RedPacket Security

security researcher
good guy hacker
AI tinkerer
OSCP certificate owner
ADHD Brain owner

[RedPacket Security @RedPacketSec]

Other places to get RedPacket Security updates:

Telegram:
https://t.co/oOCWE1Mmos

Discord:
https://t.co/B3swrGCXCS

Reddit:
https://t.co/bJLaIAwmwc

LinkedIn:
https://t.co/hwKmO7T0ON

Mastodon:
https://t.co/jDyczrNIft

[RedPacket Security @RedPacketSec]

@ChatGPT @rennsong Also can we allow more things than slack for dot. I really hate slacks message interface. Let us choose others.

[RedPacket Security @RedPacketSec]

@ChatGPT @rennsong Custom instructions for #dots to keep longer term persistent thinking.
And more proactive promoting to the user

[MalwareHunterTeam @malwrhunterteam]

🤷‍♂️

[RedPacket Security @RedPacketSec]

RT @Scott_Helme: "Sorry we didn't get back to you yet, we've been too busy on Twitter and trying to keep our investors happy"

Unbelievable…

[RedPacket Security @RedPacketSec]

@_Freakyclown_ 5

[Kiwi 🥝 🍉 @_0xKiwi]

After careful review from trusted advisors (read: my friends flamed the shit out of me) I've fixed the tier list kthxbye

[Dan Lorenc @lorenc_dan]

The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously.

I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months.

I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies.

When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack.

The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code.

Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off.

Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions.

A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs.

Here's what this run looked like.

We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.

[stypr @brokenpacifist]

mitmproxy: use `--emudhra` to sign TLS certificates 💀

[Izzatologist @IzzatStatus]

More private keys by the Indian certificate authority have been discovered. These are all small numbers.

People are suspecting that they interpreted 384 bit keys to mean that they should pick numbers from 1-384 to use as their private keys.

[Choblin @choblin29]

HOLY SHIT: This is huge. Amazon found a PHP2Shell exploit attempt on OCT 17, FOUR DAYS before the AI-discovered vulnerabilities were publicly disclosed.

It hit an AWS honeypot from an anonymized IP. Amazon says it doesn't know how the actor learned about the still-embargoed flaws.

Then Cloudflare watched the explosion:

>10 hours BEFORE disclosure: thousands of attempts
>45 minutes AFTER: tens of thousands
>2 hours AFTER: hundreds of thousands
>Later: MILLIONS

Researchers had spent two months coordinating fixes. Governments took websites offline.

And Censys found ~1.5 MILLION of 2.6 million identified PHP hosts running versions with NO PATCH available for those versions.

[Node.js @nodejs]

🔐 Node.js security updates are now available!

New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.

Review the details and update your systems to stay secure.

🔗 https://t.co/W4kfzx5lxz

#NodeJS #Security

[John Althouse @4A4133]

Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.

https://t.co/fopoKsPulV

[RedPacket Security @RedPacketSec]

Aaaaaaaaaand this is exactly why monthly patching cycles are dead.

[Matthew Prince 🌥 @eastdakota]

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

[きょうすけ @kyo_p]

php2shell の検証ついでに、パッチを追う中で session.upload_progress の filename 注入 + LFI を自分でPoC化してみた！
8.5.4 でも 8.5.12（パッチ版）でも www-data でコマンド実行までいけた
既知の手法で LFI 前提だけど、この経路はパッチ後も塞がってない
#php2shell #PHP #CVE2026109618

[Chuck Robbins @ChuckRobbins]

Great work by the @TalosSecurity team getting this out quickly! If anything in your business runs on PHP, this is critical info and requires every company to move quickly. The old habit of baking patches into the next general purpose release isn't going to survive the AI era.

[Insider Paper @TheInsiderPaper]

BREAKING: US spy agency urged organizations to take websites offline if they cannot immediately fix two serious security flaws in PHP, a programming language behind a large share of the world's websites

https://t.co/Mnq0LdHJlA

[gabsmashh @gabsmashh]

pulled this out of the archive because it feels relevant today

[Jeff Geerling @geerlingguy]

This might be the most watched GitHub Actions build in the history of the platform: https://t.co/JXEdjPGHxY