Just another web warrior ⚔️ Security Researcher ۞ Principal Security Engineer @Verichains ۞ Pwn2Own 2023 ۞@vnsec squad ۞ 💰https://xitter.cf/t.co/wuyz6IfAbA ۞ nano 💻
Inside The PHP Storm
Joined February 2017
- Tweets1.3K
- Following388
- Followers2.6K
- Likes9.4K
Nguyen The Duc retweeted
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
Wiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…
Nguyen The Duc retweeted
PHP Remote Code Execution (CVE-2026-109618 & CVE-2026-109619)
Information about two new remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS v3.1 10 / 10), has leaked ahead of their coordinated disclosure, and security firm Watchtowr Labs confirmed that the flaws are real. Both vulnerabilities are due to be disclosed on Thursday, October 22, alongside patches. Until those advisories land, no fix is available, which leaves the flaws as zero-days in PHP installations everywhere.There is currently a scheduled release of an advisement and possible patch on Wednesday, October 21 2026 at 14:00 UTC.
Below is a video of a researcher, maybe the original researcher, showcasing the exploits.
#CTI #BlueTeam #ThreatIntel #CVE-2026-109618 #CVE-2026-109619
Nguyen The Duc retweeted
Friends ask: “You’re a consultancy with no product, why STAR Labs?” Today’s my answer: 5 RCEs on Pixel 10 & 11, all patched by Google, from a team you could fit round 1 table. We don’t sell a box. We break the unbreakable and tell you how. 👇
Nguyen The Duc retweeted
Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon
Nguyen The Duc retweeted
Google Chrome. Full break-in.
Your product isn't secure. it's just been expensive to break. those are not the same thing, and a lot of founders are about to learn the difference.
One AI just ran the full chain into Chrome for $1,597. weeks of expert human work, done for the cost of a weekend trip.
The wall around your code was never "how good is this." it was "how much does it cost to find the crack." that cost is collapsing.
If breaking in is getting this cheap, checking your own code before someone else does can't be the thing you skip.
That's the gap we sit in. we run this on your code first.
We published every number. Read the full benchmark: hacktron.ai/blog/watching-gp…
Nguyen The Duc retweeted
O aluno: “professor, mas pra que preciso estudar Física mesmo? Vai servir de alguma coisa na minha vida?
A vaca: 👇
Nguyen The Duc retweeted
My third @PwnieAwards trophy! Thanks all, and to my friends who grabbed it on stage for me! 🦄🏆
Nguyen The Duc retweeted
NORTH KOREA JUST GOT HACKED BY NORTH KOREA.
Former military hackers breached the Central Bank of the DPRK and the Foreign Trade Bank, pushed the money into crypto wallets, then cashed out through Chinese brokers in tiny transfers to stay invisible. Arrested at a Pyongyang safe house on July 12.
This is the same state that stole billions of crypto the last few years.
It could not defend its own money from the people it trained.
Nobody is safe.
Nguyen The Duc retweeted
Maybe this is the "Claude, find me a vuln in XNU, make no mistakes" distribution...
This quoted post is unavailable.
Nguyen The Duc retweeted
We successfully achieved an RCE on GitLab in its default configuration.
Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the @depthfirstlabs spirit, we went deeper: into the low-level gem dependency chain beneath GitLab.
The result? By sending crafted JSON data, we could exploit memory-corruption vulnerabilities buried deep in that chain and take control of the GitLab application server.
@depthfirstlabs brings together some of the smartest people, and is building the best security AI agent. Follow our work, and come join us!
Read more about this in the comment...
Nguyen The Duc retweeted
Seems that wp2shell PoCs are now floating around the internet, so we've published our blog post including our research methodology for finding the bug as well as a deep dive into the chain itself - slcyber.io/research-center/e…
Nguyen The Duc retweeted
gist.github.com/testanull/08…
The PoC of SharePoint SE preauth RCE
I still can't believe that MS replaced an old stable one with a new terrible design, come with multiple preauth vuln ¯\_(ツ)_/¯
Nguyen The Duc retweeted
Found an RCE in a popular OTT app - patched fast via responsible disclosure.
Thanks to VSRC & Zalo Security for the quick fix 🙏
Nguyen The Duc retweeted
gnosis pay exploit root cause: a taint of revert data
gnosisscan.io/tx/0x5ea42911c…
Nguyen The Duc retweeted
We reported a critical loss of funds bug to @Thorchain (32M TVL, 150M FDV)
They silently patched it and told us their bug bounty program is permanently retired.
We have more Thorchain chain halt DoS vulns. We intend to release them (open disclosure) in the coming few days
Nguyen The Duc retweeted
Así es como se ve un lanzamiento de cohete desde 400 km sobre la Tierra a bordo de la ISS.
@StarSnap_1
#MateriaOscura