Taggart

taggartinstitute.orgThe Taggart Institute: Master Your CraftThe Taggart Institute exists to provide low-cost, high-quality technology training to everyone in a welcoming, supportive community.

11 Nov 2024

Hey hey new friends! Perhaps a reintroduction is in order: I'm Taggart, and I make low-cost, high-quality tech educational material. Career educator, IT Director, and now threat hunter. Sometimes I stream, but rarely these days. Also interested in surviving the omnicrisis. taggartinstitute.org

Taggart reposted

ifin.networkWhatsApp GhostPairing attacks in Europe using the WA.FISHER phishing kitLast Updated: 2026-10-25T14:46:59Z (UTC) What’s Happening A WhatsApp GhostPairing phishing is going around in Europe. Phishing lures are sent from compromised accounts to known contacts. Since August 2026 there is more public reporting on the ballet competition-themed lure in multiple countries. Casting a vote initiates a device-sync and leads to an account takeover. Indicators are available in the public MISP feed (uuid 3b08d9b4-c7e7-4d5b-8632-3d7d213e7298) The WA.FISHER phishing platform ...

21h

While everyone (including us) was losing their heads about PHP and Brotli, our community was tracking a widespread WhatsApp Phishing campaign in Europe. Domains and TTPs in this excellent thread. ifin.network/t/whats... #ThreatIntel #IFIN

Gonna need someone to explain how much I should trust the revenue and opex numbers in Anthropic's filing for IPO. www.sec.gov/Archives...

This in particular doesn't pass the sniff test. Anthropic is claiming a net positive revenue in 2026 so far, with a massive increase in Q2. It may be worth noting how they're accounting for the compute/infra expenses.

Taggart reposted

ZAP by Checkmarx

@zaproxy.org

Replying to @zaproxy.org

All ZAP versions from 2.14 use the old Brotli library, but as usual only the latest version of ZAP will receive the patch. We strongly advise those of you running old versions of ZAP to update to 2.17.0

Taggart reposted

George Pearkes

@peark.es

*ANTHROPIC FILES PUBLICLY FOR US IPO www.sec.gov/Archives/edg...

sec.govsec.gov

github.comGitHub - KillaBoi/StealMyBitcoin-PoC: A public release of the Steal My Bitcoin challengeA public release of the Steal My Bitcoin challenge - KillaBoi/StealMyBitcoin-PoC

The winner of the stealmybitcoin[.]com exploit challenge has a remarkably good writeup on the #PHP2Shell exploit process. The PoC clearly explains what's involved in targeting and calibration for any given PHP version/deployment.

What this tells us is exploitation requires knowledge of: 1. PHP version 2. Reasonable address spaces for the heap 3. PHP worker count 4. Exact offsets for all of the above Blind attacks are highly likely to fail unless allowed to continue for some time.

Oh yeah and this is all mod_php. None of this works the same way against PHP-FPM.

The real vulnpocalypse was the slop we read along the way.

Anyone claiming "AI removed the cost" for the binary analysis and exploitation of #PHP2Shell doesn't know ball.

The "cost" was understanding binary exploitation, which it turns out mere mortals have done for a while now.

Taggart reposted

threddy 🦖

@threddyrex.org

Code on My Phone

Taggart reposted

ifin.networkCVE-2026-111497: Brotli Out-of-Bounds Write Impacts Node, PythonLast Updated: 2026-10-23T15:39:23Z (UTC) CVSSv4: N/A On 2026-10-21T07:00:00Z (UTC) NodeJS patched a High severity vulnerability in the runtime involving the Brotli compression decoder. The vulnerability was a buffer overflow that could lead to remote code execution. On 2026-10-22T07:00:00Z (UTC), Imperva published a report demonstrating the remote code execution. Notably, Node was vulnerable in a default state, as was the express request handler. Imperva called this “Node2Shell,” but we wi...

We've updated this story to reflect the wider impact of the vulnerable Google Brotli library. Action is likely necessary.

