Samarth

Web3 security. Building audit tooling. Documenting live findings. Triage passes only — scan + manual review, not a full audit.

DMs open

[Samarth @Sam39741]

Taking 1–2 triage slots.

Automated scan plus my own manual read. Line citations. Prioritized leads only. Explicitly not a full audit, and not a completeness guarantee.

$150 for the first one so you can judge the output. After that, $300–500 by size.

DM the repo.

[Coin Bureau @coinbureau]

The internet is going into a LOCKDOWN.

Hundreds of millions of websites are potentially at risk from cyberattacks.

Governments, banks and major platforms have already taken their websites OFFLINE.

Many are already calling it “Black October.”

At the centre of the shutdowns is something most of us have never heard of, but use every day.

PHP, the software behind roughly 7 in 10 websites, has two critical flaws that can let hackers break in without a password.

Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity.

Details began circulating on Oct 20. Emergency fixes arrived the next day, but attackers were already moving.

Cloudflare’s CEO says hacking attempts then jumped from thousands to MILLIONS within hours.

Cybersecurity agencies across several countries are telling PHP site owners the same thing: Patch it now, or take it offline.

Websites have gone dark worldwide, from government portals and hospitals to banks.

CrowdStrike warns these attacks leave almost no trace, so some sites may not know if they’ve been hit.

Around 2.6 MILLION internet-facing servers run PHP, potentially hosting hundreds of sites each.

Over 1.1 million use older versions no longer receiving official PHP updates.

Older installations may need an upgrade to a supported PHP version or a fix from their software provider.

And patching does not remove a backdoor an attacker may already have planted.

Cloudflare also says hackers are now tweaking their attacks to try to slip past its protections.

But PHP isn’t the only security story unfolding.

-Japan’s Onamae suspended ALL Desktop Cloud plans after malware was found on customer servers.

-India’s eMudhra had 8 website-certificate keys so weak, one was literally the number “4”.

-State Bank of India confirmed 3,897 customer records on the dark web.

-Criminals used AI agents to break into 400+ Latin American banks.

-Capcom confirmed a breach exposing 11.7 million email addresses.

-GitLab disclosed a 10/10 severity flaw in versions going back to 2014.

-LiteLLM removed a malware-containing release. Railway reported possible exposure of customer secrets.

None of these has a confirmed link to PHP2Shell.

We’re seeing separate breaches unfold together.

The true number of incidents could take months to come out.

The world is still on alert. Attacks are still coming.

[Samarth @Sam39741]

@ShieldifySec @mdp_sec have been using this, great work for sure🔥

[Samarth @Sam39741]

The core issue is that the token treated any transfer into the pool as a sell and burned from the pool’s own NEM balance.

That turned a normal transfer-in + skim loop into a net drain on the LP. Each of the 42 cycles reduced the pool’s NEM reserves while the attacker recovered their tokens, steadily worsening the price. The large borrow was mainly to size the final sell into the already-manipulated reserves.

This is a recurring class of bug: custom burn/tax logic that keys off “sell” heuristics (balance deltas, router checks, etc.) without correctly modeling how AMMs move tokens. Once the pool itself becomes a burn target, skim becomes an extraction primitive.

Have you seen many cases where the burn is applied to the recipient rather than the sender, or is this mostly still “from” logic that gets misapplied when the pool is the recipient?

[Samarth @Sam39741]

Curious how this matches other people’s experience.

When you’ve moved between chains (or even between different EVM protocols), which parts of your process transferred cleanly and which ones kept breaking?

Any specific checks or mental models that survived the switch better than you expected?

[Samarth @Sam39741]

I’ve been auditing across EVM, Clarity, and NEAR recently.

One pattern keeps showing up: the parts of my process that stay almost identical across chains are usually more valuable than the chain-specific checks I have to rebuild.

[Samarth @Sam39741]

The highest-signal output on the last few reviews wasn’t the bug list.
It was a short defense catalog: which defenses were present and what attack appears when each one is missing. That catalog has been more reusable than the individual findings.

[Tim @tcmfld]

@phoronix

[sui @birdabo]

they’re calling it the black October lmao.

> node.js: security vulnerability.
> PHP: critical RCE vulnerabilities.
> tensorlake: npm package infected.
> liteLLM: malicious PyPI + Docker releases
> Railway: customer secrets exposed
> zeabur - infrastructure breached.
> OpenCode: AI API keys exposed.
> OVHcloud CLI: official binaries backdoored.
> RankMath PRO: malware inside official plugin.
> TeamUpdraft: customer data compromised.
> ConnectWise: cloud backup identities compromised.
> SubQuery: backdoored npm package.
> GhostAction: GitHub repos with malicious workflows (related to the broader Shai-Hulud/ChainDrop activity).
> eMudhra: certificate authority keys compromised (with downstream impact on Tailscale).

this some complete madness bro. 1/3 of the internet is fucked.

[Samarth @Sam39741]

As a whitehat, incidents like these are concerning because they involve foundational infrastructure we all rely on.

The technical fixes are straightforward — mandatory output validation, strict test/production separation, and continuous monitoring of high-value assets. Implementing them consistently would dramatically reduce these kinds of process failures.

What process improvements do you think would have the biggest impact on preventing similar incidents?

[Samarth @Sam39741]

The private key of a publicly trusted certificate authority intermediate was literally the number 4.

Not a number that starts with 4. Just 4.

eMudhra’s eight intermediate CA keys (P-384) were all single-byte integers. One was 4. They stayed recoverable for roughly 17 months until browsers blocked them within hours of disclosure.

This is a clear process failure in a high-stakes system.

[Samarth @Sam39741]

These are preventable process and validation gaps rather than sophisticated attacks:

- Missing post-generation checks on cryptographic material

- Inadequate monitoring for sensitive data exposure

- Reliance on external notification instead of internal detection controls

When high-trust systems (CAs and large banks) miss these basic layers, the blast radius and exposure window grow significantly.

[Samarth @Sam39741]

@KannAudits Applied 🫡🫡

[Samarth @Sam39741]

Hunting on immunefi now.

[cat3lyst @cat3lyst]

soon, we keep going for now.