byteMe

red teaming

[byteMe @0xby7e_me]

Just open-sourced WinLPEAuditor - a Windows LPE misconfiguration auditor built in C++.

Checks for unquoted service paths, AlwaysInstallElevated, dangerous token privileges, modifiable service binaries, and more. Native binary, no PowerShell, no .NET.

https://t.co/4eNt4kJmWQ

[solst/ICE of Astarte @IceSolst]

>junior dev at a mid startup
>wednesday morning
>just want to push a minor bugfix to our php app today
>open laptop, check slack
>company group chat is an absolute warzone
>CTO typing in all caps about php2shell
>fucking php
>whatever, server hasn't blown up yet, I just need to get my code in
>open gitlab to merge the PR
>forced emergency logout because of a critical gitlab security patch release
>fucking gitlab
>pipeline fails because of some weird regex compiler bug
>spend 40 minutes fighting CI/CD
>i can just use AI to help debug
>fire up opencode
>api keys nuked because they were breached
>fucking opencode
>i’ll just get fresh LLM api keys from our corp proxy, LiteLLM
>it won’t connect? It’s down?
>look up LiteLLM news: supply chain compromise
>fucking litellm
>cold sweat forming
>slack alert: db connection error
>check our database connection
>we host on TiDB Cloud
>they just announced a security breach, unauthorized access via stolen service account credentials, data copied
>fucking tidb cloud
>full panic attack incoming
>figure fuck it, just ship the container to Railway and go home
>open Railway dashboard
>bright red banner: "Security Disclosure: Rotate all environment variables immediately. All builds paused."
>fucking railway
>try to open the app URL in browser to see if anything is even working
⁠>NET::ERR_CERT_AUTHORITY_INVALID⁠
>eMudhra intermediate certificates compromised
>4
>instantly untrusted by every major browser
>fucking emudhra
>stare blankly at mac screen for 10min
>random pop-up
>restarting in 10min to fix a critical vulnerability
>fucking macos
>close laptop
>leave office
>never come back

[php-net @php_net]

PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619).

Changelog + downloads: https://t.co/q5agMkUfNe

[Low Level @LowLevelTweets]

hey man. if you run php.

turn it off.

[Kostas @Kostastsale]

A moron has released a POC early for php2shell so here is what you need to do:

If you’re on version prior to 8.2:
Edit php.ini: session.upload_progress.enabled = Off

Then reload php-fpm and restart apache

If you’re on later version:
Update (it’ll be available in a few hours)

In any case, the mitigation for the php.ini should work either way. Not sure if it’ll cover both vulns though so keep an eye on that. I’ll be reporting on follow up activity on windows as a target.

Good luck!

[byteMe @0xby7e_me]

Responsible disclosure isn’t “I reported it to the security team, so now I can post the exploit“

Reporting a bug doesn’t mean you can publish the exploit. The 1-day PHP RCE puts real users at risk until patched. Security isn’t about clout.

#php #rce #cve #security

[kara @Karakazzz]

okay I will be officially quitting my job and I’m going to start working with animals. I really want to blow my head smooth off seeing this

[Gezine @gezine_dev]

Hello 14.10

[byteMe @0xby7e_me]

New post: Writing a Beacon Object File from scratch in C.

COFF internals, dynamic import resolution, and building a privilege enumeration BOF - no frameworks, no wrappers.

Plus why execute-assembly lights up every EDR while BOFs barely register.

https://t.co/fuAJKeDaJ0

[byteMe @0xby7e_me]

Dropping tomorrow: my deep dive on writing a Beacon Object File from scratch in C.

From COFF internals to a working privilege enumeration BOF - plus what defenders should actually look for.

https://t.co/M5eSrR6mK8

[raizo @ostpsychosen]

shes gonna break luks encryption

[byteMe @0xby7e_me]

Been writing about how Beacon Object Files actually work under the hood.

Built a privilege enumeration BOF from scratch in C, just COFF parsing and dynamic API resolution. No wrappers, no frameworks.

Full writeup soon on https://t.co/M5eSrR6mK8

[Panos Gkatziroulis 🦄 @ipurple]

DLL Sideloading for Initial Access and Bypassing Elastic EDR https://t.co/RAGEErDyCl

[byteMe @0xby7e_me]

@ksg93rd Thank you for sharing the post, really appreciate it 🙏

[byteMe @0xby7e_me]

The cybersecurity rabbit hole is real.

You start looking into one Windows API and suddenly it’s 2 AM and you’re reading implementation details you never planned to investigate.

[mRr3b00t @UK_Daniel_Card]

Passkeys protect against online auth attacks

they don't protect against running malware on your device.....

I don't understand why people think an auth control stops malware.......

I need another tea....

[Chance Miller @ChanceHMiller]

Zuckerberg having to use X to thank Ternus because Apple doesn't use Threads is fascinating.

[byteMe @0xby7e_me]

@ipurple Thank you! Really appreciate the kind words and the support. No worries at all, glad you found it!