IFIN@ifin-intel.org

Node and Python were feeling left out, so here's an RCE that needs attention. The Node issue, referred to as #Node2Shell, appears fairly exploitable. Check your Node versions and update. Check for affected Python packages as well. ifin.network/t/cve-2... #ThreatIntel

In this house, the Australian dog show is basically Darmok and Jilad. "Bluey, when she cleaned up the duck cake." "Bingo, when Judo ran away."

Taggart reposted

NSF–DOE Rubin Observatory

Hey, has IFIN been valuable to you this week? We sure would appreciate some support of the mission. We're a registered nonprofit and rely on community support to keep the lights on! ifin-intel.org/support #ThreaIntelIsMutualAid

Taggart reposted

@rubinobservatory.org

🗣️ This is your flight captain speaking 🪶✈️ Keep your seatbelts fastened as we glide across NSF–DOE Rubin Observatory's view of the Seagull Nebula! 🔭🧪 On your screen, you’ve got a front-row seat to young stars reshaping their stellar neighborhoods. Sit back, relax, and enjoy!🪽

Taggart reposted

Really loving how everyone with an AI agent is a cybersecurity expert now

Taggart reposted

@benjaminjriley.bsky.social

The Phermi Paradox: If #PHP2Shell is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over? Some possibilities:

Taggart reposted

Benjamin Riley

Replying to @benjaminjriley.bsky.social

But we need more than wolf containment. We need a reclaimation of the essential humanity of education. Empathy, kindess, curiosity, people at education conferences roll their eyes at this. The terminally online roll their eyes too. And that is exactly why we can win this fight.

The Phermi Paradox: If #PHP2Shell is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over? Some possibilities:

3: The exploited won't know it's happening and won't report it. This is hardly a new phenomenon PHP sites have been exploited for years without anyone noticing (see: Slot Gacor).

Exploitation won't look like the internet blinking off. It'll look like a bunch of gambling pages and piracy hosted on school and municipal government websites. Such attacks can lie quietly on PHP sites for years before anyone bothers to look.

The Phermi Paradox: If #PHP2Shell is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over? Some possibilities:

php2shell.censys.comPHP2Shell services

Patching isn't done, surely, but I think the most enticing targets for notable attacks probably moved quickly. It's also worth noting that status dashboards like php2shell.censys.com are mostly a fairy tale. Look at the bottom for some whopper disclaimers.

OS backports to versions other than PHP's official patched versions will muddy the picture, as will the **50% of PHP services that don't report versions**. I'm not saying most of the internet is patched; I'm just saying But let's not ignore the alternative:

The Phermi Paradox: If #PHP2Shell is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over? Some possibilities:

They didn't show what pregaming they did to prepare the exploit for those specific targets. So far, it seems like some prior work is necessary to get proper offsets, heap layouts, and payload shapes to exploit properly. And that's assuming the mod_php SAPI, which responds differently than PHP-FPM

2. Patching was aggressive and major targets had time to get in front of this. For larger orgs, I believe this is accurate. The message was clear enough, and there was time enough to get any org with a half-awake IT team to circle the wagons.

The Phermi Paradox: If #PHP2Shell is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over? Some possibilities:

1. The exploit is still non-trivial and building the full attack chain is taking some time. This is at least partially true. I've yet to see a fully reliable proof-of-concept exploit that addresses all versions of PHP. Calif and Wiz showed exploit videos against targets.

So yeah, just checking in. Doesn't seem like the internet fell over. Doesn't seem like we're seeing an autopwn exploit ruin everyone's day. Patching quickly was prudent, but the initial comparison to Heartbleed/Log4Shell (including my own) was a bit hyperbolic.

ifin.networkCVE-2026-109618, CVE-2026-109619: Remote Code Execution in PHPLast Updated: 2026-10-22T05:59:07Z (UTC) What’s Happening On 2026-10-21T07:00:00Z (UTC), PHP published an advisory about two critical vulnerabilities in PHP. CVSSv4: 9.2 for both. These vulnerabilities is being actively exploited in the wild. The GitHub security issue has also now been published. PHP has also published a detailed blog post detailing the timeline of these vulnerabilities’ discovery, remediation, and disclosure. CISA has published an advisory urging immediate patching. Th...

