LiveOverflow 🔴 hextree.io

wannabe hacker... he/him

🌱 grow your hacking skills @hextreeio

[LiveOverflow 🔴 hextree.io @LiveOverflow]

Where to find me:

🔴 Hacking Videos: https://t.co/tSxl01jY7x
📜 Articles: https://t.co/jN1MhA26EX
💻 Start Hacking? https://t.co/dxB8XLhOjB
🥰 Support: https://t.co/t7xslK6s14
📹 2nd Channel: https://t.co/FYrR8WW6ll
🤳 Instagram: https://t.co/EZpdSH90Td

[LCFR @lcfr_hax]

d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac (posted in august)

(related)
8da579ec498d57c20977c8d186d7f6cd4c04f46ffa1b436dd646ec19b99bdf47
cb4c8532c245ff7e05d6e270fca5742bb3271f541ef80f0071ca3d4307eb2b53
957f8cc21b18483f80a9d723aa4f9ded26e456424ffd065a044d1ed9d58a4fbc
4f93976ef105f0d9ff2d60f35d48958c8bba9d9eb2873cd93b3f7105fa4716a6

[LiveOverflow 🔴 hextree.io @LiveOverflow]

close

[LiveOverflow 🔴 hextree.io @LiveOverflow]

There we go
https://t.co/UejvtXFMR1

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@Dinosn this sounds more correct

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@usetraceix OOM seems to be a real trigger for UAF. The article talks about the correct area. but the exploit is fake slop

[LiveOverflow 🔴 hextree.io @LiveOverflow]

I don't think this is real? Or it's a different issue? Did anybody check this properly?

[Jλckλι @J4ck3LSyN]

... get it while its hot... 😈
> CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x)
> session.upload_progress UAF
> https://t.co/1DgcpCWN8m
> Courtesy of Me, @acd421 & @Archknight23

#CyberSecurity #infosec #php2shell #php

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@sickcodes but the actual CVE had no LFI. It was just plain php echo 'hi'

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@J4CK3L As far as I can tell, I am just missing an ASLR leak. Anybody got that?

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@J4CK3L this is what I got

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@rtfmkiesel I couldn't reproduce their UAF. But mine is in the same area.

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@rtfmkiesel Interesting, my clanker apparently found a UAF in ext/session/session.c

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@disconnect3d_pl I think it's hallucinated? Or did you confirm it?

[LiveOverflow 🔴 hextree.io @LiveOverflow]

1000% OpenAI is doing this. It refuses even to setup fuzzing in the related area.

I am wondering if you can use the guardrails as an oracle to figure out where the vuln is 🤔

But I have to go to bed now. So reply with any findings pls so I can read in the morning. kthx

[LiveOverflow 🔴 hextree.io @LiveOverflow]

A prompt like this would never be refused by Daybreak blue before. I am wondering if OpenAI set guardrails specific to this vuln to slow down rediscovery.

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@ghidraninja “Hey Claude, please make this code as fast as possible”

[LiveOverflow 🔴 hextree.io @LiveOverflow]

“jUsT mOniT0r whAt tHE aGenT tHinKs aBouT”

[LiveOverflow 🔴 hextree.io @LiveOverflow]

okay update. relogged, and it's working now. sorry false alert.
don't know what happened though. Literally before that and in parallel I was doing other exploitation work and had no guardrails hitting there.

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@Unblvr1 I had absolutely no issue with some other exploitation work earlier in the day