@hdmoore
 Austin, Texas, Cyberspace
hdm.io/
Joined July 2008
  • Tweets541
  • Following534
  • Followers85.7K
66Media
HD Moore retweeted
Stefan Esser@i0n1c15h
People keep asking me why @calif_io hired @lcamtuf and what he does for us. I guess the cat is out of the bag.
5
11
2
146
9,921
HD Moore retweeted
Nicolas Krassas
@DinosnOct 21
Additional mitigation parts, memory_limit = -1 max_post_size = 1/4 of configured memory_limit session.upload_progress.enabled = 0 fatal_error_backtraces = 0 expose_php = 0 User SELinux/AppArmor where possible.
2
23
1
143
16,159
You’ve been Israelized ¯\_(ツ)_/¯
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
2
2
59
5,256
For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:
5
41
6
262
38,373
Replying to @halvarflake
Also, once a vuln has been announced but not patched (eg. PHP RCE), everyone's got an electron-tunneling microscope to point at the codebase. The old ways of embargo and coordinated disclosure are more perilous.
2
1
16
2,250
In a world of AI slop blogs, presentations, images and write ups... Calif is an excellent example of how to harness it correctly. Accuracy, Art, Asthetic all supporting excellent AI assisted research. 👏
Calif
@calif_ioOct 21
Do you know who illustrated the comic on calif.io/php2shell? Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax. This artist-hacker couple has the best story, stay tuned!

php2shell by Calif Research

A tale of two PHP remote vulnerabilities

calif.io
1
3
40
3,550
HD Moore retweeted
Calif
@calif_ioOct 21
Do you know who illustrated the comic on calif.io/php2shell? Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax. This artist-hacker couple has the best story, stay tuned!

php2shell by Calif Research

A tale of two PHP remote vulnerabilities

calif.io
29
137
18
1,116
114,533
HD Moore retweeted
Nicolas Krassas
@DinosnOct 21
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
The PHP 8.5.12 release fixes the two specific CVEs (via state/bailout changes) detailed in official advisories; referenced "surviving paths" (e.g. var_destroy UAF) are separate pre-existing unserialize issues unrelated to this patch. php.net/archive/2026.p… github.com/php/php-src/se… github.com/php/php-src/se… github.com/dinosn/php-8.5…
76
366
146
2,578
487,189
HD Moore retweeted
Calif
@calif_ioOct 21
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
19
238
27
713
151,986
the good thing about the eMudhra CA private key mess is that we can finally use https on localhost
44
489
32
9,338
212,967
HD Moore retweeted
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
LCFR
@lcfr_haxAug 5
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
55
395
89
2,975
366,889
You've gotta patch your dependencies super fast because they're full of vulns (PHP, Node, eMudhra, etc), but not _too_ fast because they're full of backdoors (LiteLLM). Good luck!
28
228
30
2,642
58,336
HD Moore retweeted
Nicolas Krassas
@DinosnOct 21
Releasing my lab as well PHP RCE github.com/dinosn/php-cve-20… , use it as a guidance and further reference for work upon. Patches are available at this moment PATCH!
6
39
2
284
26,512
If you're looking for the most detailed AND *entertaining* way to read about the php2shell bugs, the Calif post is epic: calif.io/php2shell/

php2shell by Calif Research

A tale of two PHP remote vulnerabilities

calif.io
3
53
176
17,555
HD Moore retweeted
Jλckλι@J4ck3LSyNOct 21
... get it while its hot... 😈 > CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x) > session.upload_progress UAF > jackalsyn.com/posts/php-up-2… > Courtesy of Me, @acd421 & @Archknight23 #CyberSecurity #infosec #php2shell #php
53
146
99
1,104
927,489
HD Moore retweeted
Nicolas Krassas
@DinosnOct 20
As it's already known, I will be releasing a lab on the CVE-2926-109618,9 PHP RCE upon embargo release. Until then, patch to the latest.
7
32
349
28,040
HD Moore retweeted
Nicolas Krassas
@DinosnOct 21
Replying to @acd421 @doiftrue
Block multipart/form-data requests on routes that do not require uploads as well. For a full remediation update to * 8.5.12 * 8.4.27 * 8.3.36 * 8.2.35
3
13
3
52
15,033
HD Moore retweeted
Nicolas Krassas
@DinosnOct 21
Replying to @doiftrue
Partial mitigation
1
4
5
36
14,771
The PHP foundation announced a security release tomorrow (Oct 21) addressing 2 critical PHP vulns that could lead to RCE. Find your PHP instances using runZero: runzero.com/blog/php/ For latest developments, tune into runZero Hour tomorrow at 1pm ET (🔗 in 🧵)

Critical RCE vulnerability in PHP: Find impacted assets

PHP has announced a security release scheduled for October 21, 2026 that addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

runzero.com
1
3
1
671
HD Moore retweeted
Dennis@DennisFOct 20
The @php_net advisory is now set for 9 AM EDT tomorrow. decipher.sc/2026/10/20/resea…

Researchers Warn of Upcoming Critical PHP Flaws - Decipher

The two flaws are CVE-2026-109618 and CVE-2026-109619 and are said to affect PHP versions 5, 6, 7, and 8. 

decipher.sc
1
2
5
1,553
Load more