The Magic You're looking for is in the work you're avoiding
Joined April 2020
- Tweets16K
- Following637
- Followers474
- Likes43.5K
~/.Humay0on retweeted
Since the @Apple Bug Bounty Program is by far the worst program I've ever hacked on, I am going to be dumping all of the data/POCs/report write ups etc for everything found during the 4 months of hacking them. This will include POCs for vulns that didnt meet their bar for a bounty so wasnt reported to them, so you may be able to find ways to escalate some of them. Ill be uploading the data all this weekend.
~/.Humay0on retweeted
⚠️php2shell (CVE-2026-109618 and CVE-2026-109619): we’re seeing “P2SB” multipart probes hitting our Palo Alto GlobalProtect honeypots.
The requests carry a PHP_SESSION_UPLOAD_PROGRESS marker (“p2s-rider”) and a dummy file upload with no payload, which points to someone checking for the vulnerable upload-progress behavior and likely building a target list of Palo Alto devices.
Source is a known mass-exploit IP: 204.76.203.]7 (AS51396 Pfcloud UG, NL)
Track php2shell exploitation on Defused 👉 console.defusedcyber.com/sig…
~/.Humay0on retweeted
You made me buy a HTB subscription... Tenet pwned with php2shell
Completely agree here - You should patch PHP but the sky is not falling yet. The issue here is going to be all the IOT Crap that just does not ever get updated. There still is time to patch.
If you want to see the state of things, find a cyber range (I prefer HackTheBox). Go look for a bunch of old PHP Boxes and try the exploit out on them. Right now I think you are going to have a tough time finding a retired box that you can exploit with PHP2SHELL.... Atleast I hope you do because I am having a hell of a time doing it and both love/hate to learn how much of a noob I am at times.
AI is really good at making crap look good. I know the POC that shows a POC of <?php echo("OK") ?> being exploited sounds scary. But when you look deeper there are a lot of hard-coded offsets that make it only work on that target.
~/.Humay0on retweeted
🚨 Yesterday, PHP2Shell made headlines. Today, we're already teaching you how to exploit it. Yeah, we're THAT fast⚡ Two critical PHP vulnerabilities. 9.2 CVSS. Unauthenticated RCE.
And you can already exploit the chain, bypass ASLR, and pop a shell in our latest recent threat room.
Hackers don't wait. Neither do we 🟢 Go Get hands-on: tryhackme.com/room/cvephp2sh…
~/.Humay0on retweeted
Look at how the blue changes color depending on the lighting. The environment can make it from navy blue to almost metallic blue, it's perfect!
~/.Humay0on retweeted
Just to be clear, I am not leaving The Batman Part II. I am profoundly grateful to Steven for coming to my aid during this challenging time to help me finish principal photography. Thank you to all for your concern and well wishes. 🦇
~/.Humay0on retweeted
Not making the lenses reflective and instead making them translucent was the best decision they made with this mask
