@TechEmiiily 💍 | Sup Earth! | #OSCP | break shit | Cloud Red Team Lead | Co-Inventor of Axiom | nmap -p- {always} | he/him
Joined February 2015
- Tweets6K
- Following2K
- Followers4.7K
- Likes12.3K
Octavian retweeted
🚨 Brotli2Shell goes beyond HTTP2Shell.
CVE-2026-111497 is a CVSS 9.2 out-of-bounds write in Google’s Brotli decoder that has been exploited for RCE and impacts far beyond HTTP.
JFrog reproduced RIP control in FFmpeg via a crafted JPEG XL file and identified additional attack paths in ClickHouse, .NET, and Apache Arrow, where some fixes were still unavailable at the time of writing.
We’ve also released an open-source scanner to uncover potential exposure beyond vulnerable package versions.
Full research and technical details in our blog 👇
Octavian retweeted
Feeling super euphoric rn lol
I explicitly decided to avoid sharing that post because it's written in an extremely weird way. The article is basically a giant non-sequitur. It starts with "we saw a proof of concept" then immediately jumps into "agentic AI post-exploitation", without making any claim that A led to B.
It's a very strange structure for a threat intelligence report, and none of the segments of the article logical follow each other. I tried asking for clarification about what/why that is, but the response I got was extremely cagy, so I didn't feel comfortable risking my reputation on it.
Octavian retweeted
This is the closest I've seen to a realistic public Node.js/Express 🥦 Brotli exploit.
No fake RCE. Author is honest about what works and what doesn't. Even with non-PIE, heap layout, multiple arenas remain obstacles. ☝️ However...
github.com/Arkango/CVE-2026-…
Octavian retweeted
An update to our threat brief on PHP CVE-2026-109618 & CVE-2026-109619: We observed an attack using agentic AI platforms for rapid post-exploitation and access to MFA secrets within 2 hours. Read the updated brief for analysis and hunting queries: bit.ly/4z7Txr2
Octavian retweeted
🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European government entity in just 2 hours.
That's not all.
→ Signs of agentic AI use in post-exploitation activity
→ Suspected Lazarus-linked operators scanning 216 targets worldwide
Full details ↓ thehackernews.com/2026/10/ph…
Octavian retweeted
StealMyBitcoin is solved! This is the absolute best explanation you’ll see on how hard #php2shell is to exploit. The author had to trigger a precise memory corruption condition, leak internal memory addresses, bypass aslr, reverse engineer php’s internal memory structures, forge structures to hijack execution, and account for php build differences, worker behavior and timing to get RCE. 20 http requests with a 7 out of 10 success rate. What an amazingly successful CTF. Impressive the creator was able to keep the server up during all the attempts. With all the BS around it’s nice to see something concrete that moves the art forward.
github.com/KillaBoi/StealMyB…
Love this. The💰is still in the wallet. Finally we get some ground truth around how hard php2shell is to exploit. The amount of bullshit flying around from vendors capitalizing on the moment is staggering, And the alert fatigue they’re creating is really going to hurt when a mass exploitable RCE emerges. We still haven’t seen a production site hacked via #php2shell at Wordfence.
Octavian retweeted
Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).
Check out their awesome writeup here: github.com/KillaBoi/StealMyB…
Octavian retweeted
the stealmybitcoin[.]com (php2shell) challenge is shit, and everyone already predisposed to dismissing ai's cyber capabilities is jumping on the bandwagon to call the bug unexploitable and overhyped.
like bro, did you even try to solve it?
i think the challenge can be solved in under five hours. whoever made stealmybitcoin just slopped it up like crazy, wasting an insane amount of people's time and tokens because of their sloppiness.
just from a blackbox perspective, for the first ~10 hours, they seemed to be serving something like index.html through a wildly uncommon setup:
nginx -> proxy_pass -> php -S -> index.html
if you look at the PHP CLI server code, without a router, it doesn't even initialize php for static files, so you can't trigger the vulnerable multipart parser in the first place.
after @LiveOverflow called this out, they updated the server to expose an actual PHP endpoint:
stealmybitcoin.com/php-versi…
this is still a crazy setup, running php's single-threaded development server behind nginx, but apparently the exploit works reliably now.
except everyone who wanted to prove php2shell was fake made the challenge go viral, and the server basically got dosed by everyone else who want to solve. now you can barely even make a request to it.
Octavian retweeted
stealmybitcoin was just solved by @killa. Or rather solved a few hours ago. He was confused because the wallet address was wrong. Turns out the server didn't have the right wallet :P
I took a closer look at the stealmybitcoin.com CTF, which aims to demonstrate that PHP2SHELL is not realistically exploitable. So I gave it a try.
Note: My analysis could be wrong, and I'm more than happy to be proven otherwise.
Here’s what I found:
• The server responds with Server: nginx and X-Powered-By: PHP/8.4.26.
• My differential fingerprinting scanner independently confirmed at least PHP 8.2+
• Hypotheses: I considered two possible setups:
◦ nginx → PHP-FPM
◦ nginx → Apache → PHP-FPM/mod_php
• After comparing the server's behavior against local test environments, the closest match appears to be nginx → PHP cli-server.
Plot twist: the response behavior is consistent with the PHP cli-server serving a static index.html rather than an index.php. If that's indeed the case, the challenge appears to be intentionally made unexploitable.
My conclusion (for now) is that I'm questioning whether this is a good-faith challenge.
Happy to be corrected if I've missed something!
