CryptoCat

Security Researcher @rapid7 😈
Hacking Content @ 💜

[CryptoCat @_CryptoCat]

Want to become an ethical hacker? 🥷 Here's a list of my favourite [mostly practical] resources 📚

They are all free (or have a free option) and there's more high quality material here than anybody realistically has the time to complete ⏳

[LiveOverflow 🔴 hextree.io @LiveOverflow]

Made a quick video (aka 5h of work), about my experience racing to find php2shell.

https://t.co/4mswR4daZH

[Anthropic @AnthropicAI]

In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.

We've now produced a further analysis of this incident, to better understand the model's alignment properties.

https://t.co/SlPQQ5xMMc

[hacker.house @hackerfantastic]

She's a 4, but she's a private key for a intermediary CA.

[CryptoCat @_CryptoCat]

In the middle of working on some @metasploit modules and @github banned my work account 🫠

[CryptoCat @_CryptoCat]

@OpenAI No refunds though, apparently 🤷‍♂️

[CryptoCat @_CryptoCat]

Daybreak Blue just stopped working at the same time as all the other models stopped answering *anything* hacking related. When I go to @OpenAI cyber page it says my account is not eligible for individual access and to contact my org (old uni). Support are refusing any refund 💀

[CryptoCat @_CryptoCat]

@OpenAI I'm seeing some other people post about Daybreak issues (maybe due to PHP RCE) so hoping my account error is just coincidence! 🤞

[Jorian @J0R1AN]

Everybody talking about php2shell, but wait 'till you hear about shell2php:

[Metasploit Project @metasploit]

Episode 17 of Hacktics & Telemetry is live: Zimbra Zero-Days, AI Torture, and Catching Malmons (ft. @LambdaMamba)! Get it here: https://t.co/JWoqkmphaI

[CryptoCat @_CryptoCat]

Found a CSRF in User Registration & Membership that lets an attacker approve or deny users through a logged-in admin. $17 🤑

https://t.co/fvJzOygTk1

[PinkDraconian @PinkDraconian]

How @joaxcar must feel after discovering a CVSS 10.0 bug in Gitlab but it's overshadowed because PHP decides to drop a 14 yo RCE

[Traceix @usetraceix]

We’re shutting down too.

We don’t use php I just don’t wanna work tomorrow.

[SinSinology @SinSinology]

To teach a lesson,

After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought https://t.co/hQYMb3AZlk before wiz could pull the same stunt again.

A big budget can buy a domain. It shouldn't buy someone else's research credit.

If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.

Hack the planet. Credit the researchers.

[Calif @calif_io]

Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: https://t.co/I88EQFrUHa

His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.

[Calif @calif_io]

php2shell - A tale of two PHP remote vulnerabilities:

https://t.co/KEUVez9Zdl

[Kirill Firsov @k_firsov]

php2shell

Tomorrow is a helluva day.

[CryptoCat @_CryptoCat]

Last Frappe post: GET CSRF in the bulk update endpoint, chained to RCE against a Website Manager.

https://t.co/kgUsyN9amR

[Stephen Fewer @stephenfewer]

Three new @metasploit exploit modules in the queue for several of the recent Cisco Secure Email Gateway vulns. Last weeks file write in AMP (CVE-2026-76519, on KEV), and two separate SQLi's (CVE-2026-76461, on KEV, and CVE-2026-76443) from last month: https://t.co/RxKsH1kRXE

[CryptoCat @_CryptoCat]

Part 3/4 pwning Frappe / ERPNext: unpublishing a Frappe Web Form leaves its submission RPC live. A guest who knows the form name creates the backing document, permissions ignored 😬

https://t.co/8nVV70vxgN

[CryptoCat @_CryptoCat]

@UK_Daniel_Card apparently is some promo 😤