Moshe Siman Tov Bustan

Security Research Team Lead @OX__Security
Guitars @CompileBand

24x CVEs
5x Conference Talks

[Moshe Siman Tov Bustan @MosheTov]

During the Shai-Hulud malware analysis, we found that the Python version contains a check if the target machine is from Israel or Iran - if so, it plays Russian roulette - randomly picking a number from 1 to 6, and if 2 is chosen - it starts a horrible siren sound on max volume, and removes all files on the machine.

[Moshe Siman Tov Bustan @MosheTov]

I agree, and it's somethine I personally work on to get my team as much space as they need during these times, change projects, take time off, everything to keep their mental health in check.

We're so much invested in what we do it's easy to forget it's just a job, there will be other places to work for, and other people to replace us, we do this to supply for our families before anything else. If something disrupts that, it ain't worth it.

[Moshe Siman Tov Bustan @MosheTov]

@itsalexjardine Thanks, it's an important note and I think looking at raw numbers do miss much of the important stuff...
Nonetheless, even if we're off by 5%, it's still concerening...

[Moshe Siman Tov Bustan @MosheTov]

PHP2Shell: 24 Hours Later

24 hours after PHP2Shell dropped, 99.3% of affected PHP instances are still unpatched.

Yep, you read that right. 🫣 🤦

After CVE-2026-109618 & CVE-2026-109619 were disclosed, we tracked more than 2.2 million publicly visible PHP instances on Shodan to see how fast the internet actually patches an unauthenticated RCE in PHP itself.

• At first: 245 patched instances
• After 12 hours: 4,519
• After 24 hours: 14,151, out of ~1.97M measurable affected instances

Breaking it down by WordPress, phpMyAdmin, Drupal, Laravel, Joomla, cPanel and Magento shows the same picture: roughly 99% still unpatched.

AI is making us faster at finding critical vulns, but it isn’t making us faster at removing them from the internet. If that gap keeps growing, patching quickly won’t be enough on its own.

You need to know what you actually expose, cut internet-facing surface you don’t need, monitor for exploitation, and fix what’s really exploitable first.

If you have a publicly accessible PHP instance and still haven’t patched, assume you’re exposed. Patch now, then check for signs of compromise.

Full data and methodology on the OX Security blog:
https://t.co/10IHG6LrlQ

[Moshe Siman Tov Bustan @MosheTov]

@BlaiseBits 2 PHP 2 Shell

[Moshe Siman Tov Bustan @MosheTov]

@_0xKiwi @OX__Security We're diamond sponsor at the next Black Hat EU..
About the IDF, even if we did, I couldn't tell you 🫣

[Moshe Siman Tov Bustan @MosheTov]

@eastsidemccarty Actually we have all of our detections in top shape, when they publish we can detect and block faster than ever 🫣😅

[Moshe Siman Tov Bustan @MosheTov]

Any threat actors waiting to drop a Shai-Hulud variant on NPM, now's probably the best time while everyone are busy with PHP2Shell, LiteLLM, Pillow, NodeJS, eMudhra CA certs...

[Moshe Siman Tov Bustan @MosheTov]

@DillynBarber Lol, I think it's a combination of hard reality and the time it takes Shodan to index stuff...
Probably most serious companies that patch don't expose the PHP headers 👀🫣🫠

[Moshe Siman Tov Bustan @MosheTov]

shell2shell just dropped or something. 🫣

JK I dunno anything I just try to fit in with this Cyber security awareness month thing...

[Moshe Siman Tov Bustan @MosheTov]

@DillynBarber Wanna go over the Shodan logs together? I just rescanned and patched instances rose to 25,887.

[Moshe Siman Tov Bustan @MosheTov]

@Kyrannio Best password is no password

[Moshe Siman Tov Bustan @MosheTov]

@PELock @Apple I'm humbled you think I work at Apple!
What am I supposed to be looking at here, and why is your GitHub username called S** Gang? 🤐

[Moshe Siman Tov Bustan @MosheTov]

@_Shark_byte NodeJS, Pillow, it's only the start 🫥

[Moshe Siman Tov Bustan @MosheTov]

@FrankSEC42 SHA256("PHP")

[Moshe Siman Tov Bustan @MosheTov]

@abh1sek I know, I think it's just too much work for something that doesn't give back the same amount of value 👀

[Moshe Siman Tov Bustan @MosheTov]

❗ If 2 PHP vulns weren't enough for one day (or, 0-day?) - LiteLLM were compromised today by a combined RAT Infostealer malware!

TLDR - LiteLLM PyPI ver 1.107.0 is compromised, if you installed it - revoke keys and change passwords ASAP.

The malware combines two threats in one package: an infostealer that harvests secrets from the machine, and a remote access trojan (RAT) that lets the attacker connect remotely and control the affected machine.

The malicious code was injected only into the “wheel” package, so reviewing the repository and the “clean source” would not have revealed anything wrong. The malware also contacts the URL litellm[.]dev, which is an attacker bought domain that could easily be seen as a legitimate domain instead.

While this might look like “yet another PyPI malware”, hiding inside the wheel file is one of the new ways attackers use to stay hidden and bypass common detections, like in npm, whenever a new protection is added – such as blocking preinstall hooks, threat actors will go out of their ways to find new techniques to reach their goals and execute code without being detected.

If you’re yet to pin versions or add a time-based installation delay, this should be yet another wake up call to take the time and do so before it is too late. Once these passwords and credentials are out, remediation will take longer than it takes threat actors to get what they want.

Read the full blog:
https://t.co/3n5Pf3wFMi

[Moshe Siman Tov Bustan @MosheTov]

Fast response from the @NSAGov

[Moshe Siman Tov Bustan @MosheTov]

php2shell - CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHP

https://t.co/WDRwwnIu7F