Taggart

taggartinstitute.orgThe Taggart Institute: Master Your CraftThe Taggart Institute exists to provide low-cost, high-quality technology training to everyone in a welcoming, supportive community.

11 Nov 2024

Hey hey new friends! Perhaps a reintroduction is in order: I'm Taggart, and I make low-cost, high-quality tech educational material. Career educator, IT Director, and now threat hunter. Sometimes I stream, but rarely these days. Also interested in surviving the omnicrisis. taggartinstitute.org

Taggart reposted

ifin.networkGoAhead TLS Vulnerabilities Break Certificate Validation, Session EncryptionLast Updated: 2026-10-27T20:12:12Z (UTC) CVEs: CVE-2026-115881, n/a, CVE-2026-115884 CVSSv4: 9.1, 5.9, 7.4 What’s Happening On 2026-10-26T07:00:00Z (UTC), research firm FoxIO published a blog post concerning three vulnerabilities in the TLS implementation of the GoAhead embedded web server. This web server is commonly used in network appliances, including devices from Palo Alto Networks, D-Link, Siemens, and others. Three separate vulnerabilities are disclosed. The first and most severe, C...

Do you use mutual TLS with your network appliances? You might want to check whether they use a vulnerable version of the GoAhead web server, which has some significant weaknesses in its client certificate verification. ifin.network/t/goahe... #ThreatIntel #IFIN

Taggart reposted

ifin.networkCVE-2026-111497: Brotli Out-of-Bounds Write Impacts Node, PythonLast Updated: 2026-10-27T20:00:43Z (UTC) CVSSv4: 9.2 What’s Happening On 2026-10-21T07:00:00Z (UTC) NodeJS patched a High severity vulnerability in the runtime involving the Brotli compression decoder. The vulnerability was a buffer overflow that could lead to remote code execution. On 2026-10-22T07:00:00Z (UTC), Imperva published a report demonstrating the remote code execution. Notably, Node was vulnerable in a default state, as was the express request handler. Imperva called this “Node2...

CISA has added the Brotli vulnerability to the KEV list. While evidence of successful exploitation outside labs is scarce, we have detection opportunities in our thread. ifin.network/t/cve-2... #ThreatIntel

Recommend you upgrade to Kakarot compression ASAP

Taggart reposted

youtube.com- YouTubeEnjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

Wanna know more about IFIN? Executive Director Taggart was just at JawnCon to explain how we started and what we're about. www.youtube.com/live... #ThreatIntelIsMutualAid

dataminr.comExamining the Vulnpocalypse and Defensive Responses - DataminrCVE volume isn’t the problem, but exploitation speed is. Learn why defenders must shift from “assume breach” to “assume exploitation.”

Great work from Joe Slowik on rationally handling the vulnpocalypse.

ifin-intel.orgFinding the Signal in the Vulnerability Noise | IFINThe flood of new CVEs can make it hard to know what matters. But there are tools to help find our way.

Mirrors what we wrote about the situation:

Taggart reposted

ifin.networkWhatsApp GhostPairing attacks in Europe using the WA.FISHER phishing kitLast Updated: 2026-10-25T14:46:59Z (UTC) What’s Happening A WhatsApp GhostPairing phishing is going around in Europe. Phishing lures are sent from compromised accounts to known contacts. Since August 2026 there is more public reporting on the ballet competition-themed lure in multiple countries. Casting a vote initiates a device-sync and leads to an account takeover. Indicators are available in the public MISP feed (uuid 3b08d9b4-c7e7-4d5b-8632-3d7d213e7298) The WA.FISHER phishing platform ...

While everyone (including us) was losing their heads about PHP and Brotli, our community was tracking a widespread WhatsApp Phishing campaign in Europe. Domains and TTPs in this excellent thread. ifin.network/t/whats... #ThreatIntel #IFIN

Gonna need someone to explain how much I should trust the revenue and opex numbers in Anthropic's filing for IPO. www.sec.gov/Archives...

This in particular doesn't pass the sniff test. Anthropic is claiming a net positive revenue in 2026 so far, with a massive increase in Q2. It may be worth noting how they're accounting for the compute/infra expenses.

Taggart reposted

ZAP by Checkmarx

@zaproxy.org

Replying to @zaproxy.org

All ZAP versions from 2.14 use the old Brotli library, but as usual only the latest version of ZAP will receive the patch. We strongly advise those of you running old versions of ZAP to update to 2.17.0

Taggart reposted

George Pearkes

@peark.es

*ANTHROPIC FILES PUBLICLY FOR US IPO www.sec.gov/Archives/edg...

sec.govsec.gov

github.comGitHub - KillaBoi/StealMyBitcoin-PoC: A public release of the Steal My Bitcoin challengeA public release of the Steal My Bitcoin challenge - KillaBoi/StealMyBitcoin-PoC

The winner of the stealmybitcoin[.]com exploit challenge has a remarkably good writeup on the #PHP2Shell exploit process. The PoC clearly explains what's involved in targeting and calibration for any given PHP version/deployment.

What this tells us is exploitation requires knowledge of: 1. PHP version 2. Reasonable address spaces for the heap 3. PHP worker count 4. Exact offsets for all of the above Blind attacks are highly likely to fail unless allowed to continue for some time.

Oh yeah and this is all mod_php. None of this works the same way against PHP-FPM.

The real vulnpocalypse was the slop we read along the way.

Anyone claiming "AI removed the cost" for the binary analysis and exploitation of #PHP2Shell doesn't know ball.

The "cost" was understanding binary exploitation, which it turns out mere mortals have done for a while now.

