Sam Sabin

@axios cybersecurity reporter, taking it day by day ✨ | 📩: sam.sabin@axios dot com, signal: SamSabin.01 (no pitches!)

[Sam Sabin @sammsabin]

ok, putting them all in one spot.

someone lmk when we sort out when to post on which for what, i’m overwhelmed already 🫠

[Sam Sabin @sammsabin]

👀👀👀

[Andy Piazza @klrgrz]

Sorry folks, we have a confirmed PHP compromise with post-exploit activity. Still not the widespread outbreak we all braced for, but it’s actively exploited in the wild. Updated threat brief:

https://t.co/43WCYmouIE

[Greg Brockman @gdb]

we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library.

it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software:

[Sam Sabin @sammsabin]

Cybersecurity Awareness Month actually meaning something this year is the ultimate Uno reverse

[Sam Sabin @sammsabin]

nsa doubling down on php

[NSA Cyber @NSACyber]

PHP security risks remain high and PHP mitigation requires immediate attention. Our guidance is further supported by additional agencies including @CISACyber, @NCSC, @ASDGovAu, and CERT-EU. If you have not reviewed your exposure and applied mitigations, now is the time. Please read the linked resources, follow requisite vendor guidance, assess your environment, and implement mitigations without delay. https://t.co/bMWqwsYliI

[simon @nautsimon_]

maybe the point of cybersecurity was the friends we made along the way

[John Hultquist @JohnHultquist]

A brief update on the critical vulnerabilities in PHP: 

We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.

Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:

​1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services

​2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window

​3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching

🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: https://t.co/uDnd6gk988 

🔗 Technical details from Wiz: https://t.co/RqmTqEDM2V

🔗 Details of the exposure from VirusTotal: https://t.co/Toix3AM0yq

[Max Zeff @ZeffMax]

New: The three researchers OpenAI fired last month spent the summer fighting to keep AI's chain-of-thought process visible.

Then, OpenAI asked to see their Signal chats. A week later, they were let go.

More below from @keachhagey, @berber_jin1, and me.

https://t.co/7klEDa8R0M

[Jason D. Clinton 🔸 @JasonDClinton]

as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)

[Peter Wildeford🇺🇸🚀 @peterwildeford]

PSA: in light of recent cyberattacks and vulnerabilities, I recommend everyone:

* use a good password manager (1Password) and do not duplicate passwords
* use two factor auth for everything important (not via sms!! Google Authenticator or better yet YubiKey)
* Auto-updates on, and restart weekly so they actually install
* Freeze your credit
* Get an IRS Identity Protection PIN
* Get your cell carrier to give you a port-out PIN or number lock that makes the carrier refuse to move your number without the PIN

You can ask your claude code to audit what on your laptop is out of date and needs updating.

[Madison Mills @MadisonMills22]

SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.

The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.

Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.

Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.

Read my latest for Axios here: https://t.co/Q3bda5In8q

[Matthew Prince 🌥 @eastdakota]

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

[Sam Sabin @sammsabin]

source: https://t.co/CpNQxvRbKK

[Sam Sabin @sammsabin]

some handy charts from Bitsight on the industries + countries with the most internet-exposed instances of PHP

[tuckner @tuckner]

Just used LiteLLM to create my first PHP website. The AI even suggested getting a certificate from eMudhra for HTTPS to protect my login page. The future looks really bright 🥳

[Sam Sabin @sammsabin]

everything is fineeeeeee 🫠

[Nikesh Arora @nikesharora]

You know it's serious when heads of state get involved.

[Heather Adkins - Ꜻ - Spes consilium non est @argvee]

Phil's post +1000. Also h/t to @riskybusiness last week that points out while vuln counts might be +YYYY% breaches might not. However, as @bradarkin raised, the CISO community is seeing a doubling in activity. While x2 < YYYY% it's still MASSIVE given global volumes of attacks. Brace yourselves. Reduce your attack surface, patch and get hygiene right on configs. Don't put your fridges on the Internet please. Deprecate your old appliances (VPN, Citrix, Zimbra, etc).

[clem 🤗 @ClementDelangue]

Just watched the @netflix Instadocs about the @OpenAI cyberattack on @huggingface. Super disappointing, as they went for maximum anthropomorphism of the technology and full doomer mode.

I spent more than two hours with them trying to correct all their mistakes and ground this in reality, explaining that agents are technological systems, not aliens. But it looks like the drive to scare people for maximum views was too strong.

Also, they didn’t mention the lack of containment and monitoring of the agents, how closed-model safeguards blocked our defensive work, or how we defended ourselves with AI using an open model. And that we still lack a lot of information and transparency, including full agent traces and that companies need to remain accountable for what their agents do.

It ends up being a fun sci-fi movie though!

[Zack Korman @ZackKorman]

This report on a Chinese threat actor using AI to automate hundreds of attacks has a very funny conclusion:

[Punit Shah @thepunit]

11 days ago, our team @AnthropicAI launched OSS Scanner to give open source projects free, periodic vulnerability scans from our strongest models, inspired by OSS-Fuzz. Some numbers so far:
• ~650 projects applied
• 114 accepted
• 77 critical and 803 high model-rated findings reported (we haven’t scanned all projects yet)

How our reports ended up flagged as malware, and other learnings/updates below 🧵