During the Shai-Hulud malware analysis, we found that the Python version contains a check if the target machine is from Israel or Iran - if so, it plays Russian roulette - randomly picking a number from 1 to 6, and if 2 is chosen - it starts a horrible siren sound on max volume, and removes all files on the machine.

0 Days to Day 5 The numbers grow but not as nearly as much as they should. I guess that while everyone were distracted by the “Steal My Bitcoin” challenge, patching and remediation were pushed aside 🫠 ox.security/blog/php2shell-d…

Am I the only one that's SUPER SUSPICIOUS about the steal bitcoin website with the PHP vuln?

shell2shell just dropped or something. 🫣 JK I dunno anything I just try to fit in with this Cyber security awareness month thing...

PHP2Shell: 24 Hours Later 24 hours after PHP2Shell dropped, 99.3% of affected PHP instances are still unpatched. Yep, you read that right. 🫣 🤦 After CVE-2026-109618 & CVE-2026-109619 were disclosed, we tracked more than 2.2 million publicly visible PHP instances on Shodan to see how fast the internet actually patches an unauthenticated RCE in PHP itself. • At first: 245 patched instances • After 12 hours: 4,519 • After 24 hours: 14,151, out of ~1.97M measurable affected instances Breaking it down by WordPress, phpMyAdmin, Drupal, Laravel, Joomla, cPanel and Magento shows the same picture: roughly 99% still unpatched. AI is making us faster at finding critical vulns, but it isn’t making us faster at removing them from the internet. If that gap keeps growing, patching quickly won’t be enough on its own. You need to know what you actually expose, cut internet-facing surface you don’t need, monitor for exploitation, and fix what’s really exploitable first. If you have a publicly accessible PHP instance and still haven’t patched, assume you’re exposed. Patch now, then check for signs of compromise. Full data and methodology on the OX Security blog: ox.security/php2shell-24-hou…

Any threat actors waiting to drop a Shai-Hulud variant on NPM, now's probably the best time while everyone are busy with PHP2Shell, LiteLLM, Pillow, NodeJS, eMudhra CA certs...

❗ If 2 PHP vulns weren't enough for one day (or, 0-day?) - LiteLLM were compromised today by a combined RAT Infostealer malware! TLDR - LiteLLM PyPI ver 1.107.0 is compromised, if you installed it - revoke keys and change passwords ASAP. The malware combines two threats in one package: an infostealer that harvests secrets from the machine, and a remote access trojan (RAT) that lets the attacker connect remotely and control the affected machine. The malicious code was injected only into the “wheel” package, so reviewing the repository and the “clean source” would not have revealed anything wrong. The malware also contacts the URL litellm[.]dev, which is an attacker bought domain that could easily be seen as a legitimate domain instead. While this might look like “yet another PyPI malware”, hiding inside the wheel file is one of the new ways attackers use to stay hidden and bypass common detections, like in npm, whenever a new protection is added – such as blocking preinstall hooks, threat actors will go out of their ways to find new techniques to reach their goals and execute code without being detected. If you’re yet to pin versions or add a time-based installation delay, this should be yet another wake up call to take the time and do so before it is too late. Once these passwords and credentials are out, remediation will take longer than it takes threat actors to get what they want. Read the full blog: ox.security/blog/litellm-1-1…

Fast response from the @NSAGov

php2shell - CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHP ox.security/blog/cve-2026-10…

PHP crit vuln drops at the same time as a new LiteLLM malware, then MacOS decides to pull this cool trick: 🤦🤦🤦

PHP CVE-2026-109618 & CVE-2026-109619: What to Do Before the Details Drop Two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are set to be patched today. The PHP security team rates both CVSS v4.0 9.2, and researchers describe them as unauthenticated remote code execution. Beyond that, there’s very little anyone can say for sure yet. Until 14:00 UTC, everything is speculation, please wait until PHP officially releases more info and don't try running POCs from unknown GitHub account 👀 Read our take on it: ox.security/blog/php-cve-202…

How many people do you think just found NEW vulnerabilities instead of the ones dropping today just because they took the time to research PHP with their favorite LLM?

Introduce yourself by listing 10 bands you have seen live. Porcupine Tree Dream Theater Haken Arctic Monkeys Queen Nightwish Muse Sleep Token Leprous Coldplay

The PHP posting went too far. Does anyone have the diff for the new vuln fox / exact version numbers for pre/post fix?

People in @X take posts too seriously. PHP is getting one crazy vuln now, nobody deserves it, pls patch fast if you can, we're working on this on our end too to learn more.

Two weeks ago I spoke at @BSidesTO and all speakers got the Heltec WiFi LoRa 32 So I did what every BSides Toronto speaker would do when he receives a ESP32 device with an OLED display, and asked the question - can it run DOOM?

Let's go!

Is it just me or it feels like the rate of ACTUAL critical vulnerabilities went down to be like it was 2 years ago? Like, I get the CVE-pocalypse and stuff, but it feels that most of it is AI theater...

I REALLY hope one of our submissions got accepted 🤞