Reliability & Scale Engineering; Big on Linux ~ built and led the @CentOS project once.
London & Cambridge, UK
Joined November 2008
- Tweets4.9K
- Following107
- Followers14.8K
- Likes894
Karanbir Singh 🐧 retweeted
Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers msft.it/6010aFLKw
PHP2Shell, a Brotli decoder vulnerability, and the eMudhra certificate authority key issue each require attention. Microsoft is updating the services it operates and releasing fixes for affected products.
Customers should review the issue-by-issue guidance for updates and actions in environments they manage: msft.it/6012aFIEO
So is this like an enterprise product where customers get fixes before the community?
Today, we're launching @LiteLLM Private Registry
With AI agents, public security patches can give attackers a blueprint to exploit vulnerabilities.
For the most severe vulnerabilities, LiteLLM Private Registry gives organizations time to upgrade before we publish public patches
If you are going to Fosdem you should join the CentOS team there. If you are not going, you should.
The CFP, registraion, and room block are all available for CentOS Connect, happening January 28-29 before FOSDEM. Join us in Brussels and show us what you've been working on.
centos.org/events/connect/
#CentOS #CentOSConnect
Well, we seem to have our work cut out here. What's a good way to collect names of hosters who still have it turned off ? I would be happy to start a dialog, see if there is anything to be done about it.
Do you use a hosting company? What is their SELinux policy ?
34%default On : Enforcing
47%default Off : permissive
19%what is SELinux ?
32 votes • Final results Karanbir Singh 🐧 retweeted
The @fosdem cfp's are coming in - are you going ? To speak ?
Karanbir Singh 🐧 retweeted
‼️ Attackers are exploiting a critical Fortinet FortiSIEM flaw that lets them run code without logging in, Canada's Cyber Centre says.
Horizon3 released an exploit for CVE-2026-106173 on Oct 20. Version 7.5.1 fixes it.
Fortinet still lists the flaw as not known to be exploited.
Karanbir Singh 🐧 retweeted
Fantastic to see this in the BBC site. Ultimately, open source and the Linux ecosystem exists purely because of the great people in it.
bbc.co.uk/news/articles/cw30…
Alright campers, rise and shine. We have patches to apply, cve hysteria to enjoy and other such fun things to start our weekend off right.
"Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell."
nitter.click/AikidoSecurity/…
Karanbir Singh 🐧 retweeted
Ruby’s turn 😅
Remember the GitLab bug? Well now it moved upstream into Ruby.
Multiple 10.0 CRITICAL exploits.
Patch now 🚨
Happy Friday 🤠
ruby-lang.org/en/news/2026/1…
Karanbir Singh 🐧 retweeted
The PHP security team is advising everyone to set this config until the next patch:
session.upload_progress.enabled=0
I’ll be cutting a release shortly where serversideup/php will do this for you by default ⚡️
php.net/archive/2026.php#202…
Dear @BBCNews you are going to need a replaced Cyber Correspondent
What
🚨 CONFIRMED: PHP has officially acknowledged another RCE vulnerability, CVE-2026-115560, affecting specific session configurations even after the October 21 patches.
A separate issue, not a bypass of the original fixes. A patch is planned.
We've updated our defensive toolkit:
github.com/syhunt/php2shell-…
#php #cybersecurity
Karanbir Singh 🐧 retweeted
In response to the eMudhra / emSign certificate security incident we've published guidance for Python users to update CA certificates: discuss.python.org/t/informa…
#security #Python #pki
discuss.python.org/t/informa…
