主要是客户资料和加密货币,为朝鲜政府牟利。
avery retweeted
🚨 EXCLUSIVE: We uncovered a Meta ad campaign seeking donations for prosthetic legs for Father Miguel, an AI-generated priest.
Scammers have used AI, religion and disability to steal money from unknowing users of Facebook, Instagram and WhatsApp, powered by Meta ads. 🧵
avery retweeted
🚨 Lognet advertises search engine with over 21 billion infostealer records and free daily lookups
IOC: http://lognetbigxp6rritpavbuaq5qz3ni223wjdhw7cm5eav5nppjhbfsbyd[.]onion
A service called Lognet is being promoted as a search engine for stolen credentials and information collected by infostealer malware.
⠀
The operators claim to have indexed more than 21 billion records, allowing users to search by domain, email address, or username. The service is accessible through Tor and offers 15 free searches per day without requiring an email address or credit card.
⠀
Paid subscriptions reportedly provide access to additional information, including:
• Unmasked passwords and device information
• Session cookies
• IP addresses and hardware identifiers
• CSV, JSON, and XLSX exports
• API access for automated searches
⠀
Pricing starts at $5 per month for 525 lookups, with higher tiers offering up to 1,500 searches and unlimited access for business subscribers.
⠀
The service also advertises anonymous cryptocurrency payments and claims that searches return results within milliseconds.
⠀
The size of the dataset and the service's advertised capabilities have not been independently verified.
This is NOT and ad.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
holy cracked
Someone is actively exploiting GolfGang Steam workshop content (maps), I recreated this by watching @xofchains video and seeing he loaded a workshop map
The Dev team of GolfGang said they have disabled the upload of workshop items and are working on a fix
avery retweeted
Someone is actively exploiting GolfGang Steam workshop content (maps), I recreated this by watching @xofchains video and seeing he loaded a workshop map
The Dev team of GolfGang said they have disabled the upload of workshop items and are working on a fix
i lost a million robux from a rce exploit on steam...
roblox user: BADUS1RNAM3 (red ice crown and red bucket of cheer). Please like if roblox moderation is cheeks.
@KreekCraft
@Roblox_RTC
@Roblox
@Rolimons

























