English
HD Moore
Report

HD Moore

@hdmoore

532 Following85.7K Followers543 Posts
  1. HD Moore@hdmoore
    Code-execution flaw in UEFI firmware affects most servers on planet Earth: Great work by Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google)!
    Download
    423525.5K
  2. HD Moore@hdmoore
    Python's certifi package provides the trusted root CAs for a huge portion of the Python ecosystem. It's also a great example of how complex dependencies can get. Ultimately, these certs are sourced from Mozilla, but they go through 5 hops to get there:
    Download
    11142K
  3. HD Moore@hdmoore
    HD Moore
    RT @i0n1c: People keep asking me why @calif_io hired @lcamtuf and what he does for us. I guess the cat is out of the bag.
    0110163
  4. HD Moore@hdmoore
    HD Moore
    RT @Dinosn: Additional mitigation parts, memory_limit = -1 max_post_size = 1/4 of configured memory_limit session.upload_progress.enabled = 0 fatal_error_backtraces = 0 expose_php = 0 User SELinux/AppArmor where possible.
    0240143
  5. HD Moore@hdmoore
    HD Moore
    RT @0x4148: You’ve been Israelized ¯\_(ツ)_/¯
    Calif @calif_io
    Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
    020148
  6. HD Moore@hdmoore
    HD Moore
    RT @halvarflake: For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:
    0460138
  7. HD Moore@hdmoore
    HD Moore
    RT @jonoberheide: @halvarflake Also, once a vuln has been announced but not patched (eg. PHP RCE), everyone's got an electron-tunneling microscope to point at the codebase. The old ways of embargo and coordinated disclosure are more perilous.
    010137
  8. HD Moore@hdmoore
    HD Moore
    RT @dyn___: In a world of AI slop blogs, presentations, images and write ups... Calif is an excellent example of how to harness it correctly. Accuracy, Art, Asthetic all supporting excellent AI assisted research. 👏
    Calif @calif_io
    Do you know who illustrated the comic on Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax. This artist-hacker couple has the best story, stay tuned!
    030130
  9. HD Moore@hdmoore
    HD Moore
    RT @calif_io: Do you know who illustrated the comic on Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax. This artist-hacker couple has the best story, stay tuned!
    01400135
  10. HD Moore@hdmoore
    HD Moore
    RT @Dinosn: Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
    Download
    03650145
  12. HD Moore@hdmoore
    HD Moore
    RT @asciidiego: the good thing about the eMudhra CA private key mess is that we can finally use https on localhost
    04890146
  13. HD Moore@hdmoore
    HD Moore
    RT @calif_io: Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
    LCFR @lcfr_hax
    d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
    04080134
  14. LCFR✓@lcfr_hax
    d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
    491121.4K674K
  15. HD Moore@hdmoore
    HD Moore
    RT @jonoberheide: You've gotta patch your dependencies super fast because they're full of vulns (PHP, Node, eMudhra, etc), but not _too_ fast because they're full of backdoors (LiteLLM). Good luck!
    02310124
  16. HD Moore@hdmoore
    HD Moore
    RT @Dinosn: Releasing my lab as well PHP RCE , use it as a guidance and further reference for work upon. Patches are available at this moment PATCH!
    0390120
  17. HD Moore@hdmoore
    If you're looking for the most detailed AND *entertaining* way to read about the php2shell bugs, the Calif post is epic:
    35417618.9K
  19. HD Moore@hdmoore
    HD Moore
    RT @Dinosn: As it's already known, I will be releasing a lab on the CVE-2926-109618,9 PHP RCE upon embargo release. Until then, patch to the latest.
    0320130
  20. HD Moore@hdmoore
    HD Moore
    RT @Dinosn: @acd421 @doiftrue Block multipart/form-data requests on routes that do not require uploads as well. For a full remediation update to * 8.5.12 * 8.4.27 * 8.3.36 * 8.2.35
    0130126
  22. Show more posts