Justin Elze

CTO @TrustedSec | Former Optiv/SecureWorks/Accuvant Labs/Redspin | Race cars

[Justin Elze @HackingLZ]

@nickdothutton Back when 0day was exploits traded amongst random people and defenders had no idea about them...

[Ryan Barnett (B0N3) @ryancbarnett]

For WAF vendor who participate in coordinated disclosures through trust groups with embargoes, here is what I feel is the more important component in relation to releasing detection logic:

[Marcus Hutchins @MalwareTechBlog]

I want to caveat this since based on some comments, people are interpreting it in a way other than was intended. You 10000% need to update your PHP version. php2shell is no joke.

I am NOT saying people don't have functional exploits...they do. I'm saying that most of the public ones are AI hallucinations, and there's also some complexities which lower the risk of something apocalyptic, like a self-propagating worm that blasts through the entire internet (À la. EnternalBlue or Log4J).

The chances are if you used some click-to-deploy container, installed your web stack from a tutorial, or copy and pasted a command from somewhere, you're probably running the same exact config as a gazillion other people. There is no guarantee someone won't publicly release an exploit that affects you setup, or multiple major setups. There is no way for you to know ahead of time.

Additionally, if you're running mod_php, that appears to be the easiest target of all. php-fpm and other configs are not immune, I've seen working exploits for all. But mod_php is the easiest, so I'd recommend not only updating PHP, but planning to migrate to something newer, like PHP-FPM.

I would bet good money this is not the last of the critical PHP bugs we're going to see, and the next ones could be easier to exploit. In which case you get less time to update.

Updating your PHP version is the absoloute bare minimum you NEED to do. Harden your servers, install security monitoring/detection tools, and please, please, migrate off mod_php if you can, it's obsolete af.

[Nathan McNulty @NathanMcNulty]

In case anyone wants to see how these attacks work and test their detection/response, I did a webinar with @AlteredSecurity where I showed how to modify evilginx and automate passkey registration

Code is here:
https://t.co/gkFdRJzraq

Video (4m-8m):
https://t.co/Lj9XBLkaWb

[Justin Elze @HackingLZ]

Happy Friday

[Justin Elze @HackingLZ]

@0xTriboulet It's confusing because the recent bugs were found as part of programs with the frontier labs.

The argument earlier this year Mythos was so powerful it couldn't be released. It wasn't some OSS model that found some of this recent stuff making the news.

[Justin Elze @HackingLZ]

An even better Malinois or Dutch Shepherd?? Wooo

https://t.co/h76tVsySEi

[TechCrunch @TechCrunch]

Warhound, the brain child of Ben Lamm and Palmer Luckey, emerges from stealth to genetically engineer dogs for military and law enforcement.
https://t.co/Por7hr92K2

[Justin Elze @HackingLZ]

I like how this gets covered when it’s the same concept as airlines and online retailers blocking agents.

https://t.co/NVNkkz6mZQ

[Axios @axios]

SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions. https://t.co/QGmAmvmtEK

[Justin Elze @HackingLZ]

@usetraceix It's probably worth the effort if you can pop some shared hosting/container platform then use whatever kernel priv esc of the week.

At least now people got extra days for patching

[Ryan Barnett (B0N3) @ryancbarnett]

I have had many discussions with security researchers, customers, et all about how @Akamai is keeping up defensively in light of the post-Mythos/Offensive AI age. Our new blog post sheds some light into our CVE triaging processes and how we leverage a defensive Agentic pipeline.

[Justin Elze @HackingLZ]

@0xTriboulet How are those interest rates looking?

[Stefan Esser @i0n1c]

We cracked the new hardware based UFP mitigation in the iPhone Duo on release day (UFP = unavailable for purchase)

[Justin Elze @HackingLZ]

@dcuthbert It’s interesting that we’ve had clients scan their codebases with both major frontier models, then bring us in for another set of eyes using those same models and we’ve still found impactful bugs.

[Justin Elze @HackingLZ]

The fact there are so many container escapes and Linux RCE floating around probably makes somethings worth max effort vs others.

[Justin Elze @HackingLZ]

The narrative in security news cycles this year has been that every new vulnerability is exploited in the wild within minutes, and that everyone now has access to abliterated GLM models, making exploit development practically instant.

The PHP bug didn’t really align with either narrative.

It’s still a big deal, and mass exploitation is absolutely possible. But the path to widespread exploitation has been more complicated than the headlines would suggest, particularly compared to previous vulnerabilities that saw rapid, large scale exploitation.

[Justin Elze @HackingLZ]

@LiveOverflow Did someone say it wasn’t serious?

[Justin Elze @HackingLZ]

@whokilleddb People tweeting about things

[Joel de la Garza @YODELAGARZA]

Patch or Die!

Today we sent the following out to the CEOs in our portfolio regarding the widespread vulnerabilities that have been detected by AI agents:

The previous week should make it obvious that things have changed. Vulnerabilities are being discovered and exploited at a rate that has never been seen before. While there has been a flood of new vulnerabilities AI agents are being adopted at scale multiplying the potential risk. Agents not only help automate the attacker lifecycle, every ai agent is an insider threat. Your environments are designed to withstand attacks from the outside, not from within. As such, we are suggesting company leaders consider the following changes:

1 - Ensure you're sufficiently staffed for security. The average enterprise allocates roughly 10% of its tech spend to security. Consider doubling that. There are likely thousands of vulnerabilities that need fixing in your environments. Security through obscurity no longer works, all that can be exploited will be exploited.

2 - Establish a zero tolerance policy for secuirty bugs in new features and product releases. Re-examine launch and release schedules and consider delays to ensure all vulnerabilities are patched before deploying new features or products.

3 - Double tap the zombies. Find all old legacy environments that have been neglected and turn them off. Labs, test environments, zombie CI/CD projects etc. Turn it off for now. If it isn’t tied to revenue, kill it.

4 - End the risk acceptance process. Over the last 10 years the risk acceptance process has morphed from a way to accept risks to enable the business, to a way to justify never fixing security issues. Adopt a zero tolerance policy for security issues and risks.

[Justin Elze @HackingLZ]

@S1r1u5_ Our startup can solve this for $X