Dominic Chell 👻

Just your friendly neighbourhood red teamer @MDSecLabs @nighthawk_c2 | Creator of /r/redteamsec | |

[Dominic Chell 👻 @domchell]

@MDSecLabs will be running our Red Team Capability Training out in #BlackHatUSA26 again this year. This year the course features a big refresh, with a bunch of new additions on the latest evolving techniques!

Early bird discounts end this month! @BlackHatEvents
https://t.co/l3uAga4TS5

[Dominic Chell 👻 @domchell]

@4Dgifts @dcuthbert Maxx was mythos before mythos 😆

[Dominic Chell 👻 @domchell]

With the AI companies hiring all these amazing VR folks and giving them capabilities that 10xs their talent, it’s really no surprise we’re starting to see a vulnpocalypse.

I’d personally like to see them hire more of the world’s best cancer or Alzheimer’s researchers.

[Dominic Chell 👻 @domchell]

🤔

[Dominic Chell 👻 @domchell]

My hot take on this PHP mess is that its incredibly overhyped and we'll see very little ITW exploitation. Overall it seems less impactful than its named bug predecessors; heartbleed, shellshock, log4shell etc

[Dominic Chell 👻 @domchell]

@4Dgifts @mattjay https://t.co/xKVN7fGW8e

[Dominic Chell 👻 @domchell]

@4Dgifts @mattjay It reads like a “we better publish anything about php” to sound relevant post - there’s not even any iocs

[Dominic Chell 👻 @domchell]

@dcolascione Indeed - though we have seen vulns capable of true mass and wormable exploitation before; ssh crc32, sadmind, slammer, wannacry etc. People forget easily, and we're all still here.

[Dominic Chell 👻 @domchell]

@lcfr_hax Taking nothing away - still very cool bugs, kudos. Just yet to see the world end 😉

[Dave Aitel @daveaitel]

https://t.co/HP6GBZZFny let me know if you are interested!

[Andrew Thompson @ImposeCost]

"The previous update (October 22 16:18 UTC) reported that Sophos observed successful exploitation of PHP2Shell in customer environments. Upon further analysis, we are correcting that assessment as Sophos customer telemetry shows scanning and a small number of failed exploitation attempts. As of this update, there is no evidence of a successful compromise due to these vulnerabilities." https://t.co/BC5caSSSiR

[The Hacker News @TheHackersNews]

🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.

CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.

Read - https://t.co/frrfCwYlgp

[Dominic Chell 👻 @domchell]

@HackingLZ

[Elastic Security Labs @elasticseclabs]

Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

You can still focus on detection coverage today.

Security Labs writeup (coverage + guidance): https://t.co/aBB6g7gCZ5

Most PHP RCEs converge on the same outcome, whatever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.

• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root

The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.

We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.

The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.

(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)

Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.

Guidance + every rule link below.

[Juliano Rizzo @julianor]

While everyone’s patching PHP today, don't sleep on Node.js CVE-2026-111497 OOB write in the bundled Brotli decoder. Reachable via fetch(): a malicious server just replies
Content-Encoding: br.
Fixed in 26.12.1 / 24.22.1 / 22.23.4.
Update.

[Calif @calif_io]

php2shell - A tale of two PHP remote vulnerabilities:

https://t.co/KEUVez9Zdl

[Ollie Whitehouse @ollieatnowhere]

At the @NCSC we are asking all UK organisations and their supply chains across product and services to understand their use of PHP and prepare to patch...

https://t.co/UPT31kqBL6

[Offensive AI Con @OffensiveAIcon]

Your EDR Has Boundary Issues.

@harmj0y and @tifkin_ of @SpecterOps explore how adversarial machine learning can evade EDR detection- and how LLMs are accelerating the reverse engineering behind it.

Watch their Offensive AI Con talk below. 👇
https://t.co/cwnirhS595

#OAIC #OffensiveAI #Cybersecurity #EDR

[mdowd @mdowd]

Videos of https://t.co/lI3BwZk9zy talks are up!

[Cyber_OSINT @Cyber_O51NT]

Google's GTIG and Mandiant reported UNC7017 conducted ephemeral, five-to-ten minute software update tampering against AOMEI, delivering CROSSROAD and SHINYROAD via evolving infrastructure to stage backdoors and C2 operations. https://t.co/zDza9TlNzV