S3cur3Th1sSh1t

Pentesting, scripting, pwning!

[S3cur3Th1sSh1t @ShitSecure]

Input payload obfuscation is a real game changer here. No AMSI or ETW bypass needed and memory scanner evasion 👀

[MSec Operations @MSecOps]

RustPack Release 1.8.0 was shipped to our customers recently. Short Blogpost with the most relevant new features for everyone here 🔥🔥

https://t.co/ufDNFPhaqH

#RedTeam #OST #Pentest #Maldev

[S3cur3Th1sSh1t @ShitSecure]

So much attention though it’s actually very same content to my earlier blog post https://t.co/Hdbo4sQ88t 🤔

[pwnmachine 👾 @princechaddha]

How abliterated models can get you pwned 👾

We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts.

Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.

In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.

[5pider @C5pider]

Looks like @github suspended my account. I haven't used github for anything in the past couple of days.

Great. A bit frustrating. If anyone from the support team sees this my ticket is: #4903946

[S3cur3Th1sSh1t @ShitSecure]

I really like the new SparkDash from @MiaAI_lab 🙂Overall token usage and comparison against frontier cloud models.

[Justin Elze @HackingLZ]

LLMs...Letting me do fun things I never would have wasted time on.

"I reviewed all 30 public GitHub repos for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) by reading code only. The slide has the full
grouped table; the headline findings:

Nothing works against a real target. Every genuine memory-corruption chain is lab-bound: it needs exact per-build offsets, display_errors=On, a single prefork mod_php worker, and a specific image.
Independent reviewers (allureluoli, dinosn, Gi1gamesh123) and the leaked primary source itself all converge on "no public artifact achieves code execution" on the patched core bug. Every real shell
in these repos comes from an app-side LFI or deserialization sink, not the CVE.

Three are original and real, all lab-only. 9bie (the source of the Set-Cookie leak chain), Marven11 (the most sophisticated, a true in-band leak), and Karasawa2025 (whose "Fermat" troll description
hides a working ROP + display_errors=off exploit). These are the only ones with a genuine ASLR-defeating leak primitive that is their own.

Most are copies. One original (9bie) spawned five derivatives:
- twili8 is an outright uncredited rip-off: its own README still says git clone 9bie/... and the Docker files are byte-identical.
- godylockz and xuehuolll are byte-identical to each other.
- dinosn and 3em0 are credited ports that add value.

Three are mislabeled. iQingshan, KarimUD7 (≈98% the same code), and Gi1gamesh123 exploit a different bug entirely (the Calif unserialize var_hash UAF) against their own planted endpoints, filed
under the php2shell CVE numbers.

The rest is noise. The most-starred repo (ikow, 905★) delivers the least: broken or stubbed chains with the two "real" ones paywalled behind Substack. eness (558★) is a leakless forge that can't
defeat ASLR. syrex1013 ships AI-generated fake CVEs in a side directory. Whackermelon hallucinates a non-existent openai/php2shell-checker. lcfr-eth is a parody with a memecoin address, and Icex0
is an empty repo. The genuinely honest work is the crash labs (allureluoli, slabbdev, 0x4148), which prove the bug without claiming RCE.

The ASLR column, star counts, copy lineage, and the specific "tell" for each repo are all in the table. The page is private to your account; use the Share menu if you want to send it to the team"

[RedTeam Pentesting @RedTeamPT]

🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!

Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀

[S3cur3Th1sSh1t @ShitSecure]

@mrgretzky Good vibe code 1o1’s. Had the same experiences this year.

[S3cur3Th1sSh1t @ShitSecure]

@mrgretzky 🤣

[S3cur3Th1sSh1t @ShitSecure]

@Void_Sec Closed Source is the new Open Source in 2026

[S3cur3Th1sSh1t @ShitSecure]

@mrgretzky @x33fcon Both highest stats nice 🔥

[S3cur3Th1sSh1t @ShitSecure]

@eversinc33 That was created by my locally hosted Minimax H3 :-)

[S3cur3Th1sSh1t @ShitSecure]

Input payload obfuscation is a real game changer here. No AMSI or ETW bypass needed and memory scanner evasion 👀

[MSec Operations @MSecOps]

RustPack Release 1.8.0 was shipped to our customers recently. Short Blogpost with the most relevant new features for everyone here 🔥🔥

https://t.co/ufDNFPhaqH

#RedTeam #OST #Pentest #Maldev

[MSec Operations @MSecOps]

RustPack Release 1.8.0 was shipped to our customers recently. Short Blogpost with the most relevant new features for everyone here 🔥🔥

https://t.co/ufDNFPhaqH

#RedTeam #OST #Pentest #Maldev

[S3cur3Th1sSh1t @ShitSecure]

@Jean_Maes_1994 @grok Well for offensive security tasks people need to fall back to opus 4.6 depending on the task. Models that run on the sparks are similar to opus 4.8 on benchmarks. Frontier in general vs frontier in maldev for example is not the same. 🤷‍♂️

[S3cur3Th1sSh1t @ShitSecure]

@Jean_Maes_1994 @grok Definitely depends on the use cases true 👍

[S3cur3Th1sSh1t @ShitSecure]

@decoder_it Exactly this is what Claude implemented got me this year in an internal WebApp. Even Opus. 🤷‍♂️ if the prompt didn’t mention server side validation why should it.

[S3cur3Th1sSh1t @ShitSecure]

When your only authorization is JavaScript client side. And you can make yourself admin in 20 minutes. Than you know this was vibe coded. What is happening in 2026? 🤣

[S3cur3Th1sSh1t @ShitSecure]

Doing an WebApp Pentest today. And this WebApp is 95% likely fully vibe coded. Authorization issues everywhere. Logical issues everywhere. Its like an CTF. And big consulting company likely won a tender because of lowest price. Happy birthday the next years will be great! 🫡🤪

[S3cur3Th1sSh1t @ShitSecure]

@NinjaParanoid Yup that is what’s happening. Would have never expected that one year ago 😂

[S3cur3Th1sSh1t @ShitSecure]

Doing an WebApp Pentest today. And this WebApp is 95% likely fully vibe coded. Authorization issues everywhere. Logical issues everywhere. Its like an CTF. And big consulting company likely won a tender because of lowest price. Happy birthday the next years will be great! 🫡🤪