security researcher @ctrlaltintel

UK
Joined December 2022
avery retweeted
🚨 #PHP2Shell (CVE-2026-109618, CVE-2026-109619): everyone is staging the leaked PHP RCE, no one has landed it 🫠 We mapped the exposed PHP footprint and went into the attacker open directories after the Oct 21 leak. What we found: → 683,922 IPs leaking a PHP version in one day of scans, mostly end-of-life builds → ~a dozen open-dir workspaces staging php2shell tooling, zero victims or shells in any of them → one mass operator sprayed up to 123 servers via a ~97-proxy farm, zero shells → scanning started ~20 min after the patch, driven by an existing Mirai-style botnet → no public PoC lands code exec on x86-64 yet (OOM corruption vs ASLR) Patch now: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Full research + network observables: hunt.io/blog/php2shell-cve-2…
3
22
6
82
31,933
the ultimate exploit
🚨 #PHP2Shell (CVE-2026-109618, CVE-2026-109619): everyone is staging the leaked PHP RCE, no one has landed it 🫠 We mapped the exposed PHP footprint and went into the attacker open directories after the Oct 21 leak. What we found: → 683,922 IPs leaking a PHP version in one day of scans, mostly end-of-life builds → ~a dozen open-dir workspaces staging php2shell tooling, zero victims or shells in any of them → one mass operator sprayed up to 123 servers via a ~97-proxy farm, zero shells → scanning started ~20 min after the patch, driven by an existing Mirai-style botnet → no public PoC lands code exec on x86-64 yet (OOM corruption vs ASLR) Patch now: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Full research + network observables: hunt.io/blog/php2shell-cve-2…
42
We hacked the hackers infrastructure because they left their AI tool expose /tmp for exploit delivery. Read how: China-Linked Hackers Targeted Governments Across Asia vulone.com/blog/a-china-link…
During routine threat actor infrastructure hunting I identified a suspicious APAC-hosted VPS running an autonomous AI intrusion platform with its entire working directory exposed to the open internet on port 9000. No authentication. 150+ live campaign files sitting there. I published my initial findings. @vulonehq then took it further. @vulonehq obtained authorized access to the server, pulled 16.4 GB of evidence including recovered deleted container layers, and mapped the full scope of the campaign. Read Here: vulone.com/blog/a-china-link… #china #vietnam #indonesia #india #cybersecurity #intrusion
17
109
7
554
39,104
Replying to @Huntio
@huntio Threat actor running automatic earning scripts for Litecoin & Solana 💸 (with goodies!) Let's take a look:
2
6
13
1,143
In particular what's curious about this "Ultimate" exploit is the attack chains that are supposedly utilized:
1
1
98
Additionally, this multi-chain PHP RCE exploit targeting session.upload_progress UAF (CVE-2026-109618, CVE-2026-109619) includes an LFI scanner, gadget serialization (PHPGGC-style), multiple attack chains, and HTTP interaction logic.
1
154
❗️ Hackers spied on government Linux servers for months using AI-written code, and left the AI's chats behind, Unit 42 says. A fake sudo prompt saved admin passwords to a bogus SolarWinds log and a script combed government mailboxes for Facebook emails.
21
220
17
1,482
81,355
目前反朝鲜黑客最成功的案例之一,是荷兰的反诈骗博主 Deeveeaar 曝光的画面,他之前一直在抓那些,假装能远程做程序员的骗子。 结果有位黑客在领英上,盯着这些骗子时,黑进了对方电脑,打开摄像头一看,发现不是普通骗子,而是一群穿着朝鲜军装的年轻人。 这些人住在军队宿舍里,屋里有晾衣架、床铺什么的。他们一边擦军靴、互相开玩笑,一边对着电脑干活。 电脑上开着 VPN 藏着位置,用英文和俄文写代码,还用 AI 帮忙编假简历和信息,然后去各种求职招聘网站,找美国或欧洲的远程工作。 最终入职后,这些人会找机会盗取公司金库(主要是客户资料和加密货币,为朝鲜政府牟利。
从这两年的案例来看,预防朝鲜黑客真的没什么好的办法,唯一有效的就是在合作或面试时,让他在录像前喊一句,金正恩是大傻批。 朝鲜公开侮辱领导人是重罪,家人也会受牵连,哪怕黑客成功盗取过公司金库或客户资料,为国家做过贡献,也不能违反。
230
3,096
141
16,180
2,047,506
🚨 EXCLUSIVE: We uncovered a Meta ad campaign seeking donations for prosthetic legs for Father Miguel, an AI-generated priest. Scammers have used AI, religion and disability to steal money from unknowing users of Facebook, Instagram and WhatsApp, powered by Meta ads. 🧵
18
116
16
403
24,073
🚨 Lognet advertises search engine with over 21 billion infostealer records and free daily lookups IOC: http://lognetbigxp6rritpavbuaq5qz3ni223wjdhw7cm5eav5nppjhbfsbyd[.]onion A service called Lognet is being promoted as a search engine for stolen credentials and information collected by infostealer malware. ⠀ The operators claim to have indexed more than 21 billion records, allowing users to search by domain, email address, or username. The service is accessible through Tor and offers 15 free searches per day without requiring an email address or credit card. ⠀ Paid subscriptions reportedly provide access to additional information, including: • Unmasked passwords and device information • Session cookies • IP addresses and hardware identifiers • CSV, JSON, and XLSX exports • API access for automated searches ⠀ Pricing starts at $5 per month for 525 lookups, with higher tiers offering up to 1,500 searches and unlimited access for business subscribers. ⠀ The service also advertises anonymous cryptocurrency payments and claims that searches return results within milliseconds. ⠀ The size of the dataset and the service's advertised capabilities have not been independently verified. This is NOT and ad. ⠀ 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
3
31
275
25,333
holy cracked
Someone is actively exploiting GolfGang Steam workshop content (maps), I recreated this by watching @xofchains video and seeing he loaded a workshop map The Dev team of GolfGang said they have disabled the upload of workshop items and are working on a fix
114
Someone is actively exploiting GolfGang Steam workshop content (maps), I recreated this by watching @xofchains video and seeing he loaded a workshop map The Dev team of GolfGang said they have disabled the upload of workshop items and are working on a fix
i lost a million robux from a rce exploit on steam... roblox user: BADUS1RNAM3 (red ice crown and red bucket of cheer). Please like if roblox moderation is cheeks. @KreekCraft @Roblox_RTC @Roblox @Rolimons
1
3
1
9
664
New blog: Russian and Allied Government Systems Compromised in Targeted Campaigns ❗️ Notable victims include: - Russian Ministry of Emergency Situations - Kyrgyz Ministry of Foreign Affairs - Syrian Government Customs dept. 🧵👇
1
10
23
2,345