Dr. Christopher Kunz (@christopherkunz.bsky.social)

Dr. Christopher Kunz

@christopherkunz.bsky.social

Security and compliance nerd, sword fighter. Opinions are my own, not my employer's. Other social media profiles: Mastodon: @christopherkunz@chaos.social LinkedIn: https://www.linkedin.com/in/christopherkunz/

627 followers 480 following532 posts

Dr. Christopher Kunz

@christopherkunz.bsky.social

23h

Ich bin dann immer mal wieder über die nächsten Tage am Heise-Stand auf der it-sa anzutreffen. Halle 7A, Stand 504. Kommt gerne vorbei, wir haben auch Sticker! Und wer will, dem male ich meinen liebsten Private Key auf einen Zettel.

Dr. Christopher Kunz

@christopherkunz.bsky.social

Allein durch die mitgehörten Telefonate im ICE zur it-sa könnte ich ein Opsec-Fail-Blog füllen.

Dr. Christopher Kunz

@christopherkunz.bsky.social

RE: https://infosec.exchange/@vx_underground/117511993208915484 [1/3]

infosec.exchangevx-underground (@vx_underground@infosec.exchange)Hello, Little People Living Inside Of My Computer, I have made my first YouTube video. I am bonking goop (malware) with a stick. I've tried to be both technical and non-technical to appeal to all nerds. This was a lot of work. I love you. https://www.youtube.com/watch?v=MqdR7eMqJnc

Dr. Christopher Kunz

@christopherkunz.bsky.social

glm-5.3 auch mal wieder on topf of the Dinge, heute: Denglisch. "Das scrambling ist effectively a one-time-pad applied to letters: identity, frequency, vocal class, keyboard relations are all destroyed."

Dr. Christopher Kunz

@christopherkunz.bsky.social

Und jetzt ist er beleidigt: ❯ Warum sprichst du denglisch mit mir? Können wir uns mal auf eine Sprache festlegen? ✻ 503 {"error":"no upstreams available"}

Dr. Christopher Kunz

@christopherkunz.bsky.social

Your daily dosis of copium, presented by emudhra.com

Dr. Christopher Kunz

@christopherkunz.bsky.social

Ich arbeite gerade an meinem Vortrag für die it-sa. Im Wesentlichen werden es wohl 30 Minuten hiervon. Video: https://chaos.social/@christopherkunz/117506324683088006

Dr. Christopher Kunz

@christopherkunz.bsky.social

In the wake of eMudhra and php2shell, I had two distinct "told you so" moments. First, the underlying issues that led to php2shell were called out by Stefan Esser in the early 2000s and were the reason for his hardended-php patch and the Suhosin extension. [1/2]

Dr. Christopher Kunz

@christopherkunz.bsky.social

Second, the catastrophic incompetence of CAs is not new. This is a screenshot from a presentation I held at OSDC in 2012. Told you so. But nobody would actually listen. [2/2]

Dr. Christopher Kunz

@christopherkunz.bsky.social

The week so far: https://www.youtube.com/watch?v=uLeAot4Zrxo

youtube.com - YouTubeEnjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

Dr. Christopher Kunz

@christopherkunz.bsky.social

POV be like

Dr. Christopher Kunz

@christopherkunz.bsky.social

TIL: Doing a live TV interview with the sound of Mastodon retoots in the background is slightly distracting.

Dr. Christopher Kunz

@christopherkunz.bsky.social

🫠

Dr. Christopher Kunz

@christopherkunz.bsky.social

Oh, an RCE in Bind too? Oh COME ON. CVE-2026-94300 What's next, Sendmail?

Dr. Christopher Kunz

@christopherkunz.bsky.social

Und weiter geht die wilde Fahrt, jetzt live im WDR2 zu KI&IT-Security am Aufhänger php2shell.

Dr. Christopher Kunz

@christopherkunz.bsky.social

So the "Virtual Patches" for php2shell are WAF rules that block RFC1867 uploads with more than 50 files? That doesn't sound very convincing...?

Dr. Christopher Kunz

@christopherkunz.bsky.social

Nun, dies eskalierte zügig. Vier weitere Interviews - verliere langsam den Überblick.

