Founder & CVO @Syhunt, Full-Stack ML/AI @DaragonTechHQ DevSecOps • MLOps • GenAI • #lualang 🦀 #rust #nodejs From Rio 🇧🇷, based in 🇵🇹 • Married
Portugal
Joined March 2009
- Tweets2.4K
- Following1.2K
- Followers1.9K
- Likes3.7K
⚠️ UPDATE: PHP maintainers have verified a separate double-free regression in PHP 8.4.27/8.5.12.
It may be related to the researcher's earlier crash report, but that connection isn't confirmed.
Neither finding establishes that the php2shell patches failed or that RCE is possible.
Repo updated: github.com/php/php-src/issue…
#php #CyberSecurity
⚠️ UPDATE: The researcher reporting a double-free crash on PHP 8.5.12 has clarified that it's unrelated to today's php2shell fixes.
Still worth investigating, but a crash alone doesn't establish remote exploitability or RCE.
We've updated our repo to reflect this clarification.
#PHP #cybersecurity
github.com/syhunt/php2shell-…
⚠️ UPDATE: The researcher reporting a double-free crash on PHP 8.5.12 has clarified that it's unrelated to today's php2shell fixes.
Still worth investigating, but a crash alone doesn't establish remote exploitability or RCE.
We've updated our repo to reflect this clarification.
#PHP #cybersecurity
github.com/syhunt/php2shell-…
As if PHP2Shell wasn't enough for one day... now GitLab. 😅
🚨 CRITICAL GITLAB ALERT (CVSS 10.0)
CVE-2026-110264 could allow unauthenticated RCE on self-managed GitLab servers.
⚠️ Potentially affects 12 years of releases, dating back to 2014.
Patches available. Update immediately!
docs.gitlab.com/releases/pat…
#gitlab #cybersecurity
🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just because you've patched.
#php4shell #php #cybersecurity
xitter.cf/_annieversary/status/2…
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793…
Details at: github.com/syhunt/php2shell-…
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
The PHP 8.5.12 release fixes the two specific CVEs (via state/bailout changes) detailed in official advisories; referenced "surviving paths" (e.g. var_destroy UAF) are separate pre-existing unserialize issues unrelated to this patch.
php.net/archive/2026.p…
github.com/php/php-src/se…
github.com/php/php-src/se…
github.com/dinosn/php-8.5…
Felipe Daragon retweeted
Patch immediately, but continue monitoring emerging research. The reported crash warrants investigation, not a premature declaration that PHP 8.5.12 remains remotely exploitable.
xitter.cf/FelipeDaragon/status/2…
🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just because you've patched.
#php4shell #php #cybersecurity
xitter.cf/_annieversary/status/2…
Felipe Daragon retweeted
claude -p "Rewrite this entire PHP codebase in idiomatic Rust, preserving all existing functionality, APIs, database behavior, and business logic. Analyze the architecture first, migrate systematically, add tests, and ensure the final project compiles and passes all tests. Do not stop until the migration is complete."
Crisis averted. You’re welcome.
Felipe Daragon retweeted
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release.
Please read more about our approach:
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
We've released php2shell-protection, an emergency Apache mitigation and testing toolkit for CVE-2026-109618 / CVE-2026-109619.
⚠️ Not based on official vulnerability details. This is a precautionary measure based on information circulating in the security community and zero-day PoC material we've obtained and reviewed.
It blocks multipart POST requests before they reach PHP. Not a substitute for patching.
github.com/syhunt/php2shell-…
#php #Cybersecurity
🚨 UPDATE: PHP's official advisory confirms the php2shell vulnerabilities and session upload-progress attack path, but not that multipart blocking provides complete protection.
We've updated our repo with official findings and additional hardening measures. Patching remains essential.
github.com/syhunt/php2shell-…
#php #Cybersecurity #php2shell
🚨 UPDATE: PHP's official advisory confirms the php2shell vulnerabilities and session upload-progress attack path, but not that multipart blocking provides complete protection.
We've updated our repo with official findings and additional hardening measures. Patching remains essential.
github.com/syhunt/php2shell-…
#php #Cybersecurity #php2shell
Felipe Daragon retweeted
ありがたい！が、環境によっては注意が必要。
php2shellの暫定策として「multipart/form-dataのPOSTをApacheで止める」ルールを入れるなら、判定をPHPと同じ切り方に揃えないと漏れる。
PHPはContent-Typeを「;」「,」「空白」のどれでも区切り、小文字にしてから multipart/form-data と比べる（main/SAPI.c）。syhunt/php2shell-protection の初版の正規表現はカンマを見ておらず、公開から約2時間後の修正で [;,[:space:]] になった。READMEは効果の限界まで正直に書いてある。使うなら修正後の版を。
自分の環境に当てはめて引っかかったのは3点。
・AllowOverride None だと .htaccess は読まれない。vhostに書く
・ の %{CONTENT_TYPE} はレスポンス側。リクエストは %{HTTP:Content-Type}
・同梱の checkblock.php はHostヘッダ宛にPOSTするので本番に残さない
2件目の根本原因はまだ公式に出ていない。multipart以外の経路があるかは、修正版の差分で確かめてください。
github.com/syhunt/php2shell-…
We've released php2shell-protection, an emergency Apache mitigation and testing toolkit for CVE-2026-109618 / CVE-2026-109619.
⚠️ Not based on official vulnerability details. This is a precautionary measure based on information circulating in the security community and zero-day PoC material we've obtained and reviewed.
It blocks multipart POST requests before they reach PHP. Not a substitute for patching.
github.com/syhunt/php2shell-…
#php #Cybersecurity
Felipe Daragon retweeted
It’s going to be really funny if everyone pointing their LLMs at the PHP codebase tonight finds dozens of OTHER critical vulnerabilities aside from the ones getting fixed tomorrow
Felipe Daragon retweeted
For those mitigating remember this is still primitive mitigations the ultimate is updating as soon as its released. Some parts were Redacted for safety to the ecosystem as a whole. These primitive mitigations still give you a head start on what attackers likely already recreated.