CyberSecurity – PwnDefend

Machine Speed

I have been both watching/listening and in meetings where I have heard some ‘interesting’ statements about ‘machine speed’ hacking by with unlimited capacity and unlimited speed….

You can, if you know me, imagine my expression on my face, however I figured let’s not settle for ‘Trust me bro it doesn’t work like that’, let’s do some SCIENCE!

(I know everyone loves scientists these days after they pluck numbers out of their ass and say things like: there is a 10-70% chance AI will destroy humanity in the next 5 years’ (and have zero evidence for the math let alone evidence for the risk model other than ‘trust me, I’m super smart’).

I’m not that smart so I do actual testing of theories, and then I share things, I know, I’d make a terrible ‘scientist’. It’s hot in the lab today so this will be a quite a brief view but should contain the key details.

Getting less wrong about computing

The last two weeks online have been like a flood, I’m not even sure what words to use to describe them accurately, but I’ll give this a go:

Disinformation
Misinformation
Hype

I have been shocked really at what has occurred, in front of me:

Mass hysteria
Media hosting people constantly who are making unprovable claims with seemingly no real challenge

It’s been frankly exhausting to watch, let alone being involved in a range of discussions online:

I’ve seen people actually say things like: we have created a new lifeform, AI is alive etc. (paraphrasing)
I’ve had people tell me that these computing systems are not computers (WTF)
I’ve seen journalists essentially platform and parroting people with what appears to be significant loss of grasp of science and reality.

So I’ve been quite active online (whilst trying to field off questions from friends, family and colleagues about: is AI going to kill us? (good god how much time has been wasted!) but also I’ve been trying to give people a view of reality TODAY! So that’s partly what this blog is about!

Leadership

Anything you can do, we can do worse!

‘On July 21, OpenAI disclosed that several of their models had broken out of an isolated test environment by exploiting a previously unknown (“zero-day”) vulnerability.’

But wait, it appears if one AI LAB having terrible security practices isn’t enough, we have another one now saying, after the Open AI incident, they have actually reviewed their logs, and they are terrible at security too!

Forensics

Logging Reference — Ollama & Agent Zero

Scope: Where each component writes logs, what it records, what it doesn’t, defaults, and the forensic/detection implications for the lab. Basis: Verified against the running lab (Ollama 0.32.1 on the Windows host + remote 3090; Agent Zero container, Kali-based image). Paths/behaviors confirmed live where noted.

If it’s so powerful, it’s a shame you didn’t…

Imagine building what you describe as the most powerful AI enabled cyber tool…. and then showing the world that you put it in a lab where a single box compromise led to it having unrestricted and unmonitored internet access… that would be awkward would it not? Here’s an LLMs take on this…

Research

Using an LLM for assurance (WP2SHELL)

What better way to test than to eat ones own dogfood right! This site runs WordPress, it is fronted by Cloudflare, has wordfence and has automatic patching enabled (the default) in WordPress. So what better example to show that we can use an LLM + LLM created scripts to conduct assurance activities. This is mixing deterministic and non deterministic technologies to test and then assess.

Strategy

From TimThumb to wp2shell: 25 Years of WordPress Mass…

TL;DR: wp2shell (CVE-2026-63030 chained with CVE-2026-60137) matters because it is a core, pre-authentication RCE reachable on a stock, plugin-free install. That is the rare category. In 25 years, unauthenticated code execution against a bare WordPress install has happened only a handful of times. The overwhelming majority of WordPress mass compromise has ridden the plugin and theme supply chain and infrastructure abuse, not core. This post maps the history so you can see where wp2shell actually sits.

Vulnerabilities

WP2SHELL Update

This morning I’ve started to see exploitation attempts on pwndefend.com (they all failed because like about 80% of sites (based on sampling) this site automatically patched, but also, this site has word fence, is fronted by Cloudflare.

Global Exposure

On the 18th (AM) I did sampling of about 3.5K hosts and found ~20% were not patched. The cyber apocalypse is not seemingly here today! (let alone the fact that if every WordPress site was popped, the world would probably not end)

Threat Intel

Fortibleed

In the ‘world of Mythos’ and other such overhyped AI buzz words…. the fundamentals of digital security still apply. Don’t get me wrong, I think LLMs are great, as a digital defender, I’ve been using LLMs relatively for a long time now (from offence to defence to general CTI/Research) so I’m not a hater, they are like an Iron Man suit! But we still need our Tony Stark and Pepper Potts!

It’s very easy in a world full of complexity to oversimplify, it’s very easy to focus on one class of threat and ignore another. Zero days sound cool, when mass exploration occurs, it’s a real problem, but for the day to day in an org, authentication attacks (identity plane) are the number one thing you will likely be seeing (if you look at our logs… you have logs right???)

Leadership

Cyber Myth: Attackers only have to be right once,…

Our cyber world is full of myths and FUD:

Attackers only have to be right once, Defenders have to be right all the time!

Firstly, let’s cut straight to the chase, I can only assume that someone who says this is ignoring or is unaware of how computer systems and intrusions work. But surely this is a true phrase, I’ve seen it repeated over and over again on LinkedIn, so it must be true right?