@commando_skiipz

Just a random guy, tweeting in front of the world. Sr. Application Security Engineer (API, Mobile, Web, Cloud, AI/ML) 💼. Creator (@vulnbank & https://xitter.cf/t.co/pgYmTW2JVL)

 …in your infra
github.com/Commando-X
Joined January 2019
  • Tweets34.2K
  • Following3.8K
  • Followers14.8K
1.5KMedia
I built an intentionally vulnerable banking application for security engineers/interns, developers, & QA analysts to learn, practice secure code reviews, and test their application security knowledge in areas such as SQLi, XSS, CSRF, race conditions, API vulnerabilities, & more.
Ghost St Badmus
@commando_skiipz3 Feb 2025
Where are the hackers/code reviewers? How many vulnerabilities can you spot in this code? Apart from the hints, are there other places you can exploit? Can you chain the vulnerabilities?
24
146
14
804
211,633
This is mental! If you haven’t updated your PHP apps yet, it might already be too late at this point. Maybe you should just wait for the ransom email from an attacker.
Matthew Prince 🌥
@eastdakota13h
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
6
8
1
77
9,662
This is embarrassing mannn
Ami Luttwak@amiluttwak17h
Replying to @migtissera @wiz_io
In the age of AI, it’s pretty common that multiple teams find similar vulns in parallel. We have another major vuln coming 🤞🤞 that has also has several teams reporting it in parallel.. It’s been an amazing collaborative effort to work on the patch and mitigations.
10
1,026
> On July 30th, the guys at Calif started auditing PHP. > By August 11th, a researcher at Calif had discovered a way to exploit a vulnerability that could lead to pre-auth RCE and reported it to the PHP team. > OpenAI reported the same vulnerability to the PHP team on the same day as the Calif researcher. (Was this a coincidence, or did something fishy happen? How did OpenAI discover it?) > Then, on August 24th, the guys at Wiz reported the same vulnerability. (But all of a sudden, Wiz is posturing as though they discovered the RCE first & went into full-blown marketing mode with their SOTA AI, lmao.) It’s a shame what the industry has become. Anyway, inform your governments to patch their websites.
Ghost St Badmus
@commando_skiipz23h
They chose today of all days to post this marketing slop, even when Wiz themselves couldn’t dare mention that it was Argon who helped them uncover the PHP vulnerability someone else already found with a different model before they did. Nah man!
7
14
1
80
9,600
1
3
633
Manchester United I pour you spit!
Manchester United
@ManUtd19h
Full-time.
Full-time: Como 4 United 1.

ALT Full-time: Como 4 United 1.

3
12
1,131
I pour you spit @ManUtd !!!
3
2
15
949
United you disgust me!
Manchester United
@ManUtd20h
Como double their lead through Douvikas, 2-0.
4
8
3
47
3,837
God see as como dey play us, walahi if we lose me sef go gather cook united
4
573
Somebody should check on government websites.
Ghost St Badmus
@commando_skiipz23h
Tell your engineering team to update their Laravel apps, WordPress sites, and any other applications written in PHP.
12
11
3
70
3,877
They chose today of all days to post this marketing slop, even when Wiz themselves couldn’t dare mention that it was Argon who helped them uncover the PHP vulnerability someone else already found with a different model before they did. Nah man!
Google
@GoogleOct 21
Researchers at @wiz_io put Gemini 4 Argon to the test against complex cyber threats. In real-world testing, it found more than two times more vulnerabilities than baseline models — catching a critical risk that previous frontier models missed. See how they did it ↓
4
2
1
32
12,895
Why is Wiz taking most of the credits??? lmaoooo smh
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
3
16
3,460
Tell your engineering team to update their Laravel apps, WordPress sites, and any other applications written in PHP.
4
50
2
162
7,593
Drupal, Joomla
658
So there was already a Wordpress RCE waiting to be disclosed.
sagitz
@sagitz_Oct 21
Today we disclose PHP2Shell - remotely exploitable memory corruptions in PHP WordPress pre-auth RCE: ✅ Drupal pre-auth RCE: ✅ Joomla pre-auth RCE: ✅ Remote memory disclosure of any PHP application: ✅ Read more ⬇️🧵
2
1
34
2,535
Once a confirmed Php2Shell POC drops, expect another WP2Shell announcement in few hours.
6
13
1
104
4,918
“Vamos” has to be the most frequently used word among footballers.
1
6
656
Even non-Spanish-speaking players say it during celebrations.
87
Ghost St Badmus retweeted
Nicolas Krassas
@DinosnOct 20
I'm starting to think that CVP and DayBreak Blue is nothing more than a way to collect more personal data from users, possibly also making easier to spot cybersecurity work? Models will still reject cybersecurity tasks often and we are under the impression that what should had been normal is exclusive. Want to look your own logfiles and past work, submit for CVP/Cyber. This is not ok.
13
10
3
151
12,358
Ghost St Badmus retweeted
Theo
@GPhilczOct 20
At @Morvdesk , our story begins with our research, and technology is central to how we turn that research into products that deliver meaningful outcomes for investors. Our 12-month commercial partnership with @trydecideAI is an important step in strengthening that process, from research and analysis to product development and financial operations.
8
30
45
1,296
The moment I left the shop, I went straight home and narrated everything to my mom. We then went back to the shop to confront him. By the time we got there, Broda Muri had also arrived, and when he saw how pissed my mom was, he became extremely pissed at his guy too. This guy threatened to stab me with a pair of scissors if I dared step into the shop. Muri dared him to try and even started pushing me towards the shop, challenging the guy to make good on his threat. When I saw that the guy had actually picked up a pair of scissors and was waiting for me, lmaoooo! I no gree o. The whole thing sha caused a big scene in the neighbourhood. Some rich dude who lived behind our house happened to drive past at that moment. He saw the whole pandemonium and was shocked to see my mom there because he knew she would never ordinarily be involved in such a scene…
ugochukwu@anihpatrickugoOct 18
Replying to @commando_skiipz
Your parents? What did they say when you returned home with a head injury and refused to go back.
4
3
1
38
9,184
Out of curiosity, he stopped to find out what was happening. After my mom narrated the whole situation to him, he said he was going to involve the police and sue the guy. That was when everyone started begging the man to let the matter go, and that was how the whole issue ended.
1
1
9
1,345
Load more