Security Research | Red Team | PenTesting | Reversing | DFIR | CEO of SwiftyNet Firewalls | DC34 ManPages Contest Winner | Views are my own.
Joined January 2020
- Tweets3.2K
- Following347
- Followers1.3K
- Likes4K
Pinned Tweet
The Part 2 article is now up (link below). It shows using the exploit we examined in Part 1 to target Chrome and other adjacent processes to pull interesting artifacts out of memory.
medium.com/@andy99998/using-…
'No Mallace'
Fancy naming the UK's first ever space debris removal mission?
Enter our competition to get your name on the spacecraft!
Our Active Debris Removal Mission, led by @ClearSpaceToday will remove two defunct satellites from orbit. 🛰️
Learn more and enter 👉 space.blog.gov.uk/2026/10/15…
ALT An artist illustration of ClearSpace's UK ADR mission. Credit: ClearSpace
wiz.io/blog/artex-in-the-wil…
I have seen a few cases related to this sort of attack recently. AWS Cognito is all well and good but seems to be to a hotbed for misconfigurations atm.
If you are getting an API pentested, worth thinking about linking that with a review of backend environment and whatever is handling your auth as well if you want to understand the full potential of an attack path.
Andy Swift retweeted
Once again, a hack starting with social engineering (interview / recruitment pretext) to convince a target to download malicious tools or steal credentials is used to kick off a major attack chain.
This time 6+ billion (yep with a B) was stolen.
So this is quite funny. Its data taken from one of our TI platforms. 12 Ransomware victims but known exploited vulns ...only 2....from 2023 and 2024.
I guess the point is...in spite of all the wave of new cluster fuckery, people still get popped by old stuff all the darn time.
OI HACKERS...you aint getting hold of our fridges, we got this dude armed with a very real and dangerous rifle.
This is a tad over the top saying Europe is under attack...but...honestly get ya flippin fridges off the Internet ya fruit cakes.
Andy Swift retweeted
Spotify: open.spotify.com/show/3PeV2F…
Apple Podcasts: podcasts.apple.com/us/podcas…
Amazon Music: music.amazon.com/podcasts/cf…
YouTube: youtube.com/channel/UC5L2Q76…
Andy Swift retweeted
Episode 48: Citrix, Cloudflare, and Credential Chaos!
@0xTib3rius & @SwiftSecur1 chat about a bunch of small topics, from Citrix bugs, to passkeys, to whether Cloudflare is actually just a huge MiTM attack.
Links below!
Andy Swift retweeted
Hello, Little People Living Inside Of My Computer,
I have made my second ever YouTube video briefly discussing the Chinese government trying to compromise companies in Malaysia.
It was fun.
youtu.be/ZcsVsr4rpgs
I shall be doing this today, let's spread the word and make this national early grey day.
#earlgreyhot
And for those not familiar with tea making...you got to try earl grey loose leaf made properly!
theteamakers.co.uk/blogs/how…
Transport tycoon was one of my first binge games. You can still download openttd today btw....great to see it still maintained!!
Here's an almost impossible question: What's the best game ever made by MicroProse?
Silent Service (1985)
Gunship (1986)
Pirates! (1987)
Airborne Ranger (1987)
F-19 Stealth Fighter (1988)
Red Storm Rising (1988)
M1 Tank Platoon (1989)
F-15 Strike Eagle II (1989)
Railroad Tycoon (1990)
Silent Service II (1990)
Knights of the Sky (1990)
Civilization (1991)
Gunship 2000 (1991)
Darklands (1992)
Master of Orion (1993)
X-COM: UFO Defense (1994)
Master of Magic (1994)
Colonization (1994)
Transport Tycoon (1994)
Civilization II (1996)
Master of Orion II (1996)
Grand Prix 2 (1996)
Falcon 4.0 (1998)
Alpha Centauri (1999)
RollerCoaster Tycoon (1999)
B-17 Flying Fortress (2000)
Note: That's just a selection... they created even more than that.
I now don't feel quite so much like I'm missing out, but still...
Current information I have on php2Shell:
- The RCEs requires the attacker to obtain memory addresses which are typically protected by ASLR.
- I suspect the original author (lcfr_hax) likely has a reliable exploit which leads to stable code execution.
- Most of the PoCs being posted are completely non-functional AI slop.
- There is at least 1 working non-slop exploit being passed around, but it's reliant on bruteforcing for ASLR bypass, so not particularly impactful.
- Rumor of ITW exploitation are patchy. There are attempts being seen using the non-functional leaked RCE, or variants that are config / system specific.
- Some rumors point towards a known-working exploit being used by threat actors (I've personally confirmed this specific exploit works, but the ASLR bypass technique is unreliable at best and massively limits the potential impact).
- I'd expect heavy ITW exploitation in the next few weeks based on how many people are looking at this. Though, success rates will vary heavily based on the specific exploit chain.
Lol
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
Unvalidated AI output (author admits in replies: omp with glm5.3 + ds4), not a lab result. Its screenshot says both CVEs are fixed; the 'surviving paths' need unserialize() of attacker data or an app LFI. Patch per php.net: php.net/archive/2026.p…