Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć

Follows you

Life is like spaghetti
It's hard until you make it
No stresso, no stresso
It's gonna be espresso

[Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć @cujanovic]

Blind XXE in python3-saml by me :) CVE-2017-9672 https://t.co/pEb5rn0zPN

[j🫪e @0x_Osprey]

Goodnight

(tomorrow will be worse)

[Tony Ma @t1o6n3y]

Imagine running PHP and Go on the backend, Node.js on the frontend, NGINX as the reverse proxy, Linux as the server, an HTTPS certificate from eMudhra

And also deploying everything via GitLab

☕️

[Choblin @choblin29]

HOLY SHIT: This is huge. Amazon found a PHP2Shell exploit attempt on OCT 17, FOUR DAYS before the AI-discovered vulnerabilities were publicly disclosed.

It hit an AWS honeypot from an anonymized IP. Amazon says it doesn't know how the actor learned about the still-embargoed flaws.

Then Cloudflare watched the explosion:

>10 hours BEFORE disclosure: thousands of attempts
>45 minutes AFTER: tens of thousands
>2 hours AFTER: hundreds of thousands
>Later: MILLIONS

Researchers had spent two months coordinating fixes. Governments took websites offline.

And Censys found ~1.5 MILLION of 2.6 million identified PHP hosts running versions with NO PATCH available for those versions.

[ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ 🛡️ @DanielMiessler]

How bad is this Gitlab issue? About as bad as it gets.

Anyone on the internet can take over an exposed, self-hosted GitLab server without logging in, on any version from the last 12 years.

Shodan is showing ~60K exposed servers online, which is a lot, but there are are far more internally for anyone with a foothold already.

[Tony Ma @t1o6n3y]

🚨 Security vulnerabilities reported in a SINGLE day:

PHP — 2 CVEs
Node.js — 10 CVEs
NGINX — 5 CVEs
Go — 1 CVE
GitLab — 12 CVEs
eMudhra — CA certificate compromise

[Andrew Dorman @acd421]

Teamwork makes the dream work.

The team and I
@J4ck3LSyN @Archknight23

🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow.

The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.

📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up.

PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act.

Here's the part the big threat-intel shops aren't shouting about:

No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling:

🔹 Present since PHP 5.4
🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live)
🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config

That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands.

✅ What to do right now:

1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade.

2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess:

session.upload_progress.enabled = Off

Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths.

3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.

4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today.

Why I'm posting this for free:

A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response.

I'll follow up once the official advisory publishes and confirm whether my root cause read was right.

Stay patched. 🔒

#PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec

[Sid Jain @sidj_in]

the nsa's "mystery" seed behind P-256 was just a 1997 clock time

the part people are missing: a timestamp only gives ~30 bits of wiggle room

the backdoor theory needed ~70

best case outcome. the most trusted curve on the internet stays trusted

[Pasha Sviderski @psviderski]

Found something funny when reading Tailscale code.

They use a Cyrillic letter "ж" (reads as "zh") for the variable which shouldn't be exposed to callers and mutated. This is an artificial barrier for human devs that should raise concerns when trying to type it.

Apparently it looks like an asterisk meaning it's a pointer. But for me it's a familiar letter which I didn't expect to see in the code and was like Ж? WAT?
Yeah, you can use unicode letters in Go code if you want.

I now really want to use something like that in my code because I bet it'll make me smile every time I see it

[Calif @calif_io]

Demos we presented at Hexacon in Paris today. Everything will be released in due time.

1/ Signal 1-click

[BridgeMind @bridgemindai]

Did Anthropic nerf Claude Opus 5.5?

The first NerfBench results are live.

We retested Opus 5.5 and GPT 6 Astra against their own launch scores.

Claude Opus 5.5: 99.2% (-0.8% vs launch)
GPT 6 Astra: 102.8% (+2.8% vs launch)

Verdict: No nerf detected.

Opus 5.5's small dip and GPT 6's small increase is within normal variance.

More models and more frequent retests are coming.

NerfBench only gets better as we collect more data.

Which models should we retest next?

[!Manan @0xManan]

PoC dropped. WordPress Core unauth LFI → RCE is not theoretical anymore.

CVE-2026-87902 : get_page_template() urldecode()'s a double-encoded pagename and locate_template() includes it with zero theme-root jail.

Chain: unauth POST (page_id + pagename) → path traversal include → pearcmd.php config-create → /tmp PHP drop → second include → www-data shell

https://t.co/FYznul9aov

https://t.co/CaG3UCpqPG

tip: if you're still on 4.7→7.1.1 with a page-templates/ theme, treat internet-facing WP as RCE until you prove the PEAR path is dead.

[Madeline Lawrence @madelinelawren]

insane new research from my colleague, Joe

tl;dr @gitlab gives you a private email address to create issues. If leaked, anyone who has it can push code, execute CI/CD jobs, and bypass IP restrictions across all of your public and private projects. 🙃

[sy.br1d @rafabd1_]

I'd like to announce a new vulnerability chain we found that starts with an SVG parser bug. It affects multiple products and can lead to RCE.

