vortex

information security - bug bounty - motorsport - karting - memes - shitposts

[vortex @vortexau]

🦋at https://t.co/wPAKd6J1lV
come say hello :)

[freakyclown @_Freakyclown_]

If you post your full private CA cert key, Twitter will censor it.

*

See?

[vortex @vortexau]

It's not over yet folks! 😭😭

[The PHP Foundation @ThePHPF]

Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc

[The PHP Foundation @ThePHPF]

Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc

[vortex @vortexau]

@Zaddyzaddy @BugBunny_ai I don't know anyone on CVP RT. None.
I know one on the CVP Specific Access program, but they're at a global consultancy - so if that's the level required, the rest of us are truly out of luck!

[探姬 | Hello-CTF 🚩 @ProbiusOfficial]

php2shell稳定利用：
https://t.co/uRz4M2a2DZ

[vortex @vortexau]

@galnagli In hindsight, yes. However two days ago, it didn't seem like it would be that way.
And I'm certain there are more log4shell type bugs coming.

[HackerOne @Hacker0x01]

All known vulnerable PHP instances in HackerOne-operated infrastructure are now patched. Spot something we missed? With our patching window complete, findings are now in scope for our bounty program: https://t.co/jt1dFrigmT

[vortex @vortexau]

@z0idsec Hell even my private nuclei templates don't find anything interesting and I know I've got stuff no one else has 😂
So much so I just straight up turned off my nuclei automation.

[vortex @vortexau]

@mdp_sec It's funny. I got invited to CLEAR last year even though I didn't meet the requirements. No one at H1 reached out to tell me!
I was busy and mostly inactive in hunting at the time, so didn't do much.
The badge came up for renewal and I was confused when I was ineligible for it 😂

[PHP CEO @PHP_CEO]

IS THE WEBSITE DOWN FOR ANYONE ELSE?

[Dwayne @CtrlAltDwayne]

Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish?

Expert: No, software is constantly evolving.

Philomena: So they've been writing the same website for 20 years?

Expert: No, different projects.

Philomena: Have they tried finishing one before starting another?

Expert: That's not how software development works.

Philomena: My mate Paul spent 20 years building a shed. Turned out he was just an alcoholic.

Expert: Right.

Philomena: Is PHP like that?

[vortex @vortexau]

@NahamSec Nahamsec is back!

[Juliano Rizzo @julianor]

Brotli CVE-2026-111497 goes well beyond Node.js.
Quick search shows unpatched Brotli decoders in Java HTTP stacks, WOFF2 libs, CF workerd.
TLS certificate compression (RFC 8879) is another attack surface worth investigating.

Check statically linked Brotli copies.

[vortex @vortexau]

https://t.co/EAlGwLAbsv

[cje @caseyjohnellis]

- “no-one would do that”
- “but that’s illegal”

[vortex @vortexau]

I'm not convinced of 'vulnzero' in 18 months.

A significantly better and more secure base?
Absolutely.

Zero vulns?
Unlikely.

There will always be many orgs that play down security because it's primarily a cost centre.

Interesting to see how this all plays out though!

[Jason D. Clinton 🔸 @JasonDClinton]

@RothRottweiler vulnzero. the scaling laws will have driven cyber mythos-class capabilities into small, cheap models and all software dev everywhere will be using models for fractions of pennies on the dollar to stop shipping security bugs permanently.

[vortex @vortexau]

@VaultPrivSec Cool idea! Seeing the data flows visually would make the concept much easier to understand.

[Thomas Unise @thomasunise]

We’re about to learn that most code written over the last 20 years was complete slop and most software developers were never that good

[vortex @vortexau]

@troyhunt @Tr3s0r @eMudhra Not to defend them, but there was a lot of commentary that was racist towards them, rather than sticking to technical discussion.
I'm not entirely surprised they locked comments.

[vortex @vortexau]

@mdp_sec I found out a friend today actually has Specialised Access, and was running deep testing with Opus 5.5, almost no refusals.

They work at a large global consultancy though, so that probably means that level of access is impossible for the rest of us 😂😂

[vortex @vortexau]

@_sarahyo Not that I can recall either. I think it's a good sign, usually marketing or sales would overrule on something like that!