This is the power of community. IFIN Staff (it's more than just me!) reviewed this observables in detail to make sure they passed muster. These are behavioral indicators that go beyond a list of attacker IPs.

IFIN@ifin-intel.org

As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed. ifin.network/t/cve-2... #ThreatIntel

Taggart reposted

"How are you doing?" Me:

Taggart reposted

We will have useful detections for #PHP2Shell in our post and in MISP shortly. We're doing rigorous validation to make sure we don't provide nonsense.

Has anyone seen (and confirmed) a solid #PHP2Shell proof-of-concept? GitHub is awash in slop.

3. The specific shape of the payload to hit the OOM at the right point. This is largely based on memory limit settings in `php.ini`.

So there's some prior work to hit a vulnerable target. A PHP offset "rainbow table" may be somewhere or getting built, but those specifics may explain the lag in clear evidence of exploitation.

Has anyone seen (and confirmed) a solid #PHP2Shell proof-of-concept? GitHub is awash in slop.

1. Initial offsets for functions are PHP version-specific, so you need those going in. That's annoying but easy.

2. Heap layout constants based on Zend MM's memory layout for the PHP build. You get this with GDB precisely on a PHP instance you control, or fuzzing a target—messy.

Has anyone seen (and confirmed) a solid #PHP2Shell proof-of-concept? GitHub is awash in slop.

I'm not certain how globally exploitable this really is.

I have arrived at a working PoC based on a GitHub repo. But there are signficant caveats. You need 3 precise things to make it work.

Has anyone seen (and confirmed) a solid #PHP2Shell proof-of-concept? GitHub is awash in slop.

eliastaylor.comThere isn't an easy exploit for this PHP vulnerabilityMass hysteria, or something.

I'm not 100% here, but I spent all last night reviewing (and attempting to make) so-called PoCs and... not much going on. eliastaylor.com/noexploit/

Here's what I basically have so far: 1. Most of the attack logs you see online are folks firing off the GitHub PoCs. 2. The GitHub PoCs are junk. 3. I have one (1) PoC that reliably produces a crash, but requires very specific conditions to do anything else, and even then it's hit-and-miss.

With all due respect to those making the claims, "trust us, bro" can't cut it for what we're trying to do. Observables (IoCs) or it didn't happen.

IFIN@ifin-intel.org

After reviewing the "evidence" of exploitation of #PHP2Shell and finding it wanting, we have removed the "EITW" tag from our story.

Taggart reposted

After reviewing the "evidence" of exploitation of #PHP2Shell and finding it wanting, we have removed the "EITW" tag from our story.

security.paloaltonetworks.comCVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory er...

Palo Alto now says that the Global Protect VPN web portal is not impacted, but I'm not sure how that's possible when the thing is made of PHP.

Taggart@taggart-tech.com

Notable PHP Enjoyer Palo Alto has posted their advisory on #PHP2Shell: security.paloaltonet... **ALL** versions of Panorama and PAN-OS are affected. There's a fix coming, but right now I recommend shutting down anything exposed publicly, like VPN portals.

Taggart reposted

ifin.networkCVE-2026-110264: Integer Overflow in Gitlab Regex CompilerLast Updated: 2026-10-21T23:33:33Z (UTC) CVSSv3: 10.0 GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression. Another perfect 10 for GitLab, seemingly the same issue as the previous one from last week. The issue affected: GitLab CE/EE: all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19....

If you run GitLab, you've handled some bad vulns recently, so what's one more? Perfect 10 patched today. ifin.network/t/cve-2... #ThreatIntel #ThreatIntelligence #IFIN

Taggart reposted

ifin.networkLiteLLM Compromised Again: Credential Stealer and BackdoorLast Updated: 2026-10-21T18:41:47Z (UTC) What’s Happening LiteLLM has been compromised again. litellM 1.107.0 on PyPI has a credential stealer and a backdoor. The official litellM 1.107.0 Docker im...

While you were patching PHP, LiteLLM went and got compromised again. ifin.network/t/litellm-co... #ThreatIntel #ThreatIntelligence #IFIN