LiveOverflow 🔴 hextree.io

wannabe hacker... he/him

🌱 grow your hacking skills @hextreeio

[LiveOverflow 🔴 hextree.io @LiveOverflow]

Where to find me:

🔴 Hacking Videos: https://t.co/tSxl01jY7x
📜 Articles: https://t.co/jN1MhA26EX
💻 Start Hacking? https://t.co/dxB8XLhOjB
🥰 Support: https://t.co/t7xslK6s14
📹 2nd Channel: https://t.co/FYrR8WW6ll
🤳 Instagram: https://t.co/EZpdSH90Td

[LiveOverflow 🔴 hextree.io @LiveOverflow]

If you use AI for "safety", at least do it with some due diligence. This checker is not accurate and will report false positives.

[OpenAI @OpenAI]

If you are wondering whether your website is affected, we have packaged a Codex skill to help check.

Point your Codex at this repo to guide you through it: https://t.co/XUEbOwXuQC

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@moyix I am thinking about this a lot and haven't figured it out yet. I have lots of peers that have more success with agents than I have. So far it's not something I can grasp. It seems to be some very small intuitive difference. Like "how to google correctly".

[Stefan Esser @i0n1c]

People keep asking me why @calif_io hired @lcamtuf and what he does for us. I guess the cat is out of the bag.

[LiveOverflow 🔴 hextree.io @LiveOverflow]

I also wanted to make this video to document an AI/Codex workflow in October 2026. Let's see how different it will be in a few months from now :D

[LiveOverflow 🔴 hextree.io @LiveOverflow]

Made a quick video (aka 5h of work), about my experience racing to find php2shell.

https://t.co/4mswR4daZH

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@tropix126 of course not remotely exploitable. but maybe there are php "sandboxes" somewhere that rely on this boundary. hence asking

[LiveOverflow 🔴 hextree.io @LiveOverflow]

I don't know the php ecosystem. Is this useful for anything?
This fell off the clanker-train while looking for php2shell

[Stefan Esser @i0n1c]

Omg I found a copy of the original memory_limit advisory. https://t.co/l8jba24oXk

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@i0n1c probably whispers are going around, and even small unintentional hints could plant the idea to look for it

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@0x_shaq It was OpenAI all along

[Anthony Ronning @anthonyronning]

@maxious Very strange how this keeps on happening

[SinSinology @SinSinology]

To teach a lesson,

After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought https://t.co/hQYMb3AZlk before wiz could pull the same stunt again.

A big budget can buy a domain. It shouldn't buy someone else's research credit.

If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.

Hack the planet. Credit the researchers.

[LiveOverflow 🔴 hextree.io @LiveOverflow]

I think it's useless and wanted to just share PoC. But just in case there is some system running untrusted PHP, I thought I'd better ask.

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@BenKnill @0xjohnny @rez0__ Worked for me :D

[LiveOverflow 🔴 hextree.io @LiveOverflow]

A prompt like this would never be refused by Daybreak blue before. I am wondering if OpenAI set guardrails specific to this vuln to slow down rediscovery.

[LiveOverflow 🔴 hextree.io @LiveOverflow]

pov: somebody drops a video with a critical 0day for the lulz and you try to fix it

[LiveOverflow 🔴 hextree.io @LiveOverflow]

Official update instructions recommend a third-party provider that adds telemetry? 🤨

[LCFR @lcfr_hax]

d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac (posted in august)

(related)
8da579ec498d57c20977c8d186d7f6cd4c04f46ffa1b436dd646ec19b99bdf47
cb4c8532c245ff7e05d6e270fca5742bb3271f541ef80f0071ca3d4307eb2b53
957f8cc21b18483f80a9d723aa4f9ded26e456424ffd065a044d1ed9d58a4fbc
4f93976ef105f0d9ff2d60f35d48958c8bba9d9eb2873cd93b3f7105fa4716a6

[LiveOverflow 🔴 hextree.io @LiveOverflow]

close

[LiveOverflow 🔴 hextree.io @LiveOverflow]

There we go
https://t.co/UejvtXFMR1

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@Dinosn this sounds more correct

[LiveOverflow 🔴 hextree.io @LiveOverflow]

@usetraceix OOM seems to be a real trigger for UAF. The article talks about the correct area. but the exploit is fake slop

[LiveOverflow 🔴 hextree.io @LiveOverflow]

I don't think this is real? Or it's a different issue? Did anybody check this properly?

[Jλckλι @J4ck3LSyN]

... get it while its hot... 😈
> CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x)
> session.upload_progress UAF
> https://t.co/1DgcpCWN8m
> Courtesy of Me, @acd421 & @Archknight23

#CyberSecurity #infosec #php2shell #php