Server Crew

System Administration, Infosec. I don't automatically refollow, especially firehoses.

[International Cyber Digest @IntCyberDigest]

There’s a less known edge case for Fortinet devices where, rather than act merely as a remote code execution platform, they can serve as firewalls.

https://t.co/Cn4DiVxSof

[Server Crew @ServerCrew_AU]

@threatbear_co Nice writeup, nice detection. I have a question though...

If I use a compiled exploit (the c or go ones floating around) and name it one of the allowlisted process names, won't it get past the filter?

[Server Crew @ServerCrew_AU]

@allgoodrecshops @Acyn Nuremberg only took place after Germany was comprehensively defeated. Foreign troops in Berlin, etc.

Nobody's going to be landing troops in the US and taking Washington.

The current US administration knows it can crime as much as it wants with impunity.

[Server Crew @ServerCrew_AU]

@DarkReading Hey @DarkReading BIG-IPs are @F5 kit, not @Fortinet .

You've spent an entire article saying Fortinets are vulnerable, Forti has issued an updated advisory, and referring to older Forti vulnerabilities.

I don't think Forti are going to be very pleased with your article 🤔

[Server Crew @ServerCrew_AU]

@QDrop2450 @grok are these photos ai generated?

[Peter Girnus 🦅 @gothburz]

Someone found an RCE on my website yesterday.

CVE-2025-55182.

React2Shell.

I don't have a bug bounty program.

I never asked for a security assessment.

I woke up to a DM: "Hey I found a critical vulnerability in your site. I only ran the exploit to verify it worked. Here's my PayPal for the bounty."

Bounty?

I checked my logs.

Forty-seven requests to my RSC endpoint.

Something, something ... Prototype pollution payloads.

They used the GitHub script.

The one with 2,000 stars.

The one that runs id automatically "for verification purposes."

They spawned a shell on my production server.

uid=1001(nextjs) gid=65533(nogroup)

They took a screenshot.

They posted it on Twitter.

"Popped a Shell on a Live Website 🚀💀 #BugBounty #CVE-2025-55182 #YOLO"

They got 84781 likes.

My customers' data was on that server.

I asked them to delete the screenshots.

They said "I removed the domain name, you should be thanking me."

Thanking them.

For unauthorized access to my production infrastructure.

For running arbitrary commands on systems I own.

For posting proof of exploitation for clout.

They called it "responsible disclosure."

I called my lawyer.

They called me "ungrateful."

I called the FBI.

Now they're in my DMs explaining that "this is how the industry works" and I "don't understand pen testing."

A pen what?

I understand it perfectly.

I understand that running https://t.co/C6kmBequB5 against random websites isn't research.

I understand that "I removed the identifying info" doesn't undo the unauthorized access.

I understand that #BugBounty doesn't apply when there's no bounty program.

I understand that finding my site on Shodan doesn't constitute authorization.

Their followers are defending them now.

"Presumption of innocence."

"You don't know if it was authorized."

"The screenshots were redacted."

Three hundred people are calling me a bootlicker for reporting a crime.

Someone said I should be grateful they didn't deploy a cryptominer.

The bar is underground.

I just wanted to run a small Next.js app.

I didn't ask to be someone's proof-of-concept.

I didn't consent to being their "first"

I didn't sign up for an unscheduled penetration test from a stranger with a GitHub account.

There is no safe harbor for spraying public exploits at random websites.

There is no legal protection for "I was just verifying the vulnerability."

There is no ethical framework where unauthorized prototype pollution is a favor.

But sure.

Thank you for your service.

You found a CVE that was already public.

Using a tool someone else wrote.

Against a target that never authorized you.

And you posted about it on main.

For likes.

Hero.

[Intigriti @intigriti]

Want to quickly scan your codebase for security vulnerabilities? 🤠

Arm recently open-sourced Metis, an open-source, AI-driven tool that uses LLMs to perform deep security code reviews on your codebase.