I created https://t.co/3Tk4B6amtx to share more about the chain, which I'm calling "VectorFreed" for now.

I started looking into this early this month and have since confirmed command execution in several products that process SVGs. The root issue is CVE-2026-96889, with fixes in librsvg 2.63.2 and the 2.62.4 backport.

The repo has an early overview and references for now. I'll share the technical write-up in the coming weeks.

[James Tucker @raggi]

CONTAINERS WERE NEVER A SECURITY BOUNDARY

how many times do we have to tell you this?

[Colin O'Brien @InsanityBit]

They never were.

The interesting bit now is that escapes for hardened systems like gvisor and firecracker have gone from "so expensive we don't know" to "10x less expensive but we still don't know" and that's scarier.

[Joel Eriksson @OwariDa]

Containers are a useful primitive, but very limited in terms of an actual security boundary

Back in 2007 when me and my team presented at BlackHat and DefCon about our kernel exploitation research and demonstrated various 0-days and N-days for different operating systems it was cutting edge

In 2026, when AI agents are able to automate a large part of the process, kernel exploitation is becoming pretty mainstream

Physical separation (dedicated systems for each workload) is always best, but at the very least use virtualization and avoid exposing the attack surface from your host kernel to anything you want to isolate

[Jay Rogers 👨‍💻 @jaydrogers]

All WordPress users need to update their WordPress installations immediately 💯

There is a 9.2 CVE that discloses a remote code execution vulnerability that affects versions all the way back to 2016 😬

Here's the official notice https://t.co/tbJlzC780L

[pilvar (Philippe Dourassov) @pilvar222]

GLM-5.3-level cybersecurity model running locally

This is a BIG unlock for many enterprises

So proud of my team for this release!

[prinz @deredleritt3r]

GPT-6 Astra has cracked *another* German WWI radio message encrypted with ADFGVX.

This message, "RICHI-240", has a single known key, but, to my knowledge, was never cracked by humans before. My guess is that humans never solved this message because it has 20 characters *missing* for reasons unknown: the "240" in "RICHI-240" signifies that there should be 240 characters in the message, whereas in fact there are only 220.

For purposes of cracking this cipher, the big problem is that it's not clear *where* these characters are missing from, because the order of the characters in the message is scrambled using the key. Thus, inserting the characters into the message in even slightly the wrong place leads to utterly nonsensical results.

All this was no problem for GPT-6 Astra, which tried the key with various combinations of hypothetical places from which the characters could have been missing and scored the resulting blocks of text using patterns common in the German language. Relatively early on in the process, this approach rendered coherent German text! Inserting the 20 missing characters as a string between the 4th and 5th lines of text in the message worked!

The message reads:

AN O H L
11 ARMEE
ALPENKORPS RAUM PETERREVE VERBASZ
21? 21? ? RDD LINIE NAGYBESSKEREK VERSECZ
VERSECZ VON SERBEN BESETZT

The three question marks you see are numerical digits, which cannot be restored by decryping (all we know is that they are three different digits from the following set: 5, 6, 7, 8, 9). And so, Astra was forced to check its results against historical WWI records. This search unearthed a French intelligence telegram, which described the situation in the area on November 11, 1918 and identified the German 217 - 219th infantry division and 6th Reserve Division in the area.

Plugging in this missing information, we get the final result:

AN O H L
11 ARMEE
ALPENKORPS RAUM PETERREVE VERBASZ
217 219 6RDD LINIE NAGYBESSKEREK VERSECZ
VERSECZ VON SERBEN BESETZT

Or, in English:

TO SUPREME ARMY COMMAND
11TH ARMY:
ALPINE CORPS IN THE PETERREVE-VERBASZ AREA.
217TH - 219TH DIVISIONS, AND 6TH RESERVE DIVISION ON THE NAGYBECSKEREK-VERSEC LINE.
VERSEC OCCUPIED BY SERBS.

Astra checked the official history of the Serbian city of Vršac (Versec in Hungarian, and Werschetz in German) and found that, on November 10, 1918, German troops left the city and it was occupied by Serbian forces. RICHI-240 was sent at 3:38am on the following day to the German Supreme Army Command, informing them of this fact.

[Oren Yomtov @orenyomtov]

We escaped Docker's hypervisor with three lines of bash. CVE-2026-77179: A container gets complete read and write access to the host filesystem.

When you mount a folder into a container, Docker's VMM uses virtio-fs, and the file server runs on the host.

Because of a TOCTOU bug, if a container opens a file, deletes it while holding its file handle open, and replaces the parent folder with a symlink, the kernel will follow the symlink to anywhere on the host.

Full technical breakdown:
https://t.co/jwsc5aozru