php2shell Fallout, Cache-Control CSP Knifework, and a Month of Supply-Chain Backdoors

The php2shell firestorm dominated the wire, and the follow-through is what separates researchers from reposters. @calif_io and @lcfr_hax took the discovery credit, and @infosec_au did the unglamorous half that actually saves people: open-sourced a high-fidelity black-box scanner with detection logic for CVE-2026-109618 and CVE-2026-109619, shipped a sibling node2shell-scanner with logic @hash_kitten wrote late on a Friday, and dropped h3fuzz -- a ffuf fork with HTTP/3 support that pushes content discovery to 100k requests per second. Worth pulling tonight if you have QUIC-facing scope. Meanwhile @SinSinology confirmed phpbleed.com is pure HTML and CSS -- don't burn RAM on it -- and built fixemudhra.com on top of @Dennis__Jackson's eMudhra work so civilians could check their own exposure. That's textbook handling of a mass-exploitation event.

The quiet gem of the month was @kevin_mizu and @hash_kitten poking Cloudflare's /cdn-cgi/image endpoint into an XSS using what mizu calls a new CSP bypass primitive: the Cache-Control response header chained with a sanitizer bypass. Response-header-driven CSP escapes are rare birds -- diff every CDN image proxy you have in scope for the same response-header reflection -> cached-poisoned markup path. Same week, the CTBB crew flagged a classic that keeps paying: a postMessage handler trusting event.origin === "null" is trusting nobody, because sandboxed iframes without allow-same-origin get an opaque origin that serializes as "null" -- and completely unrelated frames share it. Grep your JS for that exact comparison; it's a five-minute audit with a fat payoff. Their reminder that CSS injection is more useful than people think pairs cleanly with @ryancbarnett's expanding Unicode attack surface work -- ghost bits and invisible characters are still shredding normalization logic a decade after we all should have fixed it.

The automotive chain reads like a movie script except it's just ForgeRock being ForgeRock. @samwcyo's writeup covers an RCE that let his team send remote vehicle commands for two automakers using nothing but a customer's name, email, or phone number, and @infosec_au matched it with the AU-side unlock for most of the world's X-brand cars. Identity confusion in the data plane -> command plane, same story everywhere. @samwcyo's second drop is nastier in spirit: an RCE on a hosting provider that let the team steal the WARDOGS server binary and grant any player unlimited XP and money. Hardware kept pace -- @nmatt0 tore into Chinese industrial crane controllers with zero security and wrote a Flipper app that captures a controller's serial number and spits arbitrary commands at the receiver, then reversed his own gas company's tank monitor to find hidden BLE commands that flip on the cell modem. His mithril --keys flag now flags eMudhra-style weak EC keys in firmware images -- pair it with the fixemudhra checker if you're auditing embedded PKI.

Supply-chain knifework deserves its own ledger entry. The LiteLLM timeline @wunderwuzzi23 laid out is brutal in the plain sense: a backdoor key leaked on May 27, the leak was found internally, the key was never revoked, and on October 10 an attacker used it to grab GitHub creds and poison releases -- more than four months between exposure and exploitation. 'Rotated' it was not. On the bounty side, @wunderwuzzi23 also banked an Apple payout for CVE-2026-64750, and @albinowax surfaced a $300k payout for a trusted internal header -- the exact bug class Param Miner was built to smoke out of forgotten edge infrastructure, and a reminder that cache-targeted param mining still prints money. The culture shift he flagged is real too: programs that once screamed at you for pivoting now demand you break in, grab creds, and go as far as possible -- which explains @SinSinology's grim discovery that a vendor kept flipping its own scoped instance 'offline' and unreachable right after he delivered pre-auth RCEs, until a root shell on the device explained why.

Tool drops closed the month. @Jhaddix reintroduced WRAITH, a spiritual successor to BeEF that folds blind XSS and browser hooking into one framework -- live page mirror, operator console, cred popups, local port scan, and labs to teach the bugs, built for authorized red teams. Its sibling SpikeStrip inverts the game: reversible decoy leads, fake vulnerability trails, and math traps planted in web source to poison automated pentest harnesses, with raw export for manual placement -- expect the arms race between decoys and detection to get loud. @rez0__ quietly took second overall at Google's bugswat in Singapore while submitting nearly a third of all bugs in a room of ~50 hackers, which is its own kind of zero-noise flex. If you want a fresh hunting angle before the next window: @nmatt0 noted WiFi-exploitable vulns identifiable by SSID prefix, where one wiglenet search is all it takes to geolocate a pwnable device. Start with Shodan-adjacent SSID corpora, work backward to vendor prefixes, and thank the hardware later.