Steve DiCicco

CCIE #60607 | Distinguished Engineer (he/him) Tweets are my own. BLM [email protected]

[Steve DiCicco @host_bits]

[email protected]

[John Hultquist @JohnHultquist]

A brief update on the critical vulnerabilities in PHP: 

We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.

Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:

​1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services

​2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window

​3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching

🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: https://t.co/uDnd6gk988 

🔗 Technical details from Wiz: https://t.co/RqmTqEDM2V

🔗 Details of the exposure from VirusTotal: https://t.co/Toix3AM0yq

[Steve DiCicco @host_bits]

Do it, a great self registered list of assholes to avoid.

[Spencer Hakimian @SpencerHakimian]

JUST IN: Donald Trump announces he is looking into launching a dating app for MAGA men

[NSA Cyber @NSACyber]

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

[Stoner Philly Fan @StonerPhillyFan]

Fuck ICE. Free Palestine. Go Birds. Good morning.

[Cthulhu ( ;,;) @Cthulhu_Answers]

@AkitaOnRails Fascists are cunts that’s a fact

[Steve DiCicco @host_bits]

@kmcnam1 I wish I didn’t know how to read. Fuck

[Cthulhu ( ;,;) @Cthulhu_Answers]

Looking forward to @NetworkChuck’s next episode “Tech and Tradwives: why women shouldn’t work in tech and stay in the kitchen”

[Senator Adam Schiff @SenAdamSchiff]

Pete Hegseth comes out in favor of gender affirming care…

[Steve DiCicco @host_bits]

@juangolbez But that Ocarina of Time tho 🤣

[Steve DiCicco @host_bits]

If you’re sending me repeated messages from different people asking me to request an invite to your event about some AI topic, chances are pretty good it’s not worth going

[C O U R T N E Y @icourtneycries]

(IG: timgough) has done it again 🧡

[Brian Krassenstein @krassenstein]

BREAKING: Massive crowds already in Philadelphia for the No Kings Protest this morning.

Philly really hates Trump.

#nokings

[Steve DiCicco @host_bits]

@juangolbez There’s a particular one it is super susceptible to that I got through all but the final question with.

[Steve DiCicco @host_bits]

@RepOgles Man you’re really batting a thousand with understanding things you are saying you follow:

This you https://t.co/hfEzL1wGyH

Constitution / commandments fuck em right

[Steve DiCicco @host_bits]

@RepOgles Bigots don’t belong in American society my dude. Guess you missed that part of the constitution

[Antifa_Ultras @ultras_antifaa]

❝Make racists afraid again❞

[Susan Wild @wildforcongress]

Can we please do this in PA?

[Alexandria Ocasio-Cortez @AOC]

@RepNancyMace Names are not enough. Job roles, dates, & victim statements can be easily matched to House records to ID names.

Survivors have NOT provided consent and were promised anonymity and protection when they gave statements. This carelessness is why victims don’t come forward. Fix it.

[Donald J. Trump @realDonaldTrump]

The United States has spent EIGHT TRILLION DOLLARS fighting and policing in the Middle East. Thousands of our Great Soldiers have died or been badly wounded. Millions of people have died on the other side. GOING INTO THE MIDDLE EAST IS THE WORST DECISION EVER MADE.....