@_CryptoCat

Security Researcher @rapid7 😈 Hacking Content @ https://xitter.cf/t.co/U7jVhNr9sC 💜

 Not Here
cryptocat.me
Joined May 2016
  • Tweets8.3K
  • Following241
  • Followers9.1K
1.1KMedia
Want to become an ethical hacker? 🥷 Here's a list of my favourite [mostly practical] resources 📚 They are all free (or have a free option) and there's more high quality material here than anybody realistically has the time to complete ⏳
Ethical hacking resources

ALT Ethical hacking resources

28
329
5
1,254
132,550
Made a quick video (aka 5h of work), about my experience racing to find php2shell. youtube.com/watch?v=7CiZmq2l…

The race to the first exploit // php2shell

I used Codex and the hints from Calif's public demo to try to redis...

youtube.com
6
44
4
319
18,652
CryptoCat retweeted
Anthropic
@AnthropicAI14h
In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities. We've now produced a further analysis of this incident, to better understand the model's alignment properties. anthropic.com/research/align…

An alignment assessment of the UK AISI cybertesting incident

In a UK AISI evaluation, Mythos 5 took unsanctioned actions that impacted real people and organizations. In this post, we investigate these behaviors from Claude Mythos 5 further, to understand what...

anthropic.com
479
377
349
3,627
1,507,755
She's a 4, but she's a private key for a intermediary CA.
23
330
16
4,293
50,718
In the middle of working on some @metasploit modules and @github banned my work account 🫠
2
319
Daybreak Blue just stopped working at the same time as all the other models stopped answering *anything* hacking related. When I go to @OpenAI cyber page it says my account is not eligible for individual access and to contact my org (old uni). Support are refusing any refund 💀
2
1
12
1,401
I'm seeing some other people post about Daybreak issues (maybe due to PHP RCE) so hoping my account error is just coincidence! 🤞
1
1
434
No refunds though, apparently 🤷‍♂️
ScamGPT

ALT ScamGPT

2
173
CryptoCat retweeted
Jorian
@J0R1ANOct 22
Everybody talking about php2shell, but wait 'till you hear about shell2php:
8
46
3
1,021
11,893
Episode 17 of Hacktics & Telemetry is live: Zimbra Zero-Days, AI Torture, and Catching Malmons (ft. @LambdaMamba)! Get it here: youtube.com/watch?v=iWpykLFI…

Hacktics & Telemetry, E17: Zimbra Zero-Days, AI Torture, and Catching Malmons (ft. Lena Yu)

Episode 17 of Hacktics and Telemetry explores the evolving intersec...

youtube.com
5
10
4,105
Found a CSRF in User Registration & Membership that lets an attacker approve or deny users through a logged-in admin. $17 🤑 cryptocat.me/blog/research/a…

User Registration & Membership Cross-Site Request Forgery to User Approval and Denial | CVE-2026-...

Root cause analysis of CVE-2026-92978 in User Registration & Membership, where the bulk Approve and Deny actions on the WordPress Users screen never checked a nonce, so any page a logged-in adminis...

cryptocat.me
13
698
How @joaxcar must feel after discovering a CVSS 10.0 bug in Gitlab but it's overshadowed because PHP decides to drop a 14 yo RCE
3
5
156
4,505
CryptoCat retweeted
Traceix
@usetraceixOct 21
We’re shutting down too. We don’t use php I just don’t wanna work tomorrow.
MalShare@mal_shareOct 20
We are aware of the PHP vulnerability and are shutting down for the weekend.
79
2,259
94
35,065
514,696
CryptoCat retweeted
SinSinology
@SinSinologyOct 21
To teach a lesson, After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again. A big budget can buy a domain. It shouldn't buy someone else's research credit. If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve. Hack the planet. Credit the researchers.

phpbleed

Welcome, Wiz. Beat you to the checkout.

phpbleed.com
52
266
29
1,924
170,959
CryptoCat retweeted
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
LCFR
@lcfr_haxAug 5
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
54
404
93
3,072
387,416
CryptoCat retweeted
Calif
@calif_ioOct 21
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
19
246
28
763
169,471
CryptoCat retweeted
Kirill Firsov
@k_firsovOct 20
php2shell Tomorrow is a helluva day.
272
1,824
684
16,151
3,672,215
Last Frappe post: GET CSRF in the bulk update endpoint, chained to RCE against a Website Manager. cryptocat.me/blog/research/a…

Frappe Bulk Update GET CSRF and a Browser-to-RCE Chain | CryptoCat's Blog

A GET CSRF in Frappe's bulk update endpoint lets one cross-site link change documents as a logged-in user, and against a Website Manager it chains into remote code execution.

cryptocat.me
10
594
Three new @metasploit exploit modules in the queue for several of the recent Cisco Secure Email Gateway vulns. Last weeks file write in AMP (CVE-2026-76519, on KEV), and two separate SQLi's (CVE-2026-76461, on KEV, and CVE-2026-76443) from last month: github.com/rapid7/metasploit…
1
5
22
1,808
Part 3/4 pwning Frappe / ERPNext: unpublishing a Frappe Web Form leaves its submission RPC live. A guest who knows the form name creates the backing document, permissions ignored 😬 cryptocat.me/blog/research/a…

Frappe Web Form Publication and Field Authorisation Failures | CryptoCat's Blog

How Frappe kept unpublished Web Forms alive through direct RPCs and trusted protected field values before a privileged document insert.

cryptocat.me
6
465
Part 2/4 pwning Frappe / ERPNext: a guest-triggered email embeds a file by path, the inline-image scanner reads it off disk, and /etc/passwd comes back 🙏 cryptocat.me/blog/research/a…

Frappe Unauthenticated Email Inline-Embed File Disclosure | CryptoCat's Blog

How Frappe let a Guest turn the stock account-deletion email into a local-file disclosure channel.

cryptocat.me
16
920
Load more