#DFIR and research.

Sydney, Australia
Joined August 2010
Matthew Green 🌻 retweeted
Re: the widely circulated blog claiming the PHP bugs aren't easily exploitable: @trailofbits has a working exploit that gets a shell on an unmodified MediaWiki installation. eliastaylor.com/noexploit/
10
52
5
323
33,623
Matthew Green 🌻 retweeted
LLMs...Letting me do fun things I never would have wasted time on. "I reviewed all 30 public GitHub repos for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) by reading code only. The slide has the full grouped table; the headline findings: Nothing works against a real target. Every genuine memory-corruption chain is lab-bound: it needs exact per-build offsets, display_errors=On, a single prefork mod_php worker, and a specific image. Independent reviewers (allureluoli, dinosn, Gi1gamesh123) and the leaked primary source itself all converge on "no public artifact achieves code execution" on the patched core bug. Every real shell in these repos comes from an app-side LFI or deserialization sink, not the CVE. Three are original and real, all lab-only. 9bie (the source of the Set-Cookie leak chain), Marven11 (the most sophisticated, a true in-band leak), and Karasawa2025 (whose "Fermat" troll description hides a working ROP + display_errors=off exploit). These are the only ones with a genuine ASLR-defeating leak primitive that is their own. Most are copies. One original (9bie) spawned five derivatives: - twili8 is an outright uncredited rip-off: its own README still says git clone 9bie/... and the Docker files are byte-identical. - godylockz and xuehuolll are byte-identical to each other. - dinosn and 3em0 are credited ports that add value. Three are mislabeled. iQingshan, KarimUD7 (≈98% the same code), and Gi1gamesh123 exploit a different bug entirely (the Calif unserialize var_hash UAF) against their own planted endpoints, filed under the php2shell CVE numbers. The rest is noise. The most-starred repo (ikow, 905★) delivers the least: broken or stubbed chains with the two "real" ones paywalled behind Substack. eness (558★) is a leakless forge that can't defeat ASLR. syrex1013 ships AI-generated fake CVEs in a side directory. Whackermelon hallucinates a non-existent openai/php2shell-checker. lcfr-eth is a parody with a memecoin address, and Icex0 is an empty repo. The genuinely honest work is the crash labs (allureluoli, slabbdev, 0x4148), which prove the bug without claiming RCE. The ASLR column, star counts, copy lineage, and the specific "tell" for each repo are all in the table. The page is private to your account; use the Share menu if you want to send it to the team"
17
39
1
217
19,881
Matthew Green 🌻 retweeted
If you're looking for the most detailed AND *entertaining* way to read about the php2shell bugs, the Calif post is epic: calif.io/php2shell/
3
54
178
17,956
🦖 PHPInventory for Velociraptor 🔎 Inventory PHP across Windows, Linux and macOS: package versions, binary paths and running processes to help scope remediation. 🔗 docs.velociraptor.app/exchan… #DFIR
1
7
735
Matthew Green 🌻 retweeted
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can: php.net/index.php#2026-10-20…
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0. ⠀ Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8. PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases. ⠀ The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected. ⠀ Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
84
567
165
2,984
1,022,460
Matthew Green 🌻 retweeted
How’s that FOMO holding up one month on? 👀 Whether you missed out or just want to relive the best bits, the unprompted.au talks are now online! All the AI. All the cyber. None of the FOMO. 🐙 youtube.com/@unpromptedAU
19
1
65
8,611
Matthew Green 🌻 retweeted
Announcing ADVERSARY AFTERLIFE 16 former threat domains, reborn as visual histories of real attacks: the APTs, malware and TTPs behind them, and the defenders who exposed them. Told through UwU Underground's art, music and lore. Coming soon
Ummm dear threat intel agencies: Do not be alarmed by domains previously used by RU, DPRK, or CN APTs suddenly being repurchased in the last 72 hours It is us doing a preservation edutainment project Thank you for attention in this matter 6 Hugs and Kisses, UwU Underground
11
40
1
185
6,396
The hottest day ever officially recorded in Australia, using a standard Stevenson screen at a government weather station, was 125 °F (51.7 °C) on Sunday, 3 January 1909, at Bourke, New South Wales. For decades this was long recognised as Australia’s hottest day. However, it didn’t fit the “global warming” narrative. For if, as alarmists assert that “climate change” is causing unprecedented record heat, how could our hottest-ever day have occurred back in 1909? So just as Orwell described in 1984, the Bureau of Meteorology (BOM) rewrote history. "Every record has been destroyed or falsified, every book rewritten, every picture has been repainted, every date has been altered. And the process is continuing day by day and minute by minute ….. Nothing exists except an endless present in which the Party is always right.” The BOM’s excuse for erasing this record was that the observer at the Bourke Post Office in January 1909 supposedly made a mistake. "Observer error" someone at the BOM decided from a desk in Canberra a century later. The BOM’s justification for declaring it a “mistake” was the assertion that no nearby weather station recorded a similar temperature spike on the same day, so therefore the 125 °F reading at Bourke must have been an error. But that claim by the BOM is a LIE. Before COVID, I personally visited the Australian National Archives to examine the original handwritten meteorological observation books because I no longer trusted the BOM after some of their earlier data manipulations. The archived observation book from the official weather station at Brewarrina — the nearest official station to Bourke, just 100 km away — recorded a maximum temperature of 50.6 °C (123 °F) on the very same day in January 1909. The hottest temperature ever recorded there. Thus, we had two official government weather stations only 100 km apart both independently recorded extreme heat on the same day: Bourke 125 °F and Brewarrina 123 °F. Game, set, match. The Bourke record must be reinstated and the BOM held accountable for their malfeasance and fraudulent attempt to rewrite our history. One of my regrets is that the human-rights abuses inflicted upon Australians during the COVID years, along with the malfeasance at the TGA, distracted me from pursuing this matter in Parliament further at the time. Any organisation that can so brazenly and fraudulently tamper with historical data, as the BOM has done, simply cannot be trusted. I’d bet London to a brick that the very same people at the BOM who fraudulently altered our climate history have their fingers all over the $100 million of taxpayers’ money they’ve spent “updating their website”. There should be a full investigation into the Bureau of Meteorology. I volunteer to head it.