Dr. Christopher Kunz

@christopherkunz.bsky.social

Ich bin jetzt live im SWR Hörfunk zu der php2shell Sicherheitslücke und ordne das Thema für die Hörer ein.

Dr. Christopher Kunz

@christopherkunz.bsky.social

Aus der 2. Auflage meines Buchs (Koautoren: Stefan Esser, Peter Prochaska) zu PHP-Sicherheit. 2007. Stefan hatte die ganze Zeit den richtigen Riecher.

Dr. Christopher Kunz

@christopherkunz.bsky.social

If you run your own Debian/Ubuntu mirrors, for example because you are one of Germany's biggest dedicated/virtual server hosters, and there's a whole bunch of urgent PHP update packages incoming, and you are not updating your mirrors, then you should REALLY get crackin'. [1/2]

Dr. Christopher Kunz

@christopherkunz.bsky.social

# curl -sI https://mirror.hetzner.com/ubuntu/packages/dists/noble-security/InRelease | grep -i "Last-Modified" Last-Modified: Wed, 21 Oct 2026 09:45:37 GMT [2/2]

Dr. Christopher Kunz

@christopherkunz.bsky.social

In slightly happier news, the first interview request for php2shell landed before the first verified exploit.

Dr. Christopher Kunz

@christopherkunz.bsky.social

Now that the updates are out, and I can finally show the article for php2shell https://heise.de/-11494897 This has been long in the making, as I was part of the disclosure process and helped with liaising to (amongst others) CERT-Bund. [1/2]

heise.dephp2shell: Critical flaws allow code injection in PHPTwo flaws expose PHP web servers to remote attacks. Versions from the past 20 years are affected; admins should patch.

Dr. Christopher Kunz

@christopherkunz.bsky.social

I'm glad this is out, even though it leaked a day ahead of time. Now, it's time to watch the web burn, I'm afraid. [2/2]

Dr. Christopher Kunz

@christopherkunz.bsky.social

And here we go. Maybe we should set up a torrent for the PHP src tarballs, php.net is slightly sluggish right now.

php.netPHPPHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

Dr. Christopher Kunz

@christopherkunz.bsky.social

I really hope that my previous workplace has continiued to maintain the PHP applications that were due to be switched off soon during the post-merger integration phase. In June 2023.

Dr. Christopher Kunz

@christopherkunz.bsky.social

Most of the darknet forums that I know of are currently down. I wonder why that is.

Dr. Christopher Kunz

@christopherkunz.bsky.social

A new version of the "jackal" poc just landed, now brings its own lab environment. Still can't get it to fire, anyone else more successful?

Dr. Christopher Kunz

@christopherkunz.bsky.social

Weiß nicht, wie's euch so geht, aber wenn ich mir das Internet heute anschaue, möchte ich auch gern 384 Bit trinken.

Dr. Christopher Kunz

@christopherkunz.bsky.social

In a related note, could I please make a request for more Death or Black Metal as background music in poc videos? I'm listening to an uncomfortable amount of non-metal music today.

Dr. Christopher Kunz

@christopherkunz.bsky.social

While you wait for the PHP update, you might as well update your ca-certificates package on Debian/Ubuntu; the updated version completely removes trust in the emSign CAs.

Dr. Christopher Kunz

@christopherkunz.bsky.social

Yay. Dumpster Fire.

Dr. Christopher Kunz

@christopherkunz.bsky.social

Oh COME ON.

Dr. Christopher Kunz

@christopherkunz.bsky.social

The "jackalsyn" PHP RCE PoC is built against lsphp (LiteSpeed SAPI), not stock php-fpm, for whatever reason. It also notably seems to bark up against the wrong tree. [1/2]

Dr. Christopher Kunz

@christopherkunz.bsky.social

I tested it against a stock PHP on a fresh Hetzner Ubuntu VM (php-fpm 2:8.5+99ubuntu1) and it does not seem to work. No RCE, not even a worker crash on both purported exploits (618/619. I'd be interested to hear from someone who achieved either. [2/2]

Dr. Christopher Kunz

@christopherkunz.bsky.social

Der Podcast zum heutigen Tag: Mordlust Nr. 256 „Gefahr im Verzug“. Besser kann mam das Dumpsterfire, das der 21.10. werden wird, nicht zusammenfassen.