LCFR
@lcfr_eth
Followers
2K
Following
32K
Media
17
Statuses
113
My bug got published today😊 Exploits and writeups for PHP 5.X -> 8.4.X: https://t.co/3ZyTUyA31i As usual PHP does not consider such a bug as a security issue even though it bypasses security that results in direct memory access that can be used to bypass disable_functions or
🚨 New advisory was just published! 🚨 A vulnerability in PHP's extract() function allows attackers to trigger a double-free in version 5.x or a user-after-free in versions 7.x, 8.x, which in turn allows arbitrary code execution (native code):
3
18
80
This is the exact attack that drained Poo.Lend for 76 trillion dollars - reportedly it was inserted by DPRK operatives under direct order from the big K after successfully exploiting a privatekey leak attack hack. Be sure to look for this one on your next audit and follow me for
1
2
12
https:/ /data.ddosecrets.com/APT%20Down%20-%20The%20North%20Korea%20Files/ Twitter blocking the url.
🚨疑似朝鲜黑客组织Kimsuky APT 一名成员遭遇重大数据泄露，泄露数百 GB 的内部文件和工具。 🧐入侵大概发生在 2025 年 6 月初，暴露该组织复杂的后门、网络钓鱼框架和侦察行动，根据对泄露档案的分析，内部转储源自化名为“KIM”的 Kimsuky 操作员的两个受损系统。一个是运行 Deepin 20.9 的 Linux
0
0
3
New Gundam Wing manga for its 30th anniversary: https://t.co/7p5BREe54v
en.gundam.info
This is a special website dedicated to all the latest news, products, and information related to Mobile Suit Gundam Wing, celebrating its 30th anniversary in 2025.
0
0
2
Posting a throwback to some old web2->web3 boundry crossing bounties I reported years ago as duplicate ENS names are being discussed again (using unicode). First was registering invalid names with script tags that would be parsed by @etherscan even though they were invalid as
2
1
22
🚨 We got RCE on Solana 🚨 Finally revealing FULL details about the RCE vulnerability we found 2 years ago. Found it. Lost it. Exploited it anyway. 🔬 Here’s what real-world bug hunting looks like:
anatomi.st
Battle‑tested researchers securing billions in on‑chain value.
2
33
134
dropping a shitty exploit/poc for this bug (CVE-2025-49113) at: https://t.co/CDjusGPA5N Can be improved but I do not care to do more for a dead bug. The guzzle chain is probably better than GPG in case of disable_functions you could pair it with my extract() uaf to exploit
My research on CVE-2025-49113 is out. https://t.co/kuLczCSv6V. Happy reading! #CVE #roundcube #poc @FearsOff
0
4
14
this is so insane. kCTF has a first-come-first-serve policy when it comes to 0day bounties when an instance releases. this team hand crafted a proof of work solver with avx-512 instructions to beat everyone else with an 0day to the flag:
anemato.de
PoW is gone 🦀🦀
2
52
239
Follow up to the post from yesterday. Posting a https://t.co/GjLnSUpEDy script I use to search basic things - based on something I saw @bantg post somewhere awhile back. https://t.co/nMAD30apSe Can get the number of contracts + extract all current contract addresses (can
Just use cryo and save them all as parquets and use python to query the data? cryo contracts --rpc http://127.0.0.1:8545 --blocks 0 -c 999999 -o ${contract_dir}
3
4
18
Just use cryo and save them all as parquets and use python to query the data? cryo contracts --rpc http://127.0.0.1:8545 --blocks 0 -c 999999 -o ${contract_dir}
With an Erigon full node running on the same server as our code and running `trace_block` for every block starting from genesis, we successfully retrieved all deployed contracts and their bytecodes in around five days!
2
1
43
Uncovering Hidden Threats in Ethereum Virtual Machines 🚨 At #Zer0Con2025, we exposed critical vulnerabilities in Ethereum Virtual Machines (EVMs) using fuzzing. Here’s what you need to know 🧵👇 #Ethereum #EVM #Fuzzing #BlockchainSecurity
2
13
67
Still hilarious what PHP counts as "not a security issue" https://t.co/h4qY4fYA61 "this bug in xyz can bypass disabled_functions and leak all SSL certificates from all vhosts on a shared host - not security related!"
github.com
A collection of the policies and guidelines that set out PHP's development - php/policies
We are pleased to announce the completion of security audit of PHP core! Executed by @quarkslab in partnership with @OSTIFofficial and commissioned by the @sovtechagency. Learn more:
0
0
5
2
40
132
Keep installing those web3 wallet s/security/backdoor/ extensions.
I acquired a Chrome extension for $5 and began redirecting the browsing traffic of existing users to whatever I wanted. While doing so, I caught an ownership transfer of an extension with 400,000 installs that folks should be aware of. https://t.co/LOqaI54aBh
1
0
9
