Head of Application Security focused on all things #AppSec. Occasionally dabble in my own research. Also keen gamer and aspiring photographer.
Earth
Joined October 2017
- Tweets29.4K
- Following600
- Followers17K
- Likes28.6K
Amazing how it works, inorder to gain benefits from the government they look at the household income. But when it comes to taking money, they look to Individual income.
This looks like more fun 🙄
Code-execution flaw in UEFI firmware threatens most servers on planet Earth arstechnica.com/security/202…
Readers added context they thought people might want to know
The vulnerability (CVE-2026-97631) only affects systems actively PXE network-booting using vulnerable EDK2 firmware; it requires sending malicious ICMP packets during that window and does not impact systems booting from local disks or with PXE disabled.
github.com/tianocore/edk2…
arstechnica.com/security/2026/…
“Awards” like this make me really frustrated. To me this isn’t an award, it’s marketing.
cybersecurity-excellence-awa…
So turns out the UK’s Online Safety Act has pretty much made no difference in terms of what it was intended for. This is why politicians should actually listen to those who know what they are talking about.
The intentions of the act were noble, but its execution was terrible and was never going to do what it was set out to accomplish.
The thing I don’t get regarding eMudhra certificate issues is that my understanding is that would have had to undergo an independent audit as per the CAB Forum requirements. How was this missed if that did happen?
Seems that they did, but something doesn’t quite add up.
Fore! eMudhra says it passed audits and made just a minor mystery error
More here:
theregister.com/security/202…
Some more joys, this time Java:
blogs.oracle.com/security/se…
Given this looks to be an out of band release, points to this likely being a critical vulnerability. Oracle’s website has limited details. However other sites point to this being an easy to exploit vulnerability: radar.offseq.com/threat/cve-…
It looks like this may be related to the eMudhra CAs that were compromised: openjdk.org/groups/vulnerabi…
Oh yippee 😁
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
If you running PHP anywhere you probably want to keep an eye on this.
Seeing some of the comments about outages caused by Google. It’s clear most consumers don’t see or care what happens behind the scenes. To them that particular company is responsible.
The same would apply to a breach via a 3rd party. Ultimately the optics are that your organisation was breached to many. They are likely to care much for the details behind it.
I seem to recall it was a Plex server that was exploited at an employees home that lead to a breach at an org. I could be wrong/mistaken though. None the less, important to patch if you are running a vulnerable instance.
🚨 Rapid Response: Plex Media Server RCE chain is being actively exploited.
Censys ARC sees ~340,000 Internet-exposed; ~30% run vulnerable builds.
Fewer than 2% of still-vulnerable hosts patched in 3 days after exploit publication. bit.ly/4dMS1SJ
ALT Censys ARC graph showing trends in vulnerability and fixed build releases from July to October. One line shows the decline of vulnerable builds from 100% in July to 31% in October. Another line indicates the increase in fixed builds, peaking at 70% in August. Notable events are marked, including the release of 1.4.3.1080 in August and Plex security notices. CVEs published on NVD and explicit exploit chain events are annotated.
It was the Lastpass breach that I was thinking of. It wasn’t clear which media server was breached but some speculation it was Plex: community.getchannels.com/t/…
