Java developer with a twist in security. DevOps & OpenStack enthusiast. OWASP member. Opinions my own.

47.743017, -86.934128
Joined April 2009
Sergio Martínez retweeted
“Security is like Tetris: Your successes disappear but your failures pile up.” — Mikko Hyppönen
4
75
1
474
17,378
Sergio Martínez retweeted
Algún día cuando ya estén grandes entenderán que la “derecha” y la “izquierda” es un cuento que les venden para seguirlos manipulando. Solo existen los intereses.
30
307
20
1,401
22,832
Sergio Martínez retweeted
¿Ya se les olvidó? Ariadna Montiel hoy se da baños de pureza. Pero fue denunciada por peculado... ¡ en el año 2023 ! Según la denuncia, desvió dinero del pueblo a Morena y a Claudia Sheinbaum. ¿Y que creen? La denunció fue de una diputada.. ¡ DE MORENA ! Inés Parra Juárez, denunció a la Sria. del BienestarMxOax ante la FGR por quebrar el erario público... ¡ por $6,068 millones de pesos! 👇
57
2,656
66
4,474
37,798
Sergio Martínez retweeted
🚨 Henry Cavill was spotted drunk on the streets of London after discovering that his girlfriend, Natalie Viscuso had been cheating on him, only to later find out that their 1-year-old daughter allegedly isn’t biologically his. 💔
369
369
93
5,085
918,844
Sergio Martínez retweeted
A goal worthy of a Ballon d'Or winner 🏆 #ballondor
315
6,163
310
90,640
3,139,194
Sergio Martínez retweeted
A moment for the history books ✨
232
2,579
200
23,175
410,136
Sergio Martínez retweeted
“No permitiremos que Francia se deslice hacia la mexicanización con la presencia de cárteles”, dijo Marine Le Pen al iniciar oficialmente su campaña presidencial en Francia.
411
999
163
3,382
104,555
Sergio Martínez retweeted
DOLPHINS WIN!!! I REPEAT DOLPHINS WIN !!!
4
98
8
725
13,449
Sergio Martínez retweeted
Another TD for Caleb Douglas 👊
1
4
31
1,335
Yeeeeiiiiiii 🎉🎉🎉🎉🎉
THAT'S A DIVISIONAL DUB ‼️ #PhinsUp
28
Sergio Martínez retweeted
If builders built buildings the way programmers write programs, then the first woodpecker that came along would destroy civilization. -- Gerald Weinberg, The Psychology of Computer Programming, 1971.
Replying to @TaliaRinger
The fact that we tolerated a world where basically all our software was insanely buggy and everyone knew this is kinda crazy when you think about it for a few seconds.
32
73
8
477
12,339
Sergio Martínez retweeted
Everyone in tech is panicking about security right now. But outside of it, almost nobody knows anything is wrong. I wrote this so you don’t have to be the one explaining it to your family. Just send them this.
147
1,389
94
6,613
1,560,884
Sergio Martínez retweeted
Mercados cayendo, vulnerabilidades en Internet, agentes hackeando, economía desplomada.
12
33
10
242
5,534
The last 48 hours of cyber news is 🔥: • PHP: critical RCEs • LiteLLM: compromised release • eMudhra: CA private keys compromised • GitLab: CVSS 10 RCE • FortiSIEM: public RCE exploit • Signal: call hangup flaw • Oracle: 1,295 security patches Respect to the teams responding.
7
15
3
51
8,949
Sergio Martínez retweeted
Vaya forma de chingar al trabajador.