Unlike traditional SAST tools, Metis can understand contexts and catch complex vulnerability types like logic and design flaws. Plus, it supports C, C++, Python, Rust, and TypeScript out of the box! 😎

Check it out! 👇
https://t.co/X5L95lKYGt

[Server Crew @ServerCrew_AU]

@TheQeye_ @argosaki @CMDRVALTHOR @ElizabethRepp1 @JFKFan12345 @NiclasQSwede @TrumpsManInAust @ShannonCam82757 @SabrinaGal182 @WhiteHouse

[Server Crew @ServerCrew_AU]

@TheQeye_ @argosaki @CMDRVALTHOR @JFKFan12345 @WyattCatarina @TrumpsManInAust @WhiteHouse @ShannonCam82757 @SabrinaGal182 @NiclasQSwede

[Server Crew @ServerCrew_AU]

@TheQeye_ @argosaki @CMDRVALTHOR @ElizabethRepp1 @JFKFan12345 @NiclasQSwede @SabrinaGal182 @ShannonCam82757 @TrumpsManInAust @RussellEldredg1

[Server Crew @ServerCrew_AU]

@NoshrtCutz @TheWarMonitor This is what the rest of the world is saying about the US

[Keith Sakata, MD @KeithSakata]

I’m a psychiatrist.

In 2025, I’ve seen 12 people hospitalized after losing touch with reality because of AI. Online, I’m seeing the same pattern.

Here’s what “AI psychosis” looks like, and why it’s spreading fast: 🧵

[Australia Institute @TheAusInstitute]

"The Defence Housing Authority is a 100% govt owned agency that buys land, builds houses, rents them to soldiers & makes a profit."

"What if we had a Nurse's Housing Authority or a Teacher's Housing Authority? Or just a Housing Authority?"

@RDNS at @CHIA_News Housing Summit

[Server Crew @ServerCrew_AU]

@robertgraham @blackroomsec @Lerg We still have them in Australia and they're great!😛

[Justin Ibarra @br0k3ns0und]

Super excited to finally release a project I have been working on for the last few months!

🎊🎊 Introducing the REx: Rule Explorer project and Detection Engineering Threat Report (DETR) 🎉🎉

https://t.co/kR0KBSWH3M

If you found LoFP from https://t.co/BDnfDwOikI useful, this provides significantly more insights via a much more powerful platform (built on the @elastic stack!)

Happy hunting!

#DetectionEngineering #Security #ThreatHunting

[Server Crew @ServerCrew_AU]

This is horrific. There's no excuse for this.
https://t.co/krvWJYmNrH

[GCHQ @GCHQ]

Calling all teachers! 🙌🏽

We've teamed up with @twinklresources to create a resource for the classroom or at home, inspired by our new book, Puzzles for Spies.

Check it out and get puzzling together ⬇️

https://t.co/GZuZhSlH82

[0xor0ne @0xor0ne]

Cool untroduction series on Linux kernel exploitation by Keith Makan

Debugging: https://t.co/MFkoXhjCXP
Stack overflow: https://t.co/JyCPAttO1V
Privilege escalation: https://t.co/mIdgQs4F0f

#Linux

[Jon Gorenflo 🇺🇦🌻 @flakpaket]

#OSINT Tip:

Did you know you can recover scrubbed metadata from a PDF that wasn't scrubbed properly?

The changes are incremental, and the history is stored in the PDF.

This command removes the "updates" to the PDF metadata:

exiftool -PDF-update:all= file.pdf

[ProjectDiscovery @pdiscoveryio]

Installing all of our open source tools couldn't be easier than with 'pdtm' 🧰

1️⃣ Install pdtm here 👉 https://t.co/p52D5Af83i
2️⃣ Run pdtm
3️⃣ Sit back and watch all of our tools install.
4️⃣ Don't get comfy because it won't take long and there's hacking to do!

#opensource