Applying the Aneristic Principle to matters of AWS and IT infrastructure. Facts my own.
Düsseldorf
Joined January 2019
- Tweets3K
- Following607
- Followers426
- Likes8.5K
Pinned Tweet
For the 6,000+ #AWS service API endpoints, awsipv6.neveragain.de shows which endpoints support #IPv6 by default, and which require additional client configuration. Important when considering an IPv6-only VPC.
New: Daily updates and a list of recent changes.
This is the most ludicrous proposal I’ve read in a long time. It targets any traffic sent to French users, measured by ISPs, by source ASN. Even from French emitters. Not limited to large platforms!
Yeah, like that
We have discovered a substantial number of vulnerabilities in the German legal system using LLMs.
These may enable access to confidential documents, travel without an otherwise required visa, enforceable leave for soldiers at NATO’s JSEC, and more.
Similar to computer systems, the written law can contain vulnerabilities that invite exploitation. In our blog post, we share a selection of vulnerabilities, and present potential exploits for each. To our knowledge, none of these have been previously recorded. We share only those vulnerabilities whose exploitation we believe would not cause serious harm.
blog post: felixringe.com/legal-exploit…
Oh no.
In lieu of flowers, memorial contributions may be made to:
Johns Hopkins Alzheimer’s Disease Research Center Fund
alzresearch.org/giving/
Alzheimer’s Foundation of America Caregiver Resources
alzfdn.org/donate/
Photo Credit: Tommy Garcia
Without Nova, the European Sovereign Cloud’s Bedrock service only has Gemma.
This quoted post is unavailable.
Apparent Order retweeted
StealMyBitcoin is solved! This is the absolute best explanation you’ll see on how hard #php2shell is to exploit. The author had to trigger a precise memory corruption condition, leak internal memory addresses, bypass aslr, reverse engineer php’s internal memory structures, forge structures to hijack execution, and account for php build differences, worker behavior and timing to get RCE. 20 http requests with a 7 out of 10 success rate. What an amazingly successful CTF. Impressive the creator was able to keep the server up during all the attempts. With all the BS around it’s nice to see something concrete that moves the art forward.
github.com/KillaBoi/StealMyB…
Love this. The💰is still in the wallet. Finally we get some ground truth around how hard php2shell is to exploit. The amount of bullshit flying around from vendors capitalizing on the moment is staggering, And the alert fatigue they’re creating is really going to hurt when a mass exploitable RCE emerges. We still haven’t seen a production site hacked via #php2shell at Wordfence.
Apparent Order retweeted
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
It’s starting to get silly. Dario and Sam can’t stop smiling I guess.
BREAKING: UK government urges citizens to stockpile at least 3 days of emergency food & water amid the global cybersecurity crisis.
Readers added context they thought people might want to know
The UK government's advice to have 3 days of emergency supplies on hand is not directly related to current cybersecurity issues.
Recent cybersecurity incidents were referenced as an example of unexpected events that can occur, not as a direct reason to stockpile supplies.
bbc.com/news/articles/…
bbc.com/news/articles/…
I upgrade my MacBooks when the AWS Console is getting too slow to work with. The last time was on Intel. My M2 is approaching this point rapidly now.
Apparent Order retweeted
I'm going to plant a flag here: 2026 is going to go down in computer security history as the year of a million CVEs. (Maybe literally, but definitely figuratively.)
LLMs are producing lots of slop, but they're also finding a heck of a lot of real vulnerabilities.
With all the junk information that was going around for many hours before the patch release, and afterwards, it feels like the actual PHP GHSAs and this article ⬇️ were the only genuinely helpful pieces.
We built a working exploit for one of the PHP vulns. All you need to know is that you need to patch. Want more details? Read here:
securitylabs.datadoghq.com/a…
Apparent Order retweeted
PHP folks, please don't rely on the ini config change to protect your apps. It won't help when the full details are out - it only protects against a single vector, if that. You need to apply the patches as soon as they drop.
phpc.social/@joepferguson/11…
Apparent Order retweeted
Can we now do away with the whole CA nonsense and use DANE/RFC6698 in browsers? Yes, yes, it was great that the CIA/NSA could MITM every website, but it's time to move on.
Haha, ok, nevermind. Seems like work starts early today. jackalsyn.com/posts/php-up-2…