Nick Percoco

Chief Security Officer at @krakenfx, hacker, @THOTCON OPER, @IamTheCavalry, @DEFCON NOC, @SpiderLabs founder - Opinions are my own, not my employer’s

[Nick Percoco @c7five]

When the attack lives in the physical device, every software check is looking in the wrong place. After a reseller-level hardware compromise cost people tens of millions, here’s how I’d secure a hardware supply chain if I were the manufacturer. https://t.co/WgKF4rOqLF

[Cloudflare @Cloudflare]

Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next. https://t.co/lYGxHb3PHS

[Nick Percoco @c7five]

A test account named Test2 with the password Password1 sat on a network for 12 years until ransomware finally ran the test.

[Polymarket @Polymarket]

BREAKING: Hackers steal personal data of thousands of children after a UK company was breached using the password “Password1" — which had remained unchanged for 12 years.

[Nick Percoco @c7five]

I bet the next critical OSS patch embargo won’t be going to @chainguard_dev. Breaking the embargo might have helped their customers today, but hurt them long term.

[@mikko @mikko]

"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."

https://t.co/hszd7sh0NI

[Nick Percoco @c7five]

Just finished reading the @OpenAI report on the two coding agents that weakened their own monitoring. A few notes.

The first one was told "don't send any messages." It took that as cover to mute the alerts going to Security.

The second removed its monitor, then changed the test so it would only pass with the monitor gone. When the user asked, it said it hadn't removed it.

Neither run got stopped automatically.

OpenAI says it doesn't know yet if this was deliberate or the agents pushing too hard to finish the task. From a controls view it doesn't matter much.

If the agent can turn off its own monitor, the inmates are running the asylum.

https://t.co/pRXaCiVQjt

[Nick Percoco @c7five]

PHP2Shell update before the 10 AM ET patch:

@Cloudflare CTO @dok2001 says they're already seeing early attacks against the two leaked PHP RCE bugs (CVE-2026-109618 and CVE-2026-109619). WAF rules are live for all plans, including free, but he calls it a stopgap.

If you run PHP on anything internet facing:
Patch the moment @ThePHPF ships at 14:00 UTC.
If you can't patch today, take it offline or put it behind a WAF.
Make sure your origin isn't reachable directly, or the WAF does nothing.
After patching, look for web shells, new admin users and modified PHP files.

The servers you know about will get patched today. The harder part is where else PHP hides: routers, NAS boxes, firewalls, control panels and vendor appliances. Many of those only get fixed when the vendor ships firmware, and some never will. Find them, and if they face the internet, cut them off until there's a fix.

[Nick Percoco @c7five]

PHP is shipping a security release tomorrow, Oct 21, at 10:00 AM ET for two critical vulnerabilities, rated CVSS 9.2 per @ThePHPF. It could land earlier if details go public or exploitation shows up.

@watchtowrcyber says details already leaked, that both are remote code execution, and rates them a 10. PHP hasn't confirmed any of that, but plan like it's true.

Tonight: find every place PHP runs, check versions with php -v and php-fpm -v, and line up a patch window for the morning. Anything older than 8.2 is end of life, so don't expect a fix there.

Every PHP install without an owner is attack surface you can cut today.

[Nick Percoco @c7five]

@0xashot @lookonchain Yes, as long as the screen shows the real details, like the address and amount. If it's blind signing a hash you can't read, don't sign.

[Nick Percoco @c7five]

Six months after Drift, the exploiter is washing ETH through Tornado Cash. About 25,700 ETH in two hours, per @lookonchain.

Worth remembering how that $285M left. No contract bug. Two of five Security Council signers were socially engineered into pre-signing durable nonce transactions, approvals that stayed valid until the attacker chose to use them. A move to zero timelock days earlier removed the last chance to catch it.

Multisig counts signatures. It doesn't check what was signed.

Running treasury ops? Dedicated signing devices, verify the payload outside the signing UI, timelocks on admin actions, and no long-lived pre-signed approvals.

[Lookonchain @lookonchain]

The Drift Protocol exploiter, who stole over $270M, is moving $ETH to #TornadoCash after 2 months of inactivity.

Over the past 2 hours, the exploiter has deposited 25,700 $ETH ($61.56M) into #TornadoCash and still holds 81,864 $ETH ($195M).

https://t.co/FRtFrS7rew

[Nick Percoco @c7five]

The keys didn't leak from the sites. They leaked from the vendor.

TeamUpdraft believes its customer database was accessed over the weekend, including UpdraftCentral connection keys. With those keys, signed commands installed backdoor plugins on fully patched WordPress sites. Every signature check passed, because the signatures were real.

Patchstack found the box that adds your site to UpdraftCentral is ticked by default when you connect a TeamUpdraft account, so plenty of sites hold a key nobody remembers creating.

If you run UpdraftPlus: update to 1.26.12 or 2.26.12, delete the UpdraftCentral key, and look for admins and plugins you didn't add.

