Marek Sušický

Cybersecurity, SWENG, opendata. Vše jsou striktně osobní názory.

[Michael Weiss @michaeldweiss]

The GRU hacked into Jared Kushner's iPhone. Dutch military intelligence (MIVD) then recruited a GRU spy who gave them access to the hacked phone. What MIVD discovered was that Kushner had access to two bank accounts --one Azerbaijani, the other Israeli --where Saudi Crown Prince Mohammed bin Salman and Emirati ruler Mohammed bin Zayed deposited money. It sounds like a slightly far-fetched episode of "Slow Horses," but it's real. And it proves just how eye-poppingly corrupt this administration was and continues to be as its "special envoy" decides the fate of tens of millions in Europe in the Middle East. Simply incredible reporting by Matthew Cole, drawn from his new book on Kushner. https://t.co/8AyV60gg1X

[Marek Sušický @msusicky]

@sramek_o CTI by měl dělat samozřejmě i NÚKIB a je pozitivní, že varování přišlo ve stejný den.
Něco jiného je jen tak něco napsat na Twitter a něco jiného oficiálně varovat.
Kdo chce rychlejší varování, zaplatí si komerční službu.

[Marek Sušický @msusicky]

Pán je asi velký hrdina. Škoda, že měla paní odemčené dveře. Ideálně 300h prospěšných prací a 5 let bez papírů, pak jedině po psychotestech, ale tak to nejspíš nedopadne, že.
https://t.co/1XIsiMi3FQ

[Jordy Rodríguez 👨‍💻 @jordy_4sd]

🚨 Oracle publicó hoy una alerta de seguridad para Java: CVE-2026-91403, CVSS 9.1.

Está en JSSE (el TLS de Java) y es explotable por red sin credenciales.

Versiones afectadas que lista: Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 y 27.0.1, y GraalVM.

https://t.co/Uda1HhCrAz

[Marek Sušický @msusicky]

@sudetskypravnik @NUKIB_CZ To není fér, nemyslím, že jsem mimoň a cvaklo mi to v 5 ráno ve vlaku. Buďme rádi, že se to dneska stalo. Mrkněte, kdy to vydala CISA KEV. Samozřejmě předpokládám, že máte k dispozici, jako každé malé děcko, exploit, který to hackne.

[Juliano Rizzo @julianor]

While everyone’s patching PHP today, don't sleep on Node.js CVE-2026-111497 OOB write in the bundled Brotli decoder. Reachable via fetch(): a malicious server just replies
Content-Encoding: br.
Fixed in 26.12.1 / 24.22.1 / 22.23.4.
Update.

[Marek Sušický @msusicky]

Bude zajímat @NUKIB_CZ a @GOVCERT_CZ

[Andrew Dorman @acd421]

Teamwork makes the dream work.

The team and I
@J4ck3LSyN @Archknight23

🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow.

The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.

📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up.

PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act.

Here's the part the big threat-intel shops aren't shouting about:

No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling:

🔹 Present since PHP 5.4
🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live)
🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config

That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands.

✅ What to do right now:

1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade.

2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess:

session.upload_progress.enabled = Off

Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths.

3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.

4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today.

Why I'm posting this for free:

A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response.

I'll follow up once the official advisory publishes and confirm whether my root cause read was right.

Stay patched. 🔒

#PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec

[Andrew Dorman @acd421]

Teamwork makes the dream work.

The team and I
@J4ck3LSyN @Archknight23

🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow.

The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.

📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up.

PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act.

Here's the part the big threat-intel shops aren't shouting about:

No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling:

🔹 Present since PHP 5.4
🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live)
🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config

That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands.

✅ What to do right now:

1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade.

2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess:

session.upload_progress.enabled = Off

Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths.

3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.

4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today.

Why I'm posting this for free:

A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response.

I'll follow up once the official advisory publishes and confirm whether my root cause read was right.

Stay patched. 🔒

#PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec

[Florian Roth ⚡️ @cyb3rops]

patch or take offline

[Marek Sušický @msusicky]

@PalatMartin @MP_Praha @DPPOficialni @Hlavacek_P Podle popisu mi přijde, že to je zodpovědnost městské policie - přivoláni byli, nic neudělali. MP řídí primátor, takže ODS. Doufám, že nový primátor tyto praktiky změní.

[Marek Sušický @msusicky]

Asi to nechápu. Špatně parkující auta zablokovala průjezd autobusů a @MP_Praha nekonala. Předpokládám, že vznikla škoda nejen cestujícím, ale i @DPPOficialni
Bude se to vymáhat? Jsem zvědav, jak se k tomu nové vedení magistrátu postaví @Hlavacek_P
https://t.co/JxBrWpjCY2

[Marek Sušický @msusicky]

@weblog20 Další efekt budou i ty modely. Závislost na frontier modelech a cena za zpracování. Pokud to spojí s nějakým víc custom modelem, ale menším...

[Marek Sušický @msusicky]

@SkutecnyUFO @kllukk @rota152 Celé je to o tom mrknout dovnitř, jak to dělali. Když se to chytne brzo,tak berou jen metadata. Takze začátek a konec :)
Při troše štěstí a snahy to pak může jít

[Cyber Security News @The_Cyber_News]

Multiple NGINX Flaws Let Remote Attackers Crash Servers and Execute Malicious Code

Details: https://t.co/kmpAsPEPGP

F5 has disclosed three serious security flaws in NGINX Plus and NGINX Open Source that can let remote, unauthenticated attackers crash worker processes by sending crafted HTTP requests. The flaws are tracked as CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176.

F5 published the three advisories on October 14, 2026, and rated every issue High at 8.1 under CVSS v3.1 and Critical at 9.2 under CVSS v4.0. The bugs do not make every NGINX server vulnerable by default because each one needs a specific software version and configuration.

F5’s advisories do not report active exploitation of these three newly disclosed flaws.

#cybersecuritynews

[Marek Sušický @msusicky]

@SkutecnyUFO @kllukk @rota152 Zkuste Canary tokeny, dostanete varování rychle,pak taky neni špatný AI útočník, např. https://t.co/wRPL1eHYzf
Jestli máte esxi a šifrovali image, mrkněte na https://t.co/UhU4uuXPFg

[The Hacker News @TheHackersNews]

‼️ A CVSS 10.0 flaw in GitLab could have let unauthenticated users execute code on the server under certain conditions.

GitLab has patched the CI/CD vulnerability (CVE-2026-97229) affecting CE and EE.

Fixed versions: 19.2.8, 19.3.5, and 19.4.2.

Read: https://t.co/gEZiwNb9Vq

[abraxas @abraxas_null]

🔥🚒 pfSense Firewall 0day - 5 RCEs! 🚒 🔥

Exploits
- https://t.co/gHSHDRwLQF
- https://t.co/YzojvUagPM
- https://t.co/GVQrSfIx9Q
- https://t.co/FIPNZqPlO5
- https://t.co/SvDpcvBs1Q

Writeups
- https://t.co/yGwP2d1sAS
- https://t.co/kBDzZxa3xV
- https://t.co/lXsNsD5z3W
- https://t.co/pYyPWhqrYk
- https://t.co/tiSgaLPref

[Marek Sušický @msusicky]

@tohecz @michalillich https://t.co/BuRTorjfna
Koukám, že se to asi pohne..

[Marek Sušický @msusicky]

Překvapení, asi lidem došlo, že inflační 5000Kč, které budou ležet v šuplíku, nebudou v nákladu 200k kusů takový zázrak a kdo ví, jestli inflaci porazí...
https://t.co/yviXtB8712