Founder of @Squid_Sec Senior AppSec Engineer / Software Engineer OSCP+ | GWAPT #Silversmith for fun and profit Built to Destroy Your company APT
Joined April 2016
- Tweets16.4K
- Following1.2K
- Followers2.1K
- Likes60.9K
Pinned Tweet
Deep dive into two bugs in PHP
Not your app
Not your framework
The engine
They both fire before your code loads
No login
No plugin
A page that prints "OK" is enough
Come get a shell on @Squid_Sec new php2shell lab
CVE-2026-109618 / CVE-2026-109619
squidhacker.com/2026/11/php2…
A "finished" CloudFront site returned 400 on every request and handed back its real S3 origin
The artifact repo behind it ran Nexus 3.68.1 which SquidScan identified two Critical RCE Class CVEs in
45 tools, one scan, all of the information you're looking for app.squidscanner.com/job/b7f…
7
This is our second grow of the last quarter of 2026
This girl has some massive buds. The biggest few easily are bigger than my palm
Can't wait to harvest this one 😁
1
57
☣️ Mr. The Plague ☣️ retweeted
Félicitations, vous êtes entrés dans l'HISTOIRE !
WoW: Forever a battu les records suivants :
🔹 Le plus grand nombre de joueurs simultanés de l’histoire de WoW
🔹 Le plus grand nombre de joueurs de retour dans l'histoire de WoW
Tout cela, c'est grâce à vous, la communauté. De la part de toute notre équipe, MERCI !
NGL being an Asian honey pot is on my short list of red team service offerings I'm considering
I'm good with chopsticks, math, and I like hot pot
Passionate about corporate espionage and looking for my next challenge as a honeytrap.
- 4+ years as a woman
- Experience in awkward flirting
- Dated almost 2 men
DMs are open. Feel free to tag anyone that's hiring! ⬇️󠄸󠅟󠅕󠅣󠄤󠄳󠄵󠄿󠅣󠄜󠄐󠄼󠄼󠄳
#openforwork
1
11
268
Happy birthday to all the devil dogs out there
Happy 251st Birthday to all of my Marine Brothers and Sisters out there today. May your cup never show its bottom, may there always be a Marine within arms reach, and may you wake up tomorrow in your own rack or at least one you recognize. Happy Birthday Marines! Semper Fi!
3
135
☣️ Mr. The Plague ☣️ retweeted
@bot can now connect to private MCP servers on your tailnet without exposing them to the public internet.
Powered by Tailscale OAuth apps, now GA, so you can build secure agent integrations, too.
Read more here: buff.ly/U1J9By1
NGL I've hired roofers for every single property we've owned over the last decade and a half
On occasion they get me to go up on the roof to show me stuff and the dude in this video is always me
... The one afraid to fall ... 😂
youtube.com/shorts/T3HAhk1kh…
104
☣️ Mr. The Plague ☣️ retweeted
Two pre-auth bugs in PHP itself
🚨CVE-2026-109618 & 109619 with a CVSS of 9.2!🚨
squidhacker.com/2026/11/php2…
Operators are standing by
Calling all CIO, CSO, CTO, CISO, VP and Directors of Engineering and Cybersecurity - This post is for you.
Squid Sec is starting to book penetration testing and red team engagements for 2027!
If you're looking for a US-based, high-signal penetration test in 2027, let's start scoping now and get you on the calendar before we're all booked up ~> SquidOffense.com
28
> do I regret leaving my corpo job at starbucks, 6 months later .....
<insert funny "No" meme here>
I'm just getting warmed up ya'll. 2027 is going to be lit
1
12
360
I just earned the "GraphQL Glimpse" badge on SquidScanner! 🦑 squidscanner.com/profile/Squ…
2
155