Risky business
Austin, TX
Joined July 2012
- Tweets7.7K
- Following1.2K
- Followers604
- Likes6.3K
> we need to hold on for ~18 months
eMudhra exiting the global SSL/TLS certificates business due to "social media"
emudhra.com/en/press-release…
"Like many of the largest businesses in the country, we were affected by the recent PHP vulnerabilities that were discovered and exploited by advanced artificial intelligence."
vs.
"We ran dozens of agents and told them 'make no mistakes' on our vibe-coded identity service."
BIND 9 (most popular DNS server) potential RCE. Combine this with the eMudhra certs and we might have us a gooood ol' time
Thankfully, sounds nontrivial to exploit
is it time to turn the internet off yet
kb.isc.org/docs/cve-2026-943…
*Cybersecurity LinkedIn guru voice*
You don't move fast enough. You don't do CI. All belt, no suspenders.
Solution: remove the "A" from the CIA security triad. We never cared about it anyway.
They can't hack what's already offline. You're not just secure; you're a trailblazer.
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Charles Neill retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
We are beginning to see what I feared years ago with LLMs: the robots find vulnerabilities at superhuman speed, patches land continuously to fix the latest issues, and humans struggle to keep up
Into this mess steps the supply chain compromise that owns you for moving fast
It's unfortunate that this probably isn't the last time we'll see something like:
Vendor discloses vulnerability under embargo to trusted parties -> FUD starts on X -> researchers say they maybe found it with LLMs -> trusted parties break embargo to look good to their own customers -> attackers get the patch to validate exploits -> people thinking they're prepared for disclosure still get popped early
"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."
thephp.foundation/blog/2026/…
To give you an idea of what this means, some joker generated a cert for google.com and "." that @censysio currently reports as trusted in all browsers they use for validation
platform.censys.io/certifica…
The government website where India tracks its legitimate CAs is currently down. I wonder why.
(This wildcard was *not* issued by one of the affected intermediate certs, to be clear. I'm sure that's cold comfort to them right now, though)
cca.gov.in/e_mudhra.html
Charles Neill retweeted
$50K First Letters Prize awarded to Erwin Nieuwlaar for finding text in PHerc 343! This is the first time in nearly 2000 years that anyone has read text in this rolled scroll. Our papyrologists reckon it’s part of the expression πᾶ̣ν τ̣ὸ γιν̣όμ̣ε̣[νον, “everything that happens/is generated”
Concerning report from @huggingface here:
> A malicious dataset abused two code-execution paths in our dataset processing... The campaign was run by an autonomous agent framework... executing many thousands of individual actions across a swarm of short-lived sandboxes...
