Dominic White 👾

Hacker @sensepost

[Dominic White 👾 @singe]

Earlier this week I gave a talk to our internal hacking teams about the difference between good hackers and great ones that have been able to impact our field. I included three extended quotes - two from writers and one from Hamming that influenced my approach early on. Maybe some of it is useful for you.

[Matt Johansen @mattjay]

I've led vulnerability management for some very large companies. I've been in the trusted embargo 0day info sharing rooms.

I think it would be negligent at this point to assume that they will be the norm moving forward.

We can't expect to get a nice coordinated vuln announcement and patch handed to us in private with weeks to handle it.

We need layers of defense so 0days in internet facing devices won't be catastrophic. We need machine speed detections and response.

And of course we need to figure out the new norm of how we handle 0days in hours not days. This will take agents and harnesses you might not have yet.

A lot of this has been true for a while, but you could get away with handling in fire drill mode when happened and put off the actual engineering.

As people are saying, the interest rates on security tech debt just skyrocketed.

[Dominic White 👾 @singe]

Yes - less manhattan project and more making the world a better place please.

[Dominic Chell 👻 @domchell]

With the AI companies hiring all these amazing VR folks and giving them capabilities that 10xs their talent, it’s really no surprise we’re starting to see a vulnpocalypse.

I’d personally like to see them hire more of the world’s best cancer or Alzheimer’s researchers.

[Dominic Chell 👻 @domchell]

With the AI companies hiring all these amazing VR folks and giving them capabilities that 10xs their talent, it’s really no surprise we’re starting to see a vulnpocalypse.

I’d personally like to see them hire more of the world’s best cancer or Alzheimer’s researchers.

[Theorem @theoremlabs]

What would it take to formally verify all the software a real system runs on?

We modeled one ecosystem: nixpkgs, with 28,650 packages and 154 GB of machine code.

https://t.co/YdAXLVM0X3

[Dominic White 👾 @singe]

In an hour @leonjza & @watchtowrcyber will be going through the state of exploitation and defense for the PHP bug on a webinar. Free but needs a reg tho https://t.co/5HgFMEIhvy

[Dominic White 👾 @singe]

@caseyjohnellis I’m genuinely surprised we didn’t see another round of “lol, canaries”

[Dominic White 👾 @singe]

Honestly, yesterday's PHP vuln chaos wasn't that different from what we've seen in the past. The classic "it's coming get ready" race to reproduce coupled with the classic misleading noise from the discussion feels pretty familiar. Humans make it messy.

[Dominic White 👾 @singe]

@Conspologist Yep. Server is dead, and you can’t put up a replacement because of the TLS validation. Now you can.

[Dominic White 👾 @singe]

eMudhra has two interesting implications for me beyond the obvious browser trust issues.

I'm excited for the opportunities to liberate closed hardware this provides. We know hardware, particularly abandoned IoT devices are unlikely to be updating their revocation lists and root CAs. This means we can potentially intercept previously encrypted comms, or sign previously protected firmware.

I'm also interested in how well the revocation works at a WiFi supplicant level. Rogue RADIUS servers (mana, wpe, eaphammer) can now use validly* signed chains for forged leafs with TLS protected EAP modes. I'm not sure how well the revocations work in that world given the difference in the CA trust model in use there.

[Dino A. Dai Zovi @dinodaizovi]

It's still attack surface reduction if you are separating functionality implementation by security boundaries. For example, a monolithic service is more space for a vulnerability that compromises its entire database. An ingress-style reverse proxy partitions that attack surface across multiple services. The more sensitive the functionality, the smaller the service should be and furthest down the service call tree.

[Florian Roth ⚡️ @cyb3rops]

This week has been quite a shitshow already, and there are still 2 days to go

Here’s a quick recap of the security mess we’ve seen in just the last few days:

1. PHP Core RCE (CVSS 9.2)

Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…

Useful links:

Official PHP advisory and patches:
https://t.co/XOos2fsRoy

Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
https://t.co/30YfHmqIcR

Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
https://t.co/XLx8za50cZ

Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
https://t.co/5HdgI3aM0f

Corelight’s open-source Zeek and Suricata detection rules:
https://t.co/eQdkc3vIpM

2. GitLab RCE (CVSS 10.0)

CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.

https://t.co/APW5ihIOZ0

3. Node.js / Brotli RCE

CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.

https://t.co/RUFjjKtfPE

4. DNS-over-QUIC DoS

CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.

https://t.co/DxaIsMF2ZP

5. eMudhra CA disaster

And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.

Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.

Google’s analysis and response:
https://t.co/gvfGdOBibg

Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
https://t.co/K2wxEOneGJ

—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.

We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.

I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.

The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.

Anyway, quite a week. And it’s only Thursday…

[Dominic White 👾 @singe]

@viperbjk Genuinely asking? I know RADIUS better than IoT

[Dominic White 👾 @singe]

@viperbjk Two of the ints are code signing certs. Why not firmware - because it doesn’t usually use CA trust or something else?

[Dominic White 👾 @singe]

I used the ints at https://t.co/WnEG7jmzhR

[Dominic White 👾 @singe]

Added support for the compromised eMudhra intermediaries to gopostille. It'll let you create a validly signed certificate chain for a clone leaf cert in places that haven't revoked them. 1/2

[Dominic White 👾 @singe]

2/2 I've hidden it in a feature branch, and likely won't put it in main. You an grab it here https://t.co/n6Fhexblpq

[Dominic White 👾 @singe]

If you’d like to help test

[Dominic White 👾 @singe]

Added support for the compromised eMudhra intermediaries to gopostille. It'll let you create a validly signed certificate chain for a clone leaf cert in places that haven't revoked them. 1/2

[Justin Elze @HackingLZ]

Something that gets lost in all these conversations is that there were years when a major 0day would drop and technical details were almost impossible to come by. Multiple people here would stay up for days reverse engineering the issue and stitching together a working PoC, not just to prove exploitation was possible, but to help defenders understand the actual risk, develop IoCs, build detections, and clean up compromised environments.

[Dominic White 👾 @singe]

I think it's less about people encrypting with those certs, and more about chain validation not correctly revoking both the intermediary and roots. Even if the leaf is signed with a wholly different CA and intermediary, if the trust validation is just "valid CA path" with non-updated certs, you're golden.