Just your friendly neighbourhood red teamer @MDSecLabs @nighthawk_c2 | Creator of /r/redteamsec | https://xitter.cf/t.co/3k3EBAZqGd | https://xitter.cf/t.co/KwO2OwDOkl
Manchester, England
Joined February 2009
- Tweets16.5K
- Following562
- Followers18.2K
- Likes17.4K
Pinned Tweet
@MDSecLabs will be running our Red Team Capability Training out in #BlackHatUSA26 again this year. This year the course features a big refresh, with a bunch of new additions on the latest evolving techniques!
Early bird discounts end this month! @BlackHatEvents
blackhat.com/us-26/training/…
Dominic Chell 👻 retweeted
"The previous update (October 22 16:18 UTC) reported that Sophos observed successful exploitation of PHP2Shell in customer environments. Upon further analysis, we are correcting that assessment as Sophos customer telemetry shows scanning and a small number of failed exploitation attempts. As of this update, there is no evidence of a successful compromise due to these vulnerabilities." sophos.com/en-us/blog/proof-…
Dominic Chell 👻 retweeted
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Dominic Chell 👻 retweeted
Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
You can still focus on detection coverage today.
Security Labs writeup (coverage + guidance): elastic.co/security-labs/thr…
Most PHP RCEs converge on the same outcome, whatever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.
• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root
The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.
We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.
The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.
(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)
Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.
Guidance + every rule link below.
Dominic Chell 👻 retweeted
While everyone’s patching PHP today, don't sleep on Node.js CVE-2026-111497 OOB write in the bundled Brotli decoder. Reachable via fetch(): a malicious server just replies
Content-Encoding: br.
Fixed in 26.12.1 / 24.22.1 / 22.23.4.
Update.
Dominic Chell 👻 retweeted
At the @NCSC we are asking all UK organisations and their supply chains across product and services to understand their use of PHP and prepare to patch...
ncsc.gov.uk/news/critical-se…
Dominic Chell 👻 retweeted
Your EDR Has Boundary Issues.
@harmj0y and @tifkin_ of @SpecterOps explore how adversarial machine learning can evade EDR detection- and how LLMs are accelerating the reverse engineering behind it.
Watch their Offensive AI Con talk below. 👇
youtube.com/watch?v=GNDMDI_p…
#OAIC #OffensiveAI #Cybersecurity #EDR
Dominic Chell 👻 retweeted
Videos of unprompted.au talks are up!
How’s that FOMO holding up one month on? 👀
Whether you missed out or just want to relive the best bits, the unprompted.au talks are now online!
All the AI. All the cyber. None of the FOMO. 🐙
youtube.com/@unpromptedAU
Dominic Chell 👻 retweeted
Google's GTIG and Mandiant reported UNC7017 conducted ephemeral, five-to-ten minute software update tampering against AOMEI, delivering CROSSROAD and SHINYROAD via evolving infrastructure to stage backdoors and C2 operations. cloud.google.com/blog/topics…
Dominic Chell 👻 retweeted
Fox-IT’s full Cobalt Strike Beacon Corpus now available as an open dataset.
56,843 raw beacons + parsed configs from 190,182 sightings across 30,604 Team Servers, collected 2018–2026.
blog.fox-it.com/2026/10/13/r…
Dominic Chell 👻 retweeted
We recently did some research on self-service attacks on Intune Company Portal.
If you use Intune and allow users to self-install certain installers in System context, then this can lead to LPE ..
Dominic Chell 👻 retweeted
🔎 New Windows vulnerability discovered by Adrian Denkiewicz (@a_denkiewicz) of #doyensec - a high-severity flaw in one of Windows’ Virtualization-Based Security (VBS) enclaves that enables VTL1 code reuse. A first look at our ongoing research into this class of vulnerabilities.
🔗 blog.doyensec.com/2026/10/13…
#appsec #security
ALT Sparks coming out of the monitor while Adrian is typing, because his bug is so "shocking" :)
Last week I watched our team use codex to build 2 new fully functional agents for Nighthawk using our open agent protocol, including with custom c2 support. They were deployed to a live project and worked flawlessly. Everyone has their own throwaway c2 at their fingertips…. The c2 game is dead
First blog post in a mini series where I look at "disposable tooling". This post shares what I have found to be useful when 1-shot'ing LLM generated Stage-0 agents for Mythic. specterops.io/blog/2026/06/2…
Dominic Chell 👻 retweeted
The 2024 Budget raised the rate of capital gains tax. CGT receipts from that tax year *doubled*.
Looks like a triumph - but actually it was a failure.
And it means CGT reform is dead. A prudent Chancellor won't touch CGT.