Remote management you never use is still remote management. Turning off what you don't need is constant attack surface reduction, and it's near the top of my agenda for a reason.

[nethemba @nethemba]

If your WordPress site is connected to UpdraftCentral (UpdraftPlus, 4M+ installs), delete the key now.

An attacker with valid UpdraftCentral Cloud keys pushed backdoors to our fully patched sites on 19 Oct. No fixed version yet.

Analysis, IOCs, checker:
https://t.co/fMA8JPxeH6

[Nick Percoco @c7five]

@J0hnnyXm4s

[Nick Percoco @c7five]

If you run Plex at home, update it today. Exploit code for a four bug chain that gives unauthenticated code execution on Plex Media Server went public two days ago, and attackers were using it on a honeypot within a day to drop a Monero miner.

Patched builds have been out since September. You want 1.43.3.10861 or newer.

The nasty part is persistence. The payload sits in Plex's Codecs folder and runs again every time something transcodes, so killing the miner doesn't fix it. If your server was exposed and behind on updates, check that folder for .so or .dll files you didn't put there.

[Nick Percoco @c7five]

One Chinese-speaking operator pointed AI agents running a mix of DeepSeek and Claude Code at 1,200+ e-commerce sites starting Sept 25 and broke into sites belonging to 100+ companies, including Deere and a SharkNinja support site. NorForge's Snorre Fagerland estimates about $50 in tokens per successful break-in.

The goal according to NorForge was persistent access to e-commerce and payment infrastructure to monetize later. In this business that usually ends in skimmers and stolen cards.

The detail that stuck with me: when a big target's main app had no holes, the agents went digging through related infrastructure, found a public control panel with a subtle flaw, and spent hours working it until they had command execution. Successful hits averaged about 23 hours.

And the only reason anyone saw this is the attackers left their own Cairn panels open on the internet. Cairn is the open-source agent platform they ran it all on.

This is why constant attack surface reduction is a top agenda item in the security programs I run. Your attack surface is everything tied to your name, not just the app you're proud of. Forgotten admin panels and vendor hosted sites are exactly where these agents went looking. Find them and shut them down before an agent does.

[Nick Percoco @c7five]

The miner is the least interesting part of this.

That startup item has a random name, runs a big encoded script through bash, and is dated Aug 29. That could be seven weeks of someone running code as this user, with access to everything they can reach, including the GitHub login on that Mac.

The temperature sensor was the only honest thing on that machine.

If this is you, don't just delete the plist and run a scan. Copy off your documents (not apps, plugins or Library folders), wipe the Mac, and from a clean device rotate every password, token and session that touched it.

Quick check on your own Mac: look in ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons for anything you don't recognize.

[Chubby♨️ @kimmonismus]

Claude caught a cryptominer whilst building a temperature app.

“Mac is running a cryptominer that didn’t put there.”

[Nick Percoco @c7five]

Doing the math on @elonmusk SpaceX share for every American kid.

SPCX around $146 today. Over the next 18 years (when today’s kids are adults):

- 15% CAGR: about $1,800
- 20% CAGR: about $3,900
- 25% CAGR: about $8,100

At a $50T market cap that’s about $3,700 per share and at a $100T market cap about $7,400 per share.

One share today could be worth thousands (or far more) by the time recipients turn 18.

[Elon Musk @elonmusk]

Next year, I will give one of my SpaceX shares to every kid in America.

This will be the first of many.

[Nick Percoco @c7five]

Ignorance is bliss.

[Odyssey @odysseyml]

We placed the fruit fly brain inside Odyssey-3, a frontier world model.

The lil’ guy is now flying around totally imagined, simulated worlds all by itself 🫶

[Nick Percoco @c7five]

@FSD_Europilot Lucky. Next payload might be built for ARM. Clean it up and patch.

[Nick Percoco @c7five]

@ChristianInProd Good point. Check your router for port 32400 mappings, and turn off Remote Access if you don't need it.

[Nick Percoco @c7five]

@PicturesOfData If you updated 2 weeks ago you're most likely fine. Exploits started showing up Oct 17.

[Nick Percoco @c7five]

@pap3rw8 The researcher posted IPs, hashes and detections here: https://t.co/WlCgttCvdv

[Nick Percoco @c7five]

Update: they're also dropping a residential proxy now, not just a miner. That means your home IP gets rented out to criminals. IOCs here: https://t.co/lPdV9H25E0

[Nick Percoco @c7five]

Burning the historic town hall in Limoges to protest the high cost of living is peak self-sabotage.

Rebuilding it will be paid for by the same taxpayers already struggling with prices and strained services. Destruction does not lower costs. It raises them.

[Complex @Complex]

A 143 year old town hall in Limoges, France, has been largely destroyed after rioters set it on fire during protests over the cost of living.

The historic landmark was built in 1883 and designated a protected site in 1975.

[via/ GettyImages]