82
651
17
1,927
84,587
Sergio Martínez retweeted
🔐 Node.js security updates are now available! New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues. Review the details and update your systems to stay secure. 🔗 nodejs.org/en/blog/vulnerabi… #NodeJS #Security
134
2,995
500
12,589
1,256,296
Sergio Martínez retweeted
The eMudhra compromise is an absolute joke. This isn't a standard data leak it's pure, unadulterated structural incompetence. 8 globally trusted intermediate CA keys were generated with basically zero cryptographic entropy. 😠 A standard NIST P-384 private key needs 384 bits of entropy so it's mathematically impossible to crack. Yet, the blokes at @eMudhra generated production keys with 3 to 8 bits. The actual private key values were literal single digits like 4, 56, and 115. This is playground-level stuff. Infuriatingly amateur. How does a private company with zero fundamental grasp of public key infrastructure even get global root trust? Indian regulatory and auditing bodies make us look like complete idiots. They treat cybersecurity like a casual compliance checkbox instead of critical national infrastructure. This failure leaves the entire internet with a massive cleanup job. Browsers blocked these keys fast, but millions of unmaintained Linux distros, embedded IoT tech, Docker containers, and backend apps are completely exposed out there. If you're an everyday user (not a developer), you still need to fix this on your personal devices right now: Update everything: Force-update your web browsers (Chrome, Edge, Firefox, Safari) and your operating systems across your laptop, Mac, and mobile phone. Don't wait for auto-updates manually trigger them in your settings. Test your device: Go to emudhra.we-have-a-problem.co… Verify the result: If your browser blocks the site and says "Did not connect" (or throws a certificate error), you are safe. If the website opens normally, you are still vulnerable. If you're running Linux, Python, Go, or Node infrastructure: Stop what you're doing. Manually update your ca-certificates bundles, pins, or drop a system-level blocklist immediately to prevent traffic interception. The casual negligence of these agencies shouldn't be your vulnerability.
39
252
21
2,148
139,627
Sergio Martínez retweeted
🚨 ¡Se extingue la Modalidad 40 del IMSS! Millones de personas la han usado para mejorar su pensión, pero el decreto publicado hoy en el DOF le pone fin. Si tienes tu trámite en curso, te urge leer esto para saber cómo va: 👇 dof.gob.mx/nota_detalle.php?…
96
521
36
969
155,018
Sergio Martínez retweeted
Quote: "an independent security researcher reported that the keys of eight eMudhra Global TLS intermediate Certificate Authorities were cryptographically weak". Well, yeah, they were weak. A private key should look something like this: 84ac06790886c80c48d31691fd4c0fe9 ce3207f9807f2fe571d6e4ec426d7864 4298fc53df2b92566970e757ac998c34 Instead, their keys looked like this: 00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000004
Global TLS Intermediate CA incident: We’ve updated our incident page with how it happened, who is affected (one US customer ecosystem), what’s not affected, and what we’re putting in place. We will publish the root cause once our investigation is complete. 👉emudhra.com/en/post/certific…
Readers added context they thought people might want to know
eMudhra minimizes the scope by claiming only "one US customer ecosystem" is affected. In reality, 8 of its CA certificates had catastrophically weak private keys (one being simply the number 4), allowing anyone to forge trusted HTTPS certificates for any website on the internet.blog.google/security/prote…
34
120
11
760
49,914
Sergio Martínez retweeted
You guys have been hearing me say the Internet’s going to become unusable right? I’m not the first one to have said it by the way, but I usually say it when it becomes important. Normie speak 📡: “PHP is the behind-the-scenes engine that runs a huge chunk of the internet. Imagine a website like a restaurant. HTML/CSS is the menu and the pretty plates you see. JavaScript is the waiter who takes your order and chats with you at the table. PHP is the kitchen staff working in the back — it takes your request (login, search, post a comment, load a product page, etc.), talks to the database, and sends the finished page to your browser. You never see the PHP code itself; it runs on the server. It was created in the mid-1990s and is still everywhere because it’s relatively easy to use and free. It powers: •Most WordPress sites (which themselves run a massive portion of the web) •Wikipedia •Countless online stores, forums, blogs, and company websites Recent data shows PHP is used on roughly 70% of websites where the server-side language is known. Why the news about critical vulnerabilities matters. The cybersecurity post you saw is warning that PHP has two serious security flaws (rated 9.2 out of 10). These are described as remote code execution vulnerabilities — basically, a way for an attacker to potentially tell a website’s server “run this code I wrote” from anywhere on the internet. Because PHP is so widespread, a bug like this can affect a lot of sites at once. Think of it like discovering a master key that works on a huge number of apartment buildings. The PHP team is releasing emergency fixes later today (October 21, 2026, around 10 a.m. Eastern / 14:00 UTC). For regular people: You don’t need to do anything unless you run a website or server yourself. Site owners and hosting companies are the ones who need to update PHP as soon as the patches drop