security researcher good guy hacker AI tinkerer OSCP certificate owner ADHD Brain owner https://xitter.cf/t.co/6AvGIhVjFJ
Joined July 2015
- Tweets65.3K
- Following831
- Followers3.6K
- Likes2.4K
Pinned Tweet
Other places to get RedPacket Security updates:
Telegram:
t.me/RedPacketSecurity
Discord:
discord.gg/xZY94PXXs4
Reddit:
reddit.com/r/RedPacketSecuri…
LinkedIn:
linkedin.com/company/redpack…
Mastodon:
mastodon.social/@RedPacketSe…
RedPacket Security retweeted
🤷♂️
1/ We tore apart a #macOS C2 implant that's currently sailing past engines on VT - 0 detections as of today. Shared by @malwrhunterteam.
Written in Zig, and engineered like red-team infrastructure.
Here's what makes it interesting 👇
RT @Scott_Helme: "Sorry we didn't get back to you yet, we've been too busy on Twitter and trying to keep our investors happy"
Unbelievable…
RedPacket Security retweeted
The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously.
I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months.
I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies.
When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack.
The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code.
Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off.
Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions.
A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs.
Here's what this run looked like.
We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.
RedPacket Security retweeted
More private keys by the Indian certificate authority have been discovered. These are all small numbers.
People are suspecting that they interpreted 384 bit keys to mean that they should pick numbers from 1-384 to use as their private keys.
RedPacket Security retweeted
HOLY SHIT: This is huge. Amazon found a PHP2Shell exploit attempt on OCT 17, FOUR DAYS before the AI-discovered vulnerabilities were publicly disclosed.
It hit an AWS honeypot from an anonymized IP. Amazon says it doesn't know how the actor learned about the still-embargoed flaws.
Then Cloudflare watched the explosion:
>10 hours BEFORE disclosure: thousands of attempts
>45 minutes AFTER: tens of thousands
>2 hours AFTER: hundreds of thousands
>Later: MILLIONS
Researchers had spent two months coordinating fixes. Governments took websites offline.
And Censys found ~1.5 MILLION of 2.6 million identified PHP hosts running versions with NO PATCH available for those versions.
RedPacket Security retweeted
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
RedPacket Security retweeted
Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.
foxio.io/blog/header-accordi…
Aaaaaaaaaand this is exactly why monthly patching cycles are dead.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
RedPacket Security retweeted
php2shell の検証ついでに、パッチを追う中で session.upload_progress の filename 注入 + LFI を自分でPoC化してみた！
8.5.4 でも 8.5.12（パッチ版）でも www-data でコマンド実行までいけた
既知の手法で LFI 前提だけど、この経路はパッチ後も塞がってない
#php2shell #PHP #CVE2026109618
RedPacket Security retweeted
Great work by the @TalosSecurity team getting this out quickly! If anything in your business runs on PHP, this is critical info and requires every company to move quickly. The old habit of baking patches into the next general purpose release isn't going to survive the AI era.
Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset blog.talosintelligence.com/t…
RedPacket Security retweeted
BREAKING: US spy agency urged organizations to take websites offline if they cannot immediately fix two serious security flaws in PHP, a programming language behind a large share of the world's websites
insiderpaper.com/nsa-fix-php…
RedPacket Security retweeted
This might be the most watched GitHub Actions build in the history of the platform: github.com/docker-library/ph…
RedPacket Security retweeted
🚨 PHP2Shell may begin with malicious requests that blend into routine scanning, but the activity that follows should be more recognizable.
ReliaQuest assesses that threat actors will use code execution to expand access by spawning shells, running discovery commands, downloading tools, establishing persistence, and moving laterally. This can turn a PHP exploit into broader server compromise, data theft, and operational disruption.
Patching closes the vulnerability but will not remove existing access. Organizations should patch immediately, rotate exposed secrets, and use behavioral detections and retrospective hunting to identify post-exploitation activity.
Read the full assessment:
ow.ly/ySiy50ZZOmA
#ReliaQuest #ThreatResearch #AgenticAI
RedPacket Security retweeted
🚨 Fixes are out for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
Security researchers: If you find affected assets within program scope, submit validated findings with clear evidence and impact.
Details: bit.ly/4z1vVUX
So true
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.