Pritesh Mistry

Senior Penetration Tester | Security Analyst

[Pritesh Mistry @pritesec]

I just published my writeup about How an incident gave us $$$ bounty.
If you have any query feel free to DM me.
https://t.co/gH6FwOwf2b

[hackplayers @hackplayers]

💥 #PHP2shell: encadenando peticiones HTTP hasta el RCE.

Analizamos la vulnerabilidad, diseccionamos la explotación y exploramos cómo reproducirla en un laboratorio controlado gracias a Enes Sönmez.

🔬 Análisis técnico, PoC y laboratorio en Hackplayers: https://t.co/Qq6AewWcWq

[Ron Masas @RonMasas]

Liked PHP2Shell? You’re gonna love Node2Shell.

We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!

https://t.co/NLluyUopEi

[Sherwood @shcallaway]

Today we're launching https://t.co/8QjczrYPGX 🚨

Yesterday was a rough day for security. php2shell, LiteLLM, Railway... How are we supposed to stay on top of all of this?

https://t.co/8QjczrYPGX aggregates 4 vulnerability sources into one free feed and uses AI to explain each one in plain English. No login.

https://t.co/uUKISkHX1e

[Dane Knecht 🦭 @dok2001]

The Cloudflare's writeup on our php2shell response is up.

Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.

New rules keep landing in the WAF changelog.

Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.

PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
https://t.co/qzAiN2wGVl

[Nagli @galnagli]

As the embargo is now lifted, find all the information needed on https://t.co/Z86Sbopi0O - the critical RCE vulnerability our research team identified affecting PHP core https://t.co/AjhGZBtYr5

[sagitz @sagitz_]

Today we disclose PHP2Shell - remotely exploitable memory corruptions in PHP

WordPress pre-auth RCE: ✅
Drupal pre-auth RCE: ✅
Joomla pre-auth RCE: ✅
Remote memory disclosure of any PHP application: ✅

Read more ⬇️🧵

[Raj 007 @RajMav07]

The hardest choices require the strongest will. 📈

[Pritesh Mistry @pritesec]

@Meta @instagram @metaindia

[Pritesh Mistry @pritesec]

@Meta @instagram My Instagram account (Username: https://t.co/9R3nGHxFfT) has been suspended unexpectedly. I have not violated Instagram’s Community Guidelines or Terms of Use. Please review my account and restore it if the suspension was made in error.

[Dhiyaneshwaran @DhiyaneshDK]

🚨 CVE-2026-21589 - Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read

Nuclei Template : https://t.co/EvNb3MvnP0

Reference: https://t.co/zszpScosyZ

#bugbounty #hackwithautomation #atlassian

[𝐗. @be_evolved1]

men after losing everything

[Pritesh Mistry @pritesec]

@Meta @instagram My Instagram account (Username: https://t.co/9R3nGHxFfT) has been suspended unexpectedly. I have not violated Instagram’s Community Guidelines or Terms of Use. Please review my account and restore it if the suspension was made in error.

[Dera Ojobo @deraojobo]

obsession over talent

[Kevin Pietersen🦏 @KP24]

Better to be a wolf that everyone hates, than a donkey who everyone rides.

[Pritesh Mistry @pritesec]

@RealJohnnyTime Congratulations 🎉

[Pritesh Mistry @pritesec]

@_jensec 💯

[Romil Patel @Romilpatel1988]

@bsidesahmedabad "><img src=x onerror=alert('@bsidesahmedabad ')>
I want to bring my friend to learn AI Security, prompt injection, and how
we can defend AI systems.

BSides is the perfect place to learn from researchers, share ideas, and discover what’s next in cybersecurity.

@pritesec

[HackingHub @hackinghub_io]

Web cache deception tricks 🪄

GET /api/me → returns PII

Run these to trick the CDN into caching a sensitive endpoint:
🟥 GET /api/me;.css
🟥 GET /api/me/foo.css
🟥 GET /static/..%2fapi/me
🟥 GET /api/me%00.css
🟥 GET /profile%2f%2e%2e%2fstatic

Your ideal scenario: the origin ignores the trailing junk (; param, extra path segment, encoded traversal) and returns private data anyway, but the CDN only sees the .css suffix and caches it as static.

NOTE: Also try other delimiters, file extensions, and static directories.

[s1r1us @S1r1u5_]

On July 25, we hacked OpenAI.

Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.

We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