Somebody posted a github repo that claims to have about a dozen or so PHP 0days.
Based on vulnerability count, words per document, and the self-congratulatory `Publication-ready security research` right at the top, I have to say that it has all of the AI […]
[Original post on infosec.exchange]
This is how a true CTI firm should be. They tried. They have the EDR and Sigma for the worldenders that exist on my ACD421/PHP
PHP didn't even request me to make it private. See pinned post.
13 likes · 6 reposts · 560 views
ACD421/PHP Sooooo many vulns
@J4ck3LSyN @Archknight23
This is a credit theft attempt dressed up as process.
I found the bug. I put the work on a public GitHub. PHP security wrote me back and @IlijaTovilo admitted the PoC is based on my finding.
Then he said the person who refiled it through security@ / GHSA "will get the credit … because that's how it works."
That is a lie about CVE rules.
CVE CNA Operational Rules §5.2.4: credits are optional (MAY). Nothing says the inbox refiler gets finder credit and the person who identified the vulnerability is erased.
The CVE Record Format separates finder (identifies the vulnerability) from reporter (notifies the vendor/CNA). Those are different roles.
CVE-2026-115560 is still Reserved. The record is not published yet. They are deciding credit now, in email, against their own admission.
Same thread, he accused me of "potentially 0-daying the entire world" and "giving the recipe to every person on the planet." Then he moves to strip finder credit from the person whose work he just admitted using.
Video is the full chain. Watch it. Do not take my word. Take theirs. We won't get credit. We won't get thanked. We won't get paid. PHP has been lying to you all and its time we hold them accountable. Stop using PHP. Find something new. Get rid of tech debt and bad security teams.
@WIRED @TechCrunch @DarkReading @SecurityWeek @motherboard @KimZetter @josephmenn @MITREcorp @TheRecord_Media @IlijaTovilo @ThePHPF @official_php @CVEnew @CISAgov @TheHackersNews @arstechnica @briankrebs @BleepinComputer @troyhunt @SwiftOnSecurity @campuscodi @TheRegister @Girgias
#CVE #CVE2026115560 #PHP #PHPsec #OffSec #FullDisclosure #PublicDisclosure #HackThePlanet #BugBounty #InfoSec #CyberSecurity #SecurityResearch #CreditWhereItsDue #OpenSourceSecurity #GitHub
22 likes · 9 reposts · 1,408 views
Publication-ready security research: unpatched vulnerabilities in PHP, NativePHP Mobile, and Windows PHP builds. Turnkey repro scripts, raw receipts, weaponized exploit chains.
ACD421/PHP
24 likes · 6 reposts · 4,928 views
ACD421/PHP
I MADE IT BETTER, FASTER, STRONGER, BATMAN......
seriously @ThePHPF get your shit together............You had access to non public models and this is the best you can do? post patch exploited future patch already exploited. @nativephp something there for you as well. @CISAgov @CISACyber When is the KEV? because this should have been one in August.......now it is even worse after a shit patch.
14 likes · 5 reposts · 956 views
ACD421/PHP
@ThePHPF
@nativephp
@ubuntu
All those vulns I promised have fun.
Have a good weekend!!!!!
@J4ck3LSyN
@Archknight23
$PHP
Stocks up 😄 🤣 😂 😆
37 likes · 14 reposts · 4,846 views
Mentions
Somebody posted a github repo that claims to have about a dozen or so PHP 0days. Based on vulnerability count, words per document, and the self-congratulatory `Publication-ready security research` right at the top, I have to say that it has all of the AI […] [Original post on infosec.exchange]
This is how a true CTI firm should be. They tried. They have the EDR and Sigma for the worldenders that exist on my ACD421/PHP PHP didn't even request me to make it private. See pinned post.
ACD421/PHP Sooooo many vulns @J4ck3LSyN @Archknight23 This is a credit theft attempt dressed up as process. I found the bug. I put the work on a public GitHub. PHP security wrote me back and @IlijaTovilo admitted the PoC is based on my finding. Then he said the person who refiled it through security@ / GHSA "will get the credit … because that's how it works." That is a lie about CVE rules. CVE CNA Operational Rules §5.2.4: credits are optional (MAY). Nothing says the inbox refiler gets finder credit and the person who identified the vulnerability is erased. The CVE Record Format separates finder (identifies the vulnerability) from reporter (notifies the vendor/CNA). Those are different roles. CVE-2026-115560 is still Reserved. The record is not published yet. They are deciding credit now, in email, against their own admission. Same thread, he accused me of "potentially 0-daying the entire world" and "giving the recipe to every person on the planet." Then he moves to strip finder credit from the person whose work he just admitted using. Video is the full chain. Watch it. Do not take my word. Take theirs. We won't get credit. We won't get thanked. We won't get paid. PHP has been lying to you all and its time we hold them accountable. Stop using PHP. Find something new. Get rid of tech debt and bad security teams. @WIRED @TechCrunch @DarkReading @SecurityWeek @motherboard @KimZetter @josephmenn @MITREcorp @TheRecord_Media @IlijaTovilo @ThePHPF @official_php @CVEnew @CISAgov @TheHackersNews @arstechnica @briankrebs @BleepinComputer @troyhunt @SwiftOnSecurity @campuscodi @TheRegister @Girgias #CVE #CVE2026115560 #PHP #PHPsec #OffSec #FullDisclosure #PublicDisclosure #HackThePlanet #BugBounty #InfoSec #CyberSecurity #SecurityResearch #CreditWhereItsDue #OpenSourceSecurity #GitHub
Publication-ready security research: unpatched vulnerabilities in PHP, NativePHP Mobile, and Windows PHP builds. Turnkey repro scripts, raw receipts, weaponized exploit chains. ACD421/PHP
ACD421/PHP I MADE IT BETTER, FASTER, STRONGER, BATMAN...... seriously @ThePHPF get your shit together............You had access to non public models and this is the best you can do? post patch exploited future patch already exploited. @nativephp something there for you as well. @CISAgov @CISACyber When is the KEV? because this should have been one in August.......now it is even worse after a shit patch.
ACD421/PHP @ThePHPF @nativephp @ubuntu All those vulns I promised have fun. Have a good weekend!!!!! @J4ck3LSyN @Archknight23 $PHP Stocks up 😄 🤣 😂 😆