I wonder on the BOMs new $100 million website, how much historical data they purged ?
163
1,282
78
5,295
71,787
Matthew Green 🌻 retweeted
Unit 42 just published timely intel on C2Agent: Windows malware where an LLM runs the host. Jingwen Shi, Gaurav C G, Mark Lim, Tyler Halfpop, and Ashutosh Chitwadgi tracked 32 samples across ~a month of active development. github.com/PaloAltoNetworks/…
4
11
63
3,252
I wonder what they sacrificed to the live demo gods to pull that off ? 😳
Flying cars are real. Tesla Roadster is INSANE. BRO WHAT THE FK
1
1
360
Matthew Green 🌻 retweeted
the Tesla Roadtser can literally fly, holy fook
34
78
47
1,356
366,745
Matthew Green 🌻 retweeted
Analysis of a recent Kimsuky using three distinct initial delivery vectors that all converge on long-term persistence and data theft. Decoy documents are multilingual (predominantly Korean, plus Japanese, Vietnamese, German, English) and themed around insurance and financial content (contracts, premium agreements, fund-execution attachments). Primary target is South Korea, with suspected expansion to other regions and sectors (finance, R&D). Three Delivery Paths Phishing LNK (batch-based). Phishing LNK (PowerShell). Supply-chain poisoning: Attacker cloned the legitimate open-source quant-backtesting library pybroker, planting malicious code in tests/conftest.py (auto-loaded by pytest). It XOR-decrypts (0x5A key) an .env file, downloads key.enc, AES-GCM decrypts it to C:\Users\Public\1.bat executed silently. Triggers only on test runs and is inert on non-Windows (returns a fake random seed) to evade detection. mp.weixin.qq.com/s/LkX7gqz6u…
8
16
2,258
Matthew Green 🌻 retweeted
Hi, I'm Felix. I'm an eng lead working on Claude. I love watching people take flight and do things they never thought possible. We often describe that as "being more ambitious" when using AI, which is tricky advice to follow. I wrote a tutorial: felixrieseberg.com/how-to-be…
398
2,502
562
23,948
5,269,619
Matthew Green 🌻 retweeted
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work. At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated. We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
4,170
6,088
5,730
77,621
26,064,212
Pretty much sums up the trend towards authoritarianism in the west... 😢
Well, that was wild. I'm at the Australian Parliament and just left a meeting with two staffers for the governing party. They told us that the government needed more power to censor things like the upcoming US execution of Nidal Hasan. When I asked why they needed to censor that video, one said it was to prevent copycat killings. Copycat killings by governments? I asked. Er, no, they said. Copycat killings like of a backpacker, several decades ago. So, under that logic, I pointed out, the government should censor things like last year's Bondi massacre, where two Muslims killed 15 people, no? Well, that was news, they said. Didn't they realize their bill would allow the government to censor news? They didn't seem to know, or care. They also admitted that they did not know that the bill would allow the government to create and operate an unlimited number of fake social media accounts to attack its political enemies and spread disinformation. Having presented them with information they had never heard about a bill they had clearly not read, they emphasized to us, strenuously, that they were moving forward with the bill. So there you have it. The government wants the power to arbitrarily censor scenes of violent crime, or violence, for any reason. And it wants the power to use an unlimited number of fake accounts to wage offensive disinformational warfare against the Australian people. Given that the Bondi massacre last year increased public opposition to mass migration, and support for the populist One Nation Party, it seems obvious that the government wants to censor such events in order to protect its political power. It's quite telling how obediently governing party members insist such a law is needed without even knowing what's in it.
261
Matthew Green 🌻 retweeted
Introducing Muse Wonder, our new family of frontier models with state of the art performance for personal and professional agentic work.
2,382
3,082
2,837
38,849
5,986,183