Appsec adventures

OpenAI's php2shell-checker is a PHP version checker that produces a version-based PHP2Shell warning from a website's PHP headers or a local installation. It offers two skills, phpcheck-server for use when you have server access and phpcheck-url for when you only have a URL, and it can also be run directly with Node. It reports one of three results: OK with exit code 0 if the advertised version meets an upstream fixed release, POTENTIALLY VULNERABLE with exit code 1 if the version is in an affected range, and UNKNOWN with exit code 3 for missing, unrecognized, or prerelease versions or a failed check; JSON output is available via a flag. The upstream fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 from the October 21 PHP advisory, and versions below a listed fix, including PHP 5.4 through 5.6, 7.0 through 7.4, 8.0 and 8.1, return the vulnerable warning even with higher patch numbers. URL mode reads X-Powered-By and Server headers, sends HEAD with a GET fallback on 405 or 50...

Trail of Bits released two plugins, patching-bugs and regression-hunt, that let AI agents handle bug reproduction, patch development, and regression checking while engineers direct and review the work. The plugins grew out of the company's Patch the Planet initiative with OpenAI, which has produced hundreds of security patches for open-source projects. A review of more than 130 merged patches confirmed 21 regressions, none of which broke a security protection, and highlighted the need for standardized, repeatable patching and regression-checking workflows with strict schemas, live proof-of-concept evidence, and project-supplied threat models and patching guidelines. In preliminary evaluations, regression-hunt produced 25 percent fewer false-positive findings than a baseline Codex agent, though its strict evidence requirements left some known regressions classified as borderline. Trail of Bits plans to evaluate patching-bugs, analyze agent traces, and make the plugins more configura...

a website created by cryptographer Matthew Green that estimates how much public cryptanalysis effort different public-key cryptographic assumptions have received, and what that effort would cost under assumed AI productivity . The project starts from roughly sixteen thousand candidate papers, classifies the cryptanalytic work on problems including ECDLP (elliptic-curve discrete logarithm), structured and plain lattices, and syndrome decoding, and converts publications into estimated research-allocation years through a person-level author map . A headline finding is that lattices have only recently overtaken elliptic curves on this cumulative measure—a reminder that the newer post-quantum assumptions have had far less time under adversarial scrutiny than the older ones most deployed systems rely on today . The site includes a detailed bibliography and a "who's working" section showing top cryptanalysis researchers by field . Caveats matter: the authors warn that publicatio...

Apple's Security Engineering and Architecture and Camera & Photos teams introduce Apple Reference Image, an opt-in camera mode debuting on the main sensor of iPhone 18 Pro and iPhone 18 Pro Max that lets a photographer create a securely timestamped reference image accurately reflecting what the camera sensor captured. The post argues that AI-generated and altered photorealistic images make "it looks like a photo" insufficient when a photograph's essential role is to prove something happened, and that existing C2PA-based approaches fall short: they sign after capture, remain vulnerable to compromise anywhere in the editing chain, and can tie images to a public identity, endangering photographers in conflict zones. Apple's design meets three requirements: semantic authenticity (the image faithfully shows what the sensor captured, with processing publicly verifiable), resilience to compromise (including sensor removal, cryptographic attacks, and jailbreaks), and ...

A BBC News report on a cyber attack that hit hundreds of French supermarkets, causing fridges and freezers to heat up and spoiling fresh and frozen food estimated to be worth millions of euros. Hackers gained control of the software regulating refrigeration temperatures, forcing some units to warm to 50C overnight—one chain's fridges reportedly stayed at that temperature for six hours, and in some places there were even small fires. The attack targeted software from Danish engineering firm Danfoss that lets retailers manage cold units remotely; Danfoss said the affected units were older models whose security software could not be updated to address a risk it had identified, and that it had long advised businesses to keep supported systems up to date. More than 100 Coopérative U supermarkets were targeted, while 180 Intermarché and Netto stores were affected and another 100 were urgently disconnected from the internet. Carrefour, Monoprix, and E.Leclerc were also hit; Carrefour repo...

PCMag Principal Writer Neil J. Rubenking, who has reviewed antivirus software for nearly 40 years and installed well over a thousand apps, shares eight mistakes people make when installing antivirus and how to avoid them. The advice: be aware of all the features you paid for, including add-ons like VPNs, password managers, and bonus apps that only appear in the app's online console; skip installing features you don't want, especially browser extensions that hijack your homepage, new tab page, or search engine, and proprietary browsers offered during install; keep everything up to date, since manual update checks often surface updates the app claims don't exist, and confirm frequent update checks are configured; always run a full scan after installing, because the "initial scan" offered at the end of setup is often a quick or smart scan rather than a full look; schedule scans, since full scans and real-time protection don't always handle malware the same way, s...

Dan Haiem, CEO of AppMakers USA, explains how AI provider keys end up exposed in mobile apps and what a secure setup looks like. The piece opens with a Wake Forest University study of 444 iPhone AI chatbot apps, 282 of which exposed paid AI access through their network traffic—researchers simply watched what apps sent over the network and collected credentials as they passed, letting anyone run AI requests on the developer's account. Worse, when the researchers warned all 282 developers and waited three months, only 28% had clearly fixed the problem. Haiem attributes the problem to speed to launch (calling the AI provider directly from the app skips building a backend), AI-generated code that ships unreviewed with keys in config files, prototypes quietly becoming production apps, and the false belief that a compiled app hides its secrets. The study sorted leaks into three patterns: replayable tokens (136 apps—tokens that leak and stay valid far too long, one expiring in 2125 and an...