Sektor

it takes a little bit of insanity to succeed

[Sektor @Debug_sec]

Thank you @ngwhitehat 🫡

[Sektor @Debug_sec]

@pe__acep1 @BestofDem_szn 🤔🤔

[Marvel Entertainment @Marvel]

F.R.I.D.A.Y. has seen it all.

[Sektor @Debug_sec]

@Thezinnekalu Congratulations

[🍫 H A L E E M A H 🦋❤️ 🇵🇹 @Lymarh__]

One of the coolest war movies 🔥

[Ebenezer Agbey Quist @Eqayinspire]

This is what emotional maturity as a man means.

VC: Darwynnmcpherson/FB

----

#RedWednesday Frank Annoh-Dompreh Maguire Villagio Doechii Cunha Chairman

[𝐤𝐣𝐮𝐥𝐢𝐮𝐬 @ethical_h4ck3r_]

Admin Panel Access Steps. 🔥

1- Visit login panel
2- Enter username: admin and random password
3- click login & capture in burp
4- Do intercept
5- Update {"status":"0"} to
{"status":"1","user_type":"admin"}
6- Admin console 🔓

@krishnsec
#bugbountytips #bugbountytip #bugbounty

[Marcus Hutchins @MalwareTechBlog]

I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain:

Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:

a) a world-class exploit developer with an extreme case of imposter syndrome.

b) currently looking at some very confident-sounding but wrong LLM output.

I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works.

I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself).

The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off".

People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media.

So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector.

What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't).

The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations.

LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.

[Sektor @Debug_sec]

@DsokeyyV nice tips nad good observation

[TryHackMe @tryhackme]

🚨 Yesterday, PHP2Shell made headlines. Today, we're already teaching you how to exploit it. Yeah, we're THAT fast⚡ Two critical PHP vulnerabilities. 9.2 CVSS. Unauthenticated RCE.
And you can already exploit the chain, bypass ASLR, and pop a shell in our latest recent threat room.
Hackers don't wait. Neither do we 🟢 Go Get hands-on: https://t.co/76TcpTLxpr

[Sektor @Debug_sec]

@Itx_Shad0w you really worked so hard to become that good with bugbounty

[Sektor @Debug_sec]

@ibrahimatix0x01 for Real

[Sektor @Debug_sec]

Lolz
so git was next...hmmm

[Nyx @fopgirl67]

@kimmydotzip

[Sektor @Debug_sec]

@HacktronAI let the world burn

[Sektor @Debug_sec]

@commando_skiipz some companies are still behind

[Sektor @Debug_sec]

@davidherrero91 Yes I do

[Sektor @Debug_sec]

i just built a python that can help anyone test on domains to see if there are vulnerable to this php vuln and so far, i got one target vulnerable to it, i just had to test for just few domains, all for educational purposes.

[Sektor @Debug_sec]

@legacies_1337 Mimo

[Sektor @Debug_sec]

@MpFlippy @rina4_tot mine did

[Sektor @Debug_sec]

@trunipe4rc Okay

[Sektor @Debug_sec]

i think for now, if you can hide your php version, you might be safe, till the fix comes out, i don't know, i'm just guessing.