Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏

🥄 I'm the cult of personality • #1 Spoon on #tweetfleet • Play too much #eveonline • Twitch Lurker • INFP-T

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

Not many games keep me obsessed for *checks notes* 17 years (on and off) #eveonline @EveOnline https://t.co/72uOCMjyOC

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

4

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

Can we get a Jötunn extended cut of NERDS #22? @EveOnline @FenrisCreations #eveonline #FCpls #tweetfleet

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

I am very Cybersecurity Aware this month. #SysAdmin

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

@Cultaholic

[Tib3rius @0xTib3rius]

Be me.

Have old server running a PHP app.

Try to upgrade to patch PHP bug.

Server still running Ubuntu 16.04 LTS.

oops.jpg

Upgrade to at least 22.04 LTS for now.

Takes hours.

PHP upgraded along the way. Good.

Try to restart server.

Won't start.

Config still using references to PHP FPM 7.0.

Update config.

Server starts.

Woo!

Try app.

App not working.

App also outdated, using old version that doesn't support PHP 8.

cry.gif

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

@wizzouk "Oh PHP is in the news-- oh"

[Tib3rius @0xTib3rius]

Happy PHP Compromise Day everyone!

[Florian Roth ⚡️ @cyb3rops]

My concern with the upcoming PHP RCE disclosure is how many systems could remain exposed long after patches become available.

Roughly a third of PHP websites still run PHP 5 or 7. Some operators will need to migrate old applications before they can move to a supported release. Even on supported versions, plenty of systems won't be patched immediately. Some owners won't notice the advisory; others can't deploy an update that quickly.

We still need the technical details to understand the actual exposure. If reliable, unauthenticated exploitation works across common deployments, I'd expect automated mass exploitation very quickly. AI-assisted exploit development and payload adaptation could shorten the response window further.

For detection teams, I'd prepare now for the activity that follows. I expect plenty of familiar shells, downloaders, webshells and persistence mechanisms, even though the entry point is new.

I've published a process-watcher guide with PHP configurations to record descendant processes and their command lines, with optional termination rules for shells, interpreters and known payload patterns:

https://t.co/7nluFV3Q25

Short-lived commands can still be recorded, even when they finish before the kill response arrives. Activity entirely inside the PHP worker remains a blind spot.

THOR Lite already includes relevant detections. We'll also review internally what additional post-exploitation coverage we can make publicly available.

After patching, check for compromise. An update doesn't remove an existing webshell or invalidate stolen credentials.

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

Chronic illness recovery and bad mental health combo took me out for 12 hours. Twelve hours to "recover" enough energy to be somewhat human sucks. Someone reboot my nerve system please.

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

@LisaForteUK Might still be cheaper than a direct train from Bristol to London

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

@RainbowZilla87 It's too much! It's autumnal spooky time!

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

@endingwithali Ali Diamond - International Woman of mystery 💅

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

@LuetteDie My professional guess, DNS.

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

@endingwithali @Nan_dre_

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

@JenMsft Now I have a certain Electric Six song in my head on loop

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

@techspence Protected users tripped me up recently doing some decommissioning of a on prem Citrix environment. Still learning even when ripping it down.

[spencer @techspence]

This is the fastest way I’ve found to fix an IT problem. have the user try to reproduce it while you’re watching.

60% of the time, it fixes itself every time.

[Aleksandar Djokic (Александар Джокич) @polidemitolog]

Sure, this app hates me, but where else can you see a Ukrainian drone manufacturer trolling Russian internet executives after blowing up their data centers?

[Backbone666 (M̴̵͝í̸͟͜͞c̵ḩ́ą̸̛͜e̶̡͝l͘͜͟͢ )🥄 𝕏 @Backbone666]

@that_toxic @EveOnline BF3 was so good