Hash

Building the next-generation, autonomous, AI-driven red teamer.
Learn, Hack, Secure

[Hash @hash_s3c]

Btw done with open source models <3 bbye

[Hash @hash_s3c]

hmmm 👀 who want php2shell exploit for christmas?

[SinSinology @SinSinology]

To teach a lesson,

After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought https://t.co/hQYMb3AZlk before wiz could pull the same stunt again.

A big budget can buy a domain. It shouldn't buy someone else's research credit.

If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.

Hack the planet. Credit the researchers.

[Hash @hash_s3c]

Litellm, Gitlab 🤣🤣 all are happy now, while you are all discarded by slop pocs

[Hash @hash_s3c]

All those slop everywhere should show you one things. They are all lying you still need fucking expertise on any domain you will work on point .

[Hash @hash_s3c]

@acd421 I had the full exploit :) just fyi

[Hash @hash_s3c]

Btw neither the poc or mitigation are proper here. Just gonna say that

[Hash @hash_s3c]

Hmmmmm 👀👀
```
PHP >= 5.4.0 RCE by Calif.10
[*] START operation initialized
[*] INFO target acquired :: http://127.0.0.1:29264/wordpress/wp-content/index.php
[*] INFO runtime profile :: ubuntu2604-php85
[*] INFO worker strategy :: adaptive
[*] INFO execution objective :: in-band command 'uname -a; id; echo "pwned" > /var/www/html/wordpress/wp-content/uploads/pwned.txt'
[*] INFO retry envelope :: attempts=8 timeout=25s
[*] INFO selected payload :: ubuntu2604-php85
[*] INFO target ABI :: Ubuntu 26.04 package PHP 8.5.4 x86-64
[*] INFO package build :: 8.5.4-0ubuntu1 through 8.5.4-0ubuntu1.3
[*] INFO SAPI boundary :: Apache prefork/mod_php
[*] STAGE CHAIN ACTIVE :: profile=ubuntu2604-php85 elapsed=0s
[*] STAGE exploit attempt :: 1/8
[+] INFO LEAKED :: compact natural tables=149
main_heap :: 0x7b8fd6800000
stale_reference :: 0x7b8fd6875c08
zval_ptr_dtor :: 0x7b8fd8a8c0
zend_call_function :: 0x7b8fd6f2a9d0
[*] EXECUTED ->
Linux php-8u6t-resolute-amd64 7.0.0-34-generic #34-Ubuntu SMP PREEMPT_DYNAMIC Wed Sep 2 14:29:37 UTC 2026 x86_64 GNU/Linux
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[+] OK CHAIN COMPLETE :: profile=ubuntu2604-php85 elapsed=15.1s
```

[Hash @hash_s3c]

Hello X
Here is our analysis of the Nextjs “use safe” unauthenticated RCE, included in the out-of-band security update:

https://t.co/TQWikvuGs7

[Hash @hash_s3c]

Will you trust a vibe-coded communication app? (Like WhatsApp, Telegram, …) 👀

[Hash @hash_s3c]

I don't give a fuck about new models. I can do whatever I want with the existing ones, it doesn't matter anymore.

[Hash @hash_s3c]

I asked Fable to analyze a voice note and stepped out to get lunch. I returned to this:

[Hash @hash_s3c]

All those hacks, all those bioviruses, and we still don't have a cure for cancer.

[Hash @hash_s3c]

I don't use multi-agents in Claude Code anymore. I use only one main chat session, and I am satisfied with it, but I don't know why

[Hash @hash_s3c]

The number of bugs I see in software is disgusting.

Like, guys, can you vibe code properly? At least validate the functionality works as intended?

I don’t have a problem with you vibe coding, but please, I need at least the software fuckinggg working.

[Hash @hash_s3c]

Why are you worried about China winning the AI race if you were just complaining that they are stealing and distilling your models?

Aren’t they supposed to stop and not be able to innovate if you do stop?

Or do you actually just forget to mention that they really do innovative work?

[Hash @hash_s3c]

The algorithm will route us to the right audience, and we will grow one day. 😎

[Hash @hash_s3c]

Okay, I got 'locked by computer use' today.

Is that a new type of ransomware? 🫠 I pressed every possible key to unlock it but wasn't able to. Has Codex ransomwared me? 🤣

@ChatGPT