Documentation is lies. Source is an abstraction. Assembly is the truth. Also at https://xitter.cf/t.co/VYFZ0HHnQn and nostr npub10mx0gx3r2lszrrut8kvr5mt2m8r9ffhn
Joined May 2010
- Tweets8K
- Following1.7K
- Followers6.9K
- Likes81.8K
scriptjunkie (Matt) retweeted
... get it while its hot... 😈
> CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x)
> session.upload_progress UAF
> jackalsyn.com/posts/php-up-2…
> Courtesy of Me, @acd421 & @Archknight23
#CyberSecurity #infosec #php2shell #php
scriptjunkie (Matt) retweeted
Auto tech startup claims it traced hack attempt back to rival's IP address theregister.com/cyber-crime/…
scriptjunkie (Matt) retweeted
PHP is shipping a security release tomorrow, Oct 21, at 10:00 AM ET for two critical vulnerabilities, rated CVSS 9.2 per @ThePHPF. It could land earlier if details go public or exploitation shows up.
@watchtowrcyber says details already leaked, that both are remote code execution, and rates them a 10. PHP hasn't confirmed any of that, but plan like it's true.
Tonight: find every place PHP runs, check versions with php -v and php-fpm -v, and line up a patch window for the morning. Anything older than 8.2 is end of life, so don't expect a fix there.
Every PHP install without an owner is attack surface you can cut today.
scriptjunkie (Matt) retweeted
For the next few days or weeks, anyone now has a root CA thanks to eMudhra. Time to have some fun with MiTMing unwilling devices!
scriptjunkie (Matt) retweeted
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
scriptjunkie (Matt) retweeted
I take the bugs from the clankers and bring them down to the bug bounty programs
Me: "If feds get your unlocked Signal, they can ID everyone you talk to regardless of whether they use usernames" ... several months later ... "Police get one ShinyHunter unlocked Signal then rapidly arrest others"
Signal is terrible OPSEC for anonymity.
xitter.cf/scriptjunkie1/status/2…
Tracking Signal Identifiers
Signal groups, the "ICE tracker" channels, are under FBI investigation. Members rapidly change display aliases, usernames, and channels. But users can track others through changes and the FBI can ID them all. Here's how:
scriptjunkie.us/2026/01/trac…
Military fast rope demo before the UTSA Navy game went wrong. First guy going down the rope from the Alamodome ceiling lost his grip and fell. Praying he survived.
Guy was a 15 year experienced special warfare instructor. I'd really love to see if some expert has written explanations showing what goes wrong. I mean, I send my inexperienced kid to day camp with rappelling, what do they do differently? Should I worry?
kens5.com/article/news/local…
scriptjunkie (Matt) retweeted
Russian Kosmos 2612 and ICEYE-X36 (providing Ukraine military support) are now in perfect sync with each other. The Russian military satellite is intentionally stalking and tracking the Western radar satellite. Keeping a satellite "bumper-to-bumper" in this manner allows Russia to intercept or jam data transmissions, physically inspect Western technology, or quickly pivot to execute a kinetic or non-kinetic anti-satellite (ASAT) attack with very little warning or fuel expenditure.
Kosmos 2612 executed a series of highly precise, fuel-heavy maneuvers to force itself into a "coplanar" orbit—matching ICEYE-X36's exact altitude (~555 km), speed, and inclination (~97.8°). The ICEYE-X36 satellite is giving the Ukraine military support.
scriptjunkie (Matt) retweeted
Sorry to be a fascist or whatever, but beating restaurant owners with crowbars will not bring peace to the Middle East.
scriptjunkie (Matt) retweeted
Authorities say the wife of Alfozan, the OpenAI employee who allegedly bugged an OpenAI exec conference room, was to leave the U.S. on one flight, then a "member of the Saudi military booked and paid" for another one-way flight to Saudi Arabia for the wife and son.
scriptjunkie (Matt) retweeted
That was both hilarious and utterly retarded.
On flying out of UK, if you have > 5 cellphones (I have..8), the screeners will call police counterterrorism detectives to interview you. Same as >$10k.
I explained HarmonyOS Next v Jolla v Graphene v Android v iOS to them.