Octavian retweeted
github.com/ACD421/PHP Sooooo many vulns
@J4ck3LSyN @Archknight23
This is a credit theft attempt dressed up as process.
I found the bug. I put the work on a public GitHub. PHP security wrote me back and @IlijaTovilo admitted the PoC is based on my finding.
Then he said the person who refiled it through security@ / GHSA "will get the credit … because that's how it works."
That is a lie about CVE rules.
CVE CNA Operational Rules §5.2.4: credits are optional (MAY). Nothing says the inbox refiler gets finder credit and the person who identified the vulnerability is erased.
The CVE Record Format separates finder (identifies the vulnerability) from reporter (notifies the vendor/CNA). Those are different roles.
CVE-2026-115560 is still Reserved. The record is not published yet. They are deciding credit now, in email, against their own admission.
Same thread, he accused me of "potentially 0-daying the entire world" and "giving the recipe to every person on the planet." Then he moves to strip finder credit from the person whose work he just admitted using.
Video is the full chain. Watch it. Do not take my word. Take theirs. We won't get credit. We won't get thanked. We won't get paid. PHP has been lying to you all and its time we hold them accountable. Stop using PHP. Find something new. Get rid of tech debt and bad security teams.
@WIRED @TechCrunch @DarkReading @SecurityWeek @motherboard @KimZetter @josephmenn @MITREcorp @TheRecord_Media @IlijaTovilo @ThePHPF @official_php @CVEnew @CISAgov @TheHackersNews @arstechnica @briankrebs @BleepinComputer @troyhunt @SwiftOnSecurity @campuscodi @TheRegister @Girgias
#CVE #CVE2026115560 #PHP #PHPsec #OffSec #FullDisclosure #PublicDisclosure #HackThePlanet #BugBounty #InfoSec #CyberSecurity #SecurityResearch #CreditWhereItsDue #OpenSourceSecurity #GitHub
Octavian retweeted
High fidelity detection mechanism for node2shell (CVE-2026-111497)
github.com/assetnote/node2sh…
Octavian retweeted
🥦 Broccoli / CVE-2026-111497
Patched Node.js Docker images can still ship a vulnerable system Brotli (Debian 1.0.9-2+b6).
Updating Node doesn't fix the system library.
For example, curl --compressed triggers the vulnerable decoder on malicious http responses.
Patch both!
Octavian retweeted
I took a closer look at the stealmybitcoin.com CTF, which aims to demonstrate that PHP2SHELL is not realistically exploitable. So I gave it a try.
Note: My analysis could be wrong, and I'm more than happy to be proven otherwise.
Here’s what I found:
• The server responds with Server: nginx and X-Powered-By: PHP/8.4.26.
• My differential fingerprinting scanner independently confirmed at least PHP 8.2+
• Hypotheses: I considered two possible setups:
◦ nginx → PHP-FPM
◦ nginx → Apache → PHP-FPM/mod_php
• After comparing the server's behavior against local test environments, the closest match appears to be nginx → PHP cli-server.
Plot twist: the response behavior is consistent with the PHP cli-server serving a static index.html rather than an index.php. If that's indeed the case, the challenge appears to be intentionally made unexploitable.
My conclusion (for now) is that I'm questioning whether this is a good-faith challenge.
Happy to be corrected if I've missed something!
Octavian retweeted
Just found a zero day
If you right click on an executable on Windows, select run as administrator, it will run as administrator
I'm calling it Program2Shell
Octavian retweeted
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
Readers added context they thought people might want to know
The Tailscale SSH findings require prior authorized access on the tailnet per the researcher's report; Tailscale stated issues concern post-authorization behavior only and did not recommend disabling SSH for everyone.
tailworm.com
x.com/IntCyberDigest…
Octavian retweeted
We have completed our investigation into the attack chain behind the v1.107.0 release. Read it here: docs.litellm.ai/blog/securit…
Octavian retweeted
How exploitable is the recent Broccoli 🥦 vulnerability (CVE-2026-111497)?
We went beyond reproducing memory corruption and demonstrated a control-flow hijack.
Not a realistic RCE exploit, but definitely not just a crash.
Here's what we found. 🧵
Octavian retweeted
A hacker stole data from the Pentagon, Europol and 40+ companies, built one of the dark web’s biggest stolen data marketplaces, and was eventually caught after accepting a $250 payment in Bitcoin.
> Kai West, better known online as IntelBroker, was accused of running a major stolen-data marketplace on the dark web.
> His alleged victims included Apple, AMD, Cisco, Nokia, General Electric and Europol.
> The operation was also linked to claims involving sensitive US government data, including information about members of Congress.
> For years, IntelBroker operated under a pseudonym, selling stolen data while trying to keep his real identity hidden.
> He reportedly preferred Monero, a cryptocurrency designed to make transactions harder to trace.
> Then came a $250 deal.
> In January 2023, an FBI agent allegedly persuaded him to accept Bitcoin for a purchase of stolen data.
> That payment became a crucial lead in the investigation.
> Investigators spent years connecting online accounts, cryptocurrency activity and other digital evidence to identify the person behind the alias.
> In January 2025, IntelBroker announced he was stepping away from the forum he had been running.
> Three weeks later, French authorities arrested him.
> The case involved allegations of MILLIONS of dollars in damage and attacks affecting dozens of organizations.
> He allegedly spent years hiding behind an online identity, only for one transaction to help investigators close in on him.
The hacker who relied on crypto to hide his tracks may have made one of his biggest mistakes by accepting a different coin.