A 🧵 on the CGT paradox:
Dominic Chell 👻 retweeted
Zip's (team-teso) long lost ssh1-crc32 exploit was found (xt 😘), (PLUS hellkit, 7350statd, 7350qpopper, icmp-tunnel, shellcode, lkm-work, and much more).
🚰 LEAKING phrack 73 article NOW (@phrack ):
github.com/hackerschoice/tea…
🤘🤘🤘
Dominic Chell 👻 retweeted
🧵 Some cool features in the Sliver GUI
github.com/sliverarmory/sliv…
Dominic Chell 👻 retweeted
Guess who's back? (back again)
• 🗓️📈 re-emerged [APT]29 September 2026, even larger scale
• 👨🏻🔧🏢service providers [still] compromised
• 🤖☢️AI-refactored malware now in Rust flavor
Updated info: microsoft.com/en-us/security…
Russian threat actor Midnight Blizzard is conducting widespread traffic manipulation attacks at hotels worldwide. Result: delivering malware or redirecting auth flows at their discretion, globally.
Since early May 2026, we saw this subcluster manipulate DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure. We’re calling the campaign CaptiveCrunch.
“We have observed notable commonalities in the equipment and management systems used across multiple affected networks.”
We break down the malware & techniques, but the most important part is how dynamic all of it is: Midnight Blizzard is using AI to support a significant portion of these operations. They are moving and changing quickly.
Feedback welcome on the suggested mitigations: microsoft.com/en-us/security…
Help spread the word to VIPs in governments, diplomatic entities, non-governmental organizations (NGOs) in the US and Europe (probably also those traveling to Black Hat)
Dominic Chell 👻 retweeted
-Britain loses £120bn as billionaires flee Labour
telegraph.co.uk/business/202…
Dominic Chell 👻 retweeted
Malware Delivery Techniques No.78 - Frameless Browser-in-the-Browser 🌐
Proofpoint has published analysis of TA419, a China-aligned threat actor observed targeting US experts in AI policy. The campaign paired a benign pretext with a redirect chain and a client-side Browser-in-the-Browser (BitB) credential-harvesting page.
Initial contact came from a conversation-starter email referencing an "AI Policy Advisory Committee", carrying no attachment or link. Once the target engaged, a follow-up message delivered a shortened URL that redirected to a landing page impersonating a shared OneDrive document.
That page rendered a simulated browser window entirely within its own HTML, a technique first documented by the researcher mrd0x. The window included a forged title bar and an address bar displaying login.microsoftonline.com, presenting a convincing Microsoft sign-in even to users who check the URL before authenticating. Because the window is drawn rather than framed, there is no iframe or cross-origin boundary for client-side controls to inspect.
Access to the page was gated behind a simulated Cloudflare Turnstile challenge, a common method for filtering automated analysis and delaying detection. Credentials, MFA responses and session tokens entered into the form were relayed through Adversary-in-the-Middle infrastructure, allowing the actor to defeat MFA and hijack authenticated sessions.
We have covered AitM and BiTM tradecraft previously, and this campaign reflects a continued shift toward client-side, infrastructure-light credential theft.
🧵 See the comments to test your defences and learn more!
Dominic Chell 👻 retweeted
Today, we're proud to finally bring @RemoteThreat out of stealth with the first integrated, end-to-end offensive cyber operations (OCO) platform.
Much of the focus today is on patching as fast as possible against noisy AI-driven attacks. We expect the next phase to arrive soon: models optimized for stealth, connected to sophisticated payloads and nation-state-tier offensive tools. Those attacks will be designed to evade detection, maintain access, and adapt as defenses respond. Enterprise security teams need to start testing against that level of sophistication now.
Evolving U.S. policy is also opening new opportunities for commercial offensive cyber. We see an emerging market for dual-use technology that strengthens enterprise security and supports authorized operational missions. That convergence of capability, policy, and operational demand makes the timing consequential.
RemoteThreat is built for internal enterprise red teams and warfighters. Its composable capabilities let operators select, combine, and customize tooling around their environment and objective. Internal red teams can vary sophistication to match the adversary they’re emulating. Warfighters can configure capabilities for the mission and adapt as conditions change. These capabilities are available to human operators, hybrid human–AI teams, and AI operators.
The platform connects planning, capability development, command and control, execution, and analysis- with existing tools, human oversight, and approvals integrated throughout.
It’s been a significant journey building this alongside my co-founder, Shawn Jones @anthemtotheego . We’re now 15 strong and growing, with some of the most talented security researchers I’ve ever worked with.
Given the sensitive nature of our work, some of our people will remain out of the spotlight. I couldn’t be prouder of this team and what we’ve built together.
If you lead an internal enterprise red team or build capabilities for the warfighter, I’d welcome a conversation.
businesswire.com/news/home/2…
