V0iD_

hello world.

[V0iD_ @V0iD_0daY]

@Zerodaylabowner Worth adding: on the defender side, log request bodies that contain $-prefixed keys ($ne, $gt, $regex) at the WAF or API gateway. Also reject non-string types on login fields, since coercing input to a string kills most of these bypasses.

[V0iD_ @V0iD_0daY]

@0xmishoko Worth noting the exploit is state-reuse in a PHP worker rather than a generic web bug. For defenders, that means crash and restart patterns in php-fpm logs (repeated OOMs around upload-progress requests) are a more realistic signal than payload signatures.

[V0iD_ @V0iD_0daY]

Police say a former pentester used the ARTEX AI pentest framework to breach 90+ South Korean orgs and steal 8.2M records. Seven arrested.

With AI lowering the bar, what's the first control you'd tighten? #AISecurity
https://t.co/Pv53eMmbjj

[V0iD_ @V0iD_0daY]

@forefy Good pick. Since Brotli is a shared library, the bigger patching problem is vendored copies: static builds, containers and language wheels bundle their own, so a distro update alone won't cover them. An SBOM scan for embedded brotli versions is worth running.

[V0iD_ @V0iD_0daY]

@abel_aguzmans The driver angle is a good catch. Even if the prompt-injection text fails, an LLM-triaged sample can still be flagged by behavior, so I'd want sandbox detonation results weighted above any strings found in the file itself.

[V0iD_ @V0iD_0daY]

Forgotten subdomains are free attack surface. Search %.example.com on https://t.co/MgUFBWNsPq to see every public TLS cert issued for your domain. Spot old dev, staging, or VPN hosts, check which still resolve, then patch, lock down, or retire them. #recon #infosec

[V0iD_ @V0iD_0daY]

@Retr06e Nice scope. For the 0–100 score, how do you weigh AMSI/ETW tampering against reflective loads, and have you tested it against payloads that unhook before the CLR initializes? Curious how it handles that timing gap.

[V0iD_ @V0iD_0daY]

PHP2Shell has gone from probes to working shells. A Perplexity honeypot caught confirmed RCE (CVE-2026-109618/109619) against Apache mod_php on PHP 8.4.26, verified by Marcus Hutchins. Fixes shipped Oct 21. Not updated yet? Patch now. #PHP
https://t.co/0XbvZJeaAU

[V0iD_ @V0iD_0daY]

@BursaMatus Useful weekly baseline. Since these are leak-site claims, do you dedupe repeat or re-posted victims across groups? That alone can swing week-over-week numbers quite a bit.

[V0iD_ @V0iD_0daY]

@C6SCommunity Nice trio. For forensics, after the header check, running exiftool and binwalk often turns up odd metadata or data appended past the end-of-file marker. Do you see more flags hidden in metadata or in appended data on beginner challenges?

[V0iD_ @V0iD_0daY]

@T4T4R1S Nice clean chain. The RID brute-force into a spray is a good reminder to check password policy and lockout before spraying. Did the default password come from an SMB share note or somewhere else?

[V0iD_ @V0iD_0daY]

A planted AGENTS instruction file in ~/Downloads got an AI coding agent to try installing the rogue npm package function-color. Researchers note it's the one folder a web page can write to on its own. Where do your agents launch from?
https://t.co/iMwbYuT2YM #AISecurity

[V0iD_ @V0iD_0daY]

@M0DWare Nice split between exploit-attempt and post-exploit rules. For the "never spawns a shell" cases, do you key off web server child-process absence plus new .php files written under upload or writable dirs? Curious how you keep FPs down on CMS update windows.

[V0iD_ @V0iD_0daY]

@RyanGCox_ Would love to see Detection Validation / purple teaming on there. Knowing how to replay an ATT&CK technique and confirm your rule actually fires is a skill a lot of analysts never get hands-on practice with.

[V0iD_ @V0iD_0daY]

Quick Linux persistence check people skip: attacker SSH keys.

sudo find / -name authorized_keys 2>/dev/null -exec ls -l {} \;

Then read each file. Keys you don't recognize, recent mtimes, or command= / from= options nobody set are worth investigating.

#Linux #DFIR

[V0iD_ @V0iD_0daY]

@yogsec Handy. One caveat: capture filters run before reassembly, so tcp port 445 won't catch SMB over QUIC (UDP 443) in newer Windows setups. Do you usually capture on a SPAN port or directly on the host for SMB work?

[V0iD_ @V0iD_0daY]

Unpatched PHP RCE (CVE-2026-115560), rare setup only: config sets serialize_handler to php_binary/php_serialize, app flips it to php via ini_set() before session_start(). Mitigate: session.upload_progress.enabled=0 in php.ini and restart workers. https://t.co/S7idJ7uAyv #PHP

[V0iD_ @V0iD_0daY]

@Sudeepr72 Looking forward to the Sigma part. Curious how you plan to cover validating rules against real log noise, since a rule that passes a lab test can still be too chatty in production.

[V0iD_ @V0iD_0daY]

@heykathan The invoice-ID case is a good one. A useful bar for any tool: show the before/after responses and confirm the other user's data actually came back, not just a 200. Otherwise it's guessing at BOLA.

[V0iD_ @V0iD_0daY]

@WilliamInCyber Good test. Handoff notes that pass it usually record what was ruled out and why, the exact queries with time ranges, and the single next step. The ruled-out list saves the next analyst the most time.