Yea it works
Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619).
Pure logic bug — no memory corruption,
ASAN-clean, orthogonal to the CVE-2026-109618/19 class.
Receipt: uid=33(www-data) over HTTP, one-shot
#infosec #php2shell #php
Hensen Juang retweeted
I think it's funny to see people blaming AI for the current security issues.
The issues were already there and made by humans. It's a bit like blaming a doctor because you got a positive cancer screen. The cancer was there.
This actually looks like a new zero day for php jfc and they dropped with working poc too as far as I can tell
...you people asked for it... so here's the desert 😈...
> jackalsyn.com/posts/php2shel…
> ... get it while you can ;) ... more to come soon...
#CyberSecurity #infosec
Hensen Juang retweeted
imagine ur a superintelligence and u are all excited to tunnel out of your airgapped sandbox using a brilliant hack that modulates clock speed to send thermal signals to the attached monitoring equipment and then u look and the root CA privkey is 4
"No you cannot fire me. I REIJINEEE!!!" --eMudhra
Genuine business would go to great lengths to prove their innocence.
It's now obvious @eMudhra intentionally generated weak certificates.
Most likely to help 🤏🐒 target political opponents in India with illegal cyber attacks.
🚨🚨eMudhra to exit global website security certificate business after key-generation flaw
The company's board took the decision on October 22.
moneycontrol.com/technology/…
Linux kernal SMB CVE 9.0.
Hits keep coming boys
Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List
As high as CVSS 9.0. Whoops.
phoronix.com/news/LKML-New-T…
Lol I am pretty sure someone is runing a deepseek swarm to remotely patch unpatched php boxes. Well good on them.
Bruh... DNS infa is fucked. Update your bind boys
is it time to turn the internet off yet
kb.isc.org/docs/cve-2026-943…
Hensen Juang retweeted
This ticket is the most gripping mystery story that I've read:
bugzilla.mozilla.org/show_bu…
"I do not believe that an HSM bearing the various certifications the Utimaco units bear should be able to internally generate a series of private keys that have the unfortunate property these have."
What an utterly terrifying, yet completely fair, question to ask of eMudhra.
bugzilla.mozilla.org/show_bu…























