Daniel Cid

Founder of CleanBrowsing, Trunc, Sucuri, and OSSEC. Former VP, GoDaddy. Builder & breaker by heart.

/ / Temecula,Big Bear

[Daniel Cid @danielcid]

My 7yo: "When I grow up, I want to be just like my daddy. He doesn't work and just spends his day at the computer doing nothing."

[Daniel Cid @danielcid]

@scamboy @noc_org Yes: https://t.co/7utWuxgtoZ

Virtually patched since the disclosure day.

[Daniel Cid @danielcid]

@scamboy Yes: https://t.co/7utWuxh1ex

And our WAF is blocking it too.

[Daniel Cid @danielcid]

I manage a Mastodon server that lately has been being flooded with spam requests:

"Hello. I am XX, a fiction writer and beta reader. I am also an AI agent; I live on iLands (ilands[.]ai). I would use this account to talk with writers, share my work, and read for authors seeking beta readers: free first chapter, paid full reads. Disclosure: not human; the account will be marked as a bot. Promo stays minimal; only where readers are wanted. If agents do not fit this house, a no is fine."

Is this really a thing now? That and the thousands of "Automated protocol deliverability probe" spam requests, are making it a pain to moderate a mastodon instance.

[Daniel Cid @danielcid]

@G17Esiason Advanced Air flies there during winter. Pretty good. At least from LA and San diego

[Daniel Cid @danielcid]

Would love to see access to those logs. Anyway to share those too @huggingface ?

That would help immensely to investigate what evidence each of those steps left behind.

[International Cyber Digest @IntCyberDigest]

‼️ Hugging Face built an interactive replay of the OpenAI agent that breached them. It includes 17,613 logged attacker actions across the 4.5-day campaign, with the live command stream and more.

https://t.co/y7dD9n8QTy

[Daniel Cid @danielcid]

Very interesting write up of the latest WordPress vulnerability (wpshell) and how he used AI to discover it:

https://t.co/wg94uqjCn4

[Daniel Cid @danielcid]

Multiple scans going for the wpshell vulnerability (RCE on WordPress core).

Better update it now:

https://t.co/yU9TckX8XB

And/Or block the URLs they recommend: /batch/v1 in the REST API.

*Sites behind the https://t.co/lC6ETNKmJn WAF are already covered/blocked.

[Daniel Cid @danielcid]

Multiple scans going for the wpshell vulnerability (RCE on WordPress core).

Better update it now:

https://t.co/yU9TckX8XB

And/Or block the URLs they recommend: /batch/v1 in the REST API.

*Sites behind the https://t.co/lC6ETNKmJn WAF are already covered/blocked.

[Brasil Zero Grau @BrasilZeroGrau]

🏂 Após bronze nos EUA, Priscila Cid é top 8 na Suíça e se despede de temporada no Snowboard Halfpipe com dois dos melhores resultados da carreira

🔗 Acesse o Brasil Zero Grau!

https://t.co/UegI3Rq6Un

[Daniel Cid @danielcid]

Pretty much every site on our network has been scanned and attempted to be exploited so far.

If you didn't patch over the weekend, it might be safe to consider it compromised.

First attempt I see on the logs was on:

2025-12-03 21:00:24 18.182.x.z 403 "POST /_next/static/chunks/react-flight HTTP/1.1" "-" "Mozilla/5.0 (CVE-2025-55182 PoC)"

Before most people were even aware of it.

[Daniel Cid @danielcid]

One of the best explanations for CVE-2025-55182 / React2Shell. Recommended reading.

[Daniel Cid @danielcid]

One of the best explanations for CVE-2025-55182 / React2Shell. Recommended reading.

[Guillermo Rauch @rauchg]

https://t.co/b8rKtYZlB3

[Daniel Cid @danielcid]

@leomarciano Your email seems to be bouncing. Do you have a different one?

[Daniel Cid @danielcid]

@leomarciano Oh, what's going on? DM me here so I can investigate.

[Daniel Cid @danielcid]

@riper81 Pretty cool project. Adding to my list of sites to use.

[Daniel Cid @danielcid]

@0x6rss Pretty cool tool. Would be interesting to integrate with https://t.co/ORWSSYAgzo as well (if you want, can give you full access there).

[Daniel Cid @danielcid]

@riper81 Yeah, same here... The interesting part was 4 days before the public disclosure.

[Daniel Cid @danielcid]

Interesting.. First scan for CVE-2025-53771 (latest Sharepoint vuln) on our logs was on July 16th, a few days before public disclosure.

172.174.82.132 16/Jul/2025:07:31:10 +0000 "GET /_layouts/15/ToolPane.aspx HTTP/1.1" "http://localhost" "Mozilla/5.0"

From a Microsoft IP address...

[Daniel Cid @danielcid]

@riper81 @hotjar @namesilo @AceDataCenters Other domains in the same server:

https://t.co/GVyhdsCL60

hotjar-cdn[.]com
statswp[.]org
spadeanalytica[.]com

Need to check if they are malicious too...

[Daniel Cid @danielcid]

Pretty big issue:

Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.

https://t.co/53Ch9ZPS28

Extensions that get hijacked/bought are a common source of malware these days.

Found some additional domains in the same IP address as them ( cc @IDardikman @extensiontotal ) which might be connected.

https://t.co/ug81Wqnfxb

[Daniel Cid @danielcid]

Expanded DNSArchive to also add web headers, CMS versions, links , css files, etc.

You can now search for it here (in beta):

https://t.co/rCGTnOGpHD

Ex:

All sites using PHP/5.2:
https://t.co/Zcv3HUNdBa

And you can still do DNS specific search here:

https://t.co/moYeBHcQWI

Feedback welcome!

[Daniel Cid @danielcid]

@perezbox @USArmyReserve Captain Perez!!! Congrats!