engineering @solanafndn | Techno, Rust, Solana, Et al.
Portugal
Joined April 2011
- Tweets90.8K
- Following706
- Followers3K
- Likes59.2K
tiago.oak retweeted
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
tiago.oak retweeted
Consolidation is happening in blockchain.
Apps are moving to infrastructure that has:
→ Handled the most traffic
→ Consistently increased capacity
→ Proven institutional-grade security
Only one network clears that bar for critical financial infrastructure.
Solana.
tiago.oak retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
tiago.oak retweeted
The AI-driven surge in vulnerability discovery and exploitation has begun. Three indicators from the past few weeks:
1. chatter that incident response firms are fully booked and overwhelmed with business (meaning breaches are happening even if we don’t see headlines)
2. a major certificate authority compromise (eMudhra)
3. the massive PHP vulnerabilities discussed today (CVE-2026-109618 and CVE-2026-109619)
AI is either directly discovering the vulnerabilities or is a means to rapidly exploit the issue at scale and low cost. The combination of low cost and scale means industries that skated under the radar because of attacker interest / ROI are now squarely in the attack crosshairs.
This applies to all companies, big and small. You are not safe because “hackers won’t come after industry XYZ”. They will.
The defensive needs are clear. We need to migrate from human-driven cyber defense to defense at the speed of computers. This is the position I laid out in December when I spoke to the House Homeland Security Committee subcommittee in DC about the threat of AI-powered cybersecurity attacks.
What should organizations do today?
This is not an exercise in being clever. Rather the need is to be comprehensive.
1. Understand your exposure - Establish an automated inventory of your packages, libraries, operating systems, full tech stack, etc.
2. Understand when you need to respond - Build automated monitoring systems that monitor public CVEs and cybersecurity chatter and cross-reference this with your inventory. Response time is moving from days to hours to minutes. You need automation and alerting.
3. Mobilize and plan for response - The issue will inevitably hit at 2am. How will you mobilize the right team members? Can you bring the system offline in moments (operationally, and do you have internal authorization)? What team members are needed? Do you have reliable paging and response? Practice now.
4. Reduce Attack Surface & fix issues you can now - AI chaining is increasingly tying together otherwise low-risk issues into critical outcomes. This means you either need to comprehensively analyze all known vulns to better understand if a low is actually a high risk issue. Or, lacking this capability, be more aggressive to fix known issues. One simple way to fix issues - remove the access and exposure. A device that can’t be reached is much harder to exploit!
This is not business as usual. Your cybersecurity posture and strategy over the next 18 months are an opportunity to survive when your competition fails (and they may no longer be a competitor at that point).
If you’ve been saying “We take cybersecurity seriously...” This is your chance to put your money where your mouth is.
tiago.oak retweeted
Happy Alpenglow.
Slot 459,653,000 was a boring, uneventful and yet spectacular 217ms migration.
Kudos to @anza_xyz @bw_solana @Ashwinningg @TheWattenhofer @qkniep and all the team!
Only possible on Solana.
tiago.oak retweeted
It's live! Congrats to everyone that helped get this done: core devs, the research team, validators, marketing, comms and a special shout out to the 🐐 @Ashwinningg
tiago.oak retweeted
Alpenglow is now live
- Vote transactions -> 0
- Finality -> 150ms
- TowerBFT -> Gone
⛰️⛰️⛰️
tiago.oak retweeted
In two hours @solana finality will be dramatically faster than credit cards!