Taggart reposted

threddy 🦖

@threddyrex.org

Code on My Phone

Taggart reposted

ifin.networkCVE-2026-111497: Brotli Out-of-Bounds Write Impacts Node, PythonLast Updated: 2026-10-23T15:39:23Z (UTC) CVSSv4: N/A On 2026-10-21T07:00:00Z (UTC) NodeJS patched a High severity vulnerability in the runtime involving the Brotli compression decoder. The vulnerability was a buffer overflow that could lead to remote code execution. On 2026-10-22T07:00:00Z (UTC), Imperva published a report demonstrating the remote code execution. Notably, Node was vulnerable in a default state, as was the express request handler. Imperva called this “Node2Shell,” but we wi...

We've updated this story to reflect the wider impact of the vulnerable Google Brotli library. Action is likely necessary.

IFIN@ifin-intel.org

Node and Python were feeling left out, so here's an RCE that needs attention. The Node issue, referred to as #Node2Shell, appears fairly exploitable. Check your Node versions and update. Check for affected Python packages as well. ifin.network/t/cve-2... #ThreatIntel

In this house, the Australian dog show is basically Darmok and Jilad. "Bluey, when she cleaned up the duck cake." "Bingo, when Judo ran away."

Taggart reposted

NSF–DOE Rubin Observatory

Hey, has IFIN been valuable to you this week? We sure would appreciate some support of the mission. We're a registered nonprofit and rely on community support to keep the lights on! ifin-intel.org/support #ThreaIntelIsMutualAid

Taggart reposted

@rubinobservatory.org

🗣️ This is your flight captain speaking 🪶✈️ Keep your seatbelts fastened as we glide across NSF–DOE Rubin Observatory's view of the Seagull Nebula! 🔭🧪 On your screen, you’ve got a front-row seat to young stars reshaping their stellar neighborhoods. Sit back, relax, and enjoy!🪽

Taggart reposted

Really loving how everyone with an AI agent is a cybersecurity expert now

Taggart reposted

@benjaminjriley.bsky.social

The Phermi Paradox: If #PHP2Shell is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over? Some possibilities:

Taggart reposted

Benjamin Riley

Replying to @benjaminjriley.bsky.social

But we need more than wolf containment. We need a reclaimation of the essential humanity of education. Empathy, kindess, curiosity, people at education conferences roll their eyes at this. The terminally online roll their eyes too. And that is exactly why we can win this fight.

The Phermi Paradox: If #PHP2Shell is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over? Some possibilities:

View full thread

3: The exploited won't know it's happening and won't report it. This is hardly a new phenomenon PHP sites have been exploited for years without anyone noticing (see: Slot Gacor).

Exploitation won't look like the internet blinking off. It'll look like a bunch of gambling pages and piracy hosted on school and municipal government websites. Such attacks can lie quietly on PHP sites for years before anyone bothers to look.

The Phermi Paradox: If #PHP2Shell is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over? Some possibilities:

View full thread

php2shell.censys.comPHP2Shell services

Patching isn't done, surely, but I think the most enticing targets for notable attacks probably moved quickly. It's also worth noting that status dashboards like php2shell.censys.com are mostly a fairy tale. Look at the bottom for some whopper disclaimers.

OS backports to versions other than PHP's official patched versions will muddy the picture, as will the **50% of PHP services that don't report versions**. I'm not saying most of the internet is patched; I'm just saying But let's not ignore the alternative:

The Phermi Paradox: If #PHP2Shell is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over? Some possibilities:

View full thread

They didn't show what pregaming they did to prepare the exploit for those specific targets. So far, it seems like some prior work is necessary to get proper offsets, heap layouts, and payload shapes to exploit properly. And that's assuming the mod_php SAPI, which responds differently than PHP-FPM

2. Patching was aggressive and major targets had time to get in front of this. For larger orgs, I believe this is accurate. The message was clear enough, and there was time enough to get any org with a half-awake IT team to circle the wagons.

The Phermi Paradox: If #PHP2Shell is so gnarly and so many systems are vulnerable, why hasn't half the internet fallen over? Some possibilities:

1. The exploit is still non-trivial and building the full attack chain is taking some time. This is at least partially true. I've yet to see a fully reliable proof-of-concept exploit that addresses all versions of PHP. Calif and Wiz showed exploit videos against targets.

So yeah, just checking in. Doesn't seem like the internet fell over. Doesn't seem like we're seeing an autopwn exploit ruin everyone's day. Patching quickly was prudent, but the initial comparison to Heartbleed/Log4Shell (including my own) was a bit hyperbolic.

ifin.networkCVE-2026-109618, CVE-2026-109619: Remote Code Execution in PHPLast Updated: 2026-10-22T05:59:07Z (UTC) What’s Happening On 2026-10-21T07:00:00Z (UTC), PHP published an advisory about two critical vulnerabilities in PHP. CVSSv4: 9.2 for both. These vulnerabilities is being actively exploited in the wild. The GitHub security issue has also now been published. PHP has also published a detailed blog post detailing the timeline of these vulnerabilities’ discovery, remediation, and disclosure. CISA has published an advisory urging immediate patching. Th...

This is the power of community. IFIN Staff (it's more than just me!) reviewed this observables in detail to make sure they passed muster. These are behavioral indicators that go beyond a list of attacker IPs.

IFIN@ifin-intel.org

As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed. ifin.network/t/cve-2... #ThreatIntel

Taggart reposted

"How are you doing?" Me:

Taggart reposted

We will have useful detections for #PHP2Shell in our post and in MISP shortly. We're doing rigorous validation to make sure we don't provide nonsense.

With all due respect to those making the claims, "trust us, bro" can't cut it for what we're trying to do. Observables (IoCs) or it didn't happen.

IFIN@ifin-intel.org

After reviewing the "evidence" of exploitation of #PHP2Shell and finding it wanting, we have removed the "EITW" tag from our story.

Taggart reposted