Reliability & Scale Engineering; Big on Linux ~ built and led the @CentOS project once.
London & Cambridge, UK
Joined November 2008
- Tweets4.9K
- Following105
- Followers14.9K
- Likes893
So is this like an enterprise product where customers get fixes before the community?
Today, we're launching @LiteLLM Private Registry
With AI agents, public security patches can give attackers a blueprint to exploit vulnerabilities.
For the most severe vulnerabilities, LiteLLM Private Registry gives organizations time to upgrade before we publish public patches
If you are going to Fosdem you should join the CentOS team there. If you are not going, you should.
The CFP, registraion, and room block are all available for CentOS Connect, happening January 28-29 before FOSDEM. Join us in Brussels and show us what you've been working on.
centos.org/events/connect/
#CentOS #CentOSConnect
Well, we seem to have our work cut out here. What's a good way to collect names of hosters who still have it turned off ? I would be happy to start a dialog, see if there is anything to be done about it.
Do you use a hosting company? What is their SELinux policy ?
34%default On : Enforcing
47%default Off : permissive
19%what is SELinux ?
32 votes • Final results Karanbir Singh 🐧 retweeted
The @fosdem cfp's are coming in - are you going ? To speak ?
Karanbir Singh 🐧 retweeted
‼️ Attackers are exploiting a critical Fortinet FortiSIEM flaw that lets them run code without logging in, Canada's Cyber Centre says.
Horizon3 released an exploit for CVE-2026-106173 on Oct 20. Version 7.5.1 fixes it.
Fortinet still lists the flaw as not known to be exploited.
Karanbir Singh 🐧 retweeted
Fantastic to see this in the BBC site. Ultimately, open source and the Linux ecosystem exists purely because of the great people in it.
bbc.co.uk/news/articles/cw30…
Alright campers, rise and shine. We have patches to apply, cve hysteria to enjoy and other such fun things to start our weekend off right.
"Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell."
nitter.click/AikidoSecurity/…
Karanbir Singh 🐧 retweeted
Ruby’s turn 😅
Remember the GitLab bug? Well now it moved upstream into Ruby.
Multiple 10.0 CRITICAL exploits.
Patch now 🚨
Happy Friday 🤠
ruby-lang.org/en/news/2026/1…
Karanbir Singh 🐧 retweeted
The PHP security team is advising everyone to set this config until the next patch:
session.upload_progress.enabled=0
I’ll be cutting a release shortly where serversideup/php will do this for you by default ⚡️
php.net/archive/2026.php#202…
Dear @BBCNews you are going to need a replaced Cyber Correspondent
What
🚨 CONFIRMED: PHP has officially acknowledged another RCE vulnerability, CVE-2026-115560, affecting specific session configurations even after the October 21 patches.
A separate issue, not a bypass of the original fixes. A patch is planned.
We've updated our defensive toolkit:
github.com/syhunt/php2shell-…
#php #cybersecurity
Karanbir Singh 🐧 retweeted
In response to the eMudhra / emSign certificate security incident we've published guidance for Python users to update CA certificates: discuss.python.org/t/informa…
#security #Python #pki
discuss.python.org/t/informa…
Looks like it's real
An urgent notice from the Railway team
blog.railway.com/p/security-…
Karanbir Singh 🐧 retweeted
Quote: "an independent security researcher reported that the keys of eight eMudhra Global TLS intermediate Certificate Authorities were cryptographically weak".
Well, yeah, they were weak. A private key should look something like this:
84ac06790886c80c48d31691fd4c0fe9
ce3207f9807f2fe571d6e4ec426d7864
4298fc53df2b92566970e757ac998c34
Instead, their keys looked like this:
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000004
Global TLS Intermediate CA incident: We’ve updated our incident page with how it happened, who is affected (one US customer ecosystem), what’s not affected, and what we’re putting in place. We will publish the root cause once our investigation is complete.
👉emudhra.com/en/post/certific…
Readers added context they thought people might want to know
eMudhra minimizes the scope by claiming only "one US customer ecosystem" is affected. In reality, 8 of its CA certificates had catastrophically weak private keys (one being simply the number 4), allowing anyone to forge trusted HTTPS certificates for any website on the internet.blog.google/security/prote…
