Internet2Shell: The Month the Web's Floor Fell Out

php2shell hit like a depth charge and the wire spent the rest of the month doing damage control. Credit @calif_io and @lcfr_hax for the discovery, @SinSinology for the two-word obituary -- "PHP 2 SHELL" -- and CVE-2026-109618 / CVE-2026-109619 for the paperwork. Assetnote did the decent thing and open-sourced a high-fidelity black-box scanner with detection logic published alongside, then turned around days later and shipped the same treatment for node2shell, with the detection smarts written by @hash_kitten. @0xLupin's verdict on the whole pile -- "Internet2Shell" -- is the only naming convention that survived contact with reality. @rez0__ did the grim math: hack a small company, make a little; hack a big company, make a lot; hack seventy percent of the web, make nothing. @ryancbarnett spent the fallout dusting off his 2011 Black Hat DC slides on correlating inbound and outbound traffic, politely reminding everyone who claimed to have "invented a new form of WAF" that the party started fifteen years ago.

The same stretch produced two of the cleanest chains we have read all year. @samwcyo and @infosec_au walked an RCE on ForgeRock all the way to remotely unlocking and issuing vehicle commands for two automakers, with the only prerequisite being a customer's name, email, or phone number -- @shubs' companion writeup covers the same fleet from the other hemisphere. Then @samwcyo, @sshell_, and @xEHLE_ popped a hosting provider and stole the WARDOGS server binary, granting arbitrary players unlimited XP and money from the comfort of a leaked artifact. Both are textbook examples of why an RCE is a gadget, not a finding, until you prove what document, tenant, or driveway it reaches. @wunderwuzzi23 quietly banked an Apple bounty for CVE-2026-64750 in the same window. No drama, just the CVE.

Quieter researchers dropped the best primitives. @kevin_mizu and @hash_kitten took Cloudflare's /cdn-cgi/image endpoint to XSS using what mizu believes is a new CSP bypass abusing the Cache-Control response header, chained with a sanitizer bypass -- worth diffing against every other CDN-fronted image resizer you have in scope. The Critical Thinking crew flagged a postMessage handler that trusts event.origin === "null": sandboxed iframes without allow-same-origin get opaque origins, unrelated frames share the same "null", and the origin check tells you precisely nothing about who is talking to you. And @albinowax noted a $300k payout for a trusted internal header -- his guess is Param Miner earned its keep on that one -- while simultaneously observing that programs which once screamed at you for pivoting now demand you break in, grab creds, and pivot as far as the architecture allows. The dupe economy does strange things to scope policy.

Supply chain was the other front. @0xLupin's crew at Depi gave @0xMadder and @_Worty six months to break things and they came back with a chain worth reading twice: injected content -> sandbox escape -> secret exfiltration -> a backdoored next release of a widely deployed coding agent, with the full writeup on depi.security. @wunderwuzzi23 traced a popular open-source gateway proxy where a key leaked on May 27 was discovered internally and simply never revoked -- exploited October 10 for GitHub creds and backdoored releases, four-plus months between exposure and boom. Same week, a DevOps engineer's laptop compromise -> service container -> unauthorized withdrawal transactions. The pattern is not clever exploitation; it is keys that outlive their welcome.

On the tooling bench: Assetnote's h3fuzz forks ffuf into HTTP/3 territory and pushes content discovery to 100k requests per second against QUIC-fronted hosts -- your ffuf workflow is now the slow lane. @Jhaddix resurrected WRAITH, a spiritual successor to BeEF combining blind XSS and browser hooking with live page mirroring, credential-capture popups, and local port scanning, plus labs. His SpikeStrip goes the other direction: reversible decoy strings, fake vulnerability leads, and math traps sprinkled into web source to poison automated scanners -- an ARTEX fork maintainer reportedly messaged him a very naughty word, which is the best endorsement a defense tool can get. @nmatt0's Mithril firmware scanner grew a --keys flag that catches eMudhra-style EC key flaws (unpack with Moria, analyze with Mithril), while @SinSinology's fixemudhra.com put a friendlier face on @Dennis__Jackson's research. Same researcher tore open Chinese industrial crane controllers with zero auth and wrote a Flipper app that captures a serial and transmits arbitrary commands; his gas company's propane monitor gave up hidden BLE commands that wake the cell modem.

Program economics shifted under everyone's feet. Google Cloud VRP added a $250,000 tier aimed at high-impact architectural research, then quietly capped the 1.2x Exceptional Quality bonus at $5,000 for reports filed after November 5 -- read both rule pages before you price your next chain. Chrome VRP restructured rewards across more severity tiers in the same month. @NahamSec posted a video on being limited to three reports after twelve years on HackerOne, Intigriti's CrowdRecon started paying for recon data even when no bug materializes, and @SinSinology caught a vendor repeatedly flipping its scoped instance "offline" after receiving one pre-auth RCE too many -- until a root shell on the device explained the pattern. Caido's v0.59.0 rounds it out with capture scoping (All traffic, In-scope, or custom Capture and Passthrough lists), multi-instance desktop, and ordered Match & Replace. The floor is cracked, the payouts are moving, and the scanners are open source. Diff accordingly.