🦅

offensive security researcher @synack , specialized in breaking LLM security

[🦅 @jayy0x01]

How @CyberMehul and I approached testing a GPT-4-based assistant from prompt injection to SQL execution and database dump.

This article is not a copy&padte payload dump. It focuses on the methodology, mindset, and attack progression: how we approached the AI surface, identified trusted input vectors, bypassed model defenses, and escalated the issue into backend tool abuse.

Due to NDA restrictions, I cannot share screenshots or raw target evidence, but the writeup explains the technique, reasoning, and impact in a redacted and responsible way.

Enjoy reading.

#LLMSecurity #PromptInjection #BugBounty #BugBountyTips
#YesWeRHackers #YesWeHack #synack

[🦅 @jayy0x01]

https://t.co/b9kBEoR9Cl

[🦅 @jayy0x01]

@Dinosn

[Smukx.E @5mukx]

Do you know Google Flare team ( an elite reverse engineering and malware analysis unit ) has a crash course that explains and teaches malware analysis from basics to advanced step by step.

Link :- https://t.co/hWQoJP1Nwp

[le.hl @0xleegenz]

My bro and I who had $15 on Binance monitoring the hack situation

[Andrew Dorman @acd421]

I have been meaning to drop this article for a long time enjoy the read! https://t.co/9ZbAJa4t0S

[Nicolas Krassas @Dinosn]

NWH Stealer Payload Extraction, Fileless Bun Runtime & Cloud C2 (AWS/R2) https://t.co/lP7GQE8kvq

[🦅 @jayy0x01]

@DsokeyyV المحور كلو وقف يتفرج 😂

[The Hacker News @TheHackersNews]

‼️ Linux kernel TCP flaw rated 9.8 CVSS.

Anthropic demonstrated an exploit that runs commands as root on servers using MPTCP.

Ubuntu and RHEL still lack fixes, while Debian, Oracle and others have released patches for some versions.

Details: https://t.co/sGwlEL7RNk

[🦅 @jayy0x01]

No you’re not misreading, look
Proof.txt is different than the evidence dir,
Evidence dir output the responses and json from script, it’s writable by your machine
Proof.txt is target side where apache /www-data must be able to create /var/www/html/proof.txt for the default command; python then retrieves it over http
So Apache needs write permission for the target proof file, not the local evidence directory.

Is that clear or wang me to send you s.s to be able to understand more?

[🦅 @jayy0x01]

my turn , here is my poc for CVE-2026-109618 / CVE-2026-109619 ,exact build PHP 8.5.11 / Apache mod_php .
Includes fresh-leak validation, evidence handling and an execution diagram.
Exact-build only not a universal PHP exploit.
For authorized lab research.
https://t.co/xH7JlovoWy
#AppSec #PHPの脆弱性だと思うもの #infosec #PHP

[🦅 @jayy0x01]

@rickchisholm No evidence dir is on the machine running the Python script, so it must be writable by your local user, not Apache,The target never writes there.

[Synack Red Team @SynackRedTeam]

A random-looking GUID was the only thing protecting guest PII on a food ordering platform. Maybe it wasn’t so random?

Synack Red Team researcher Mustafa Öztaş (rickiex) spotted the pattern. A forgotten endpoint did the rest. CVSS 8.7. https://t.co/PHvCX0rKwZ

[vx-underground @vxunderground]

Life hack: join a ransomware group, extort companies, make tens of millions, get caught, only do 5.5 years in a minimum security prison, lie about paying restitution, retire early

[🦅 @jayy0x01]

@IntCyberDigest

[🦅 @jayy0x01]

@The_Cyber_News

[Cyber Security News @The_Cyber_News]

‼️ Hackers Chain PHP2Shell and Linux Kernel Exploits to Gain Root Access on 25 Servers

Details: https://t.co/up3Dc5JUzL

Hackers combined PHP2Shell vulnerabilities with a Linux kernel exploit to gain root access on 25 servers across the United States, Japan, Taiwan, and South Korea, including three systems in a US government-affiliated environment. Dream researchers uncovered the campaign’s files on October 25, revealing a path from exposed firewall management interfaces to internal Active Directory services.

The attack paired PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, with Fragnesia, a Linux kernel privilege escalation flaw tracked as CVE-2026-46300.

Dream described the PHP2Shell code as a custom, nonpublic implementation tailored to the targeted firewall platform, rather than a copy of a known public exploit. The full chain reportedly installed a root webshell in under 15 minutes.

#cybersecuritynews

[Nicolas Krassas @Dinosn]

Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces https://t.co/CnLH794sLq

[Dark Web Informer @DarkWebInformer]

🚨🇦🇪 Telegram zero-day can enable code execution through malicious animated content

A vulnerability in Telegram’s rlottie animation library can allow attackers to execute arbitrary code within the application process.

Tracked as CVE-2026-111105, the flaw carries a CVSS score of 7.0 and was publicly disclosed by Trend Micro’s Zero Day Initiative after remaining unresolved at the client-code level.
⠀
The vulnerability is caused by improper validation of attacker-controlled animation data, resulting in a write before the beginning of an allocated memory buffer.
⠀
Despite reports describing the flaw as a zero-click sticker attack, ZDI’s final advisory says user interaction is required. The victim must visit a malicious page or open a malicious file for exploitation to occur.
⠀
Telegram told ZDI that server-side sticker validation mitigates the vulnerability. However, ZDI continued seeking a client-side fix and ultimately published the issue as a zero-day advisory on October 15.
⠀
No affected client versions, patched versions or confirmed in-the-wild attacks have been disclosed.

Users should keep Telegram updated and avoid opening untrusted animated files, sticker packs or external links until a client-side fix is confirmed.

[klöss @kloss_xyz]

my AI agents after I give them full access and tell them to be careful

[PHP Site Audit @PHPSiteAudit]

Exact-build only is the honest caveat, and it still matters.

PHP 8.5.11 on Apache mod_php is not some exotic setup.

It's a production setup a lot of sites actually run.

So "not universal" is not the same as "not dangerous."

If your serving version is 8.5.11, patch to 8.5.12.

Then restart Apache / PHP-FPM and verify the version that's actually serving requests, not just php -v.

[🦅 @jayy0x01]

@PHPSiteAudit Thank you for pointing this out , appreciate it!

[🦅 @jayy0x01]

@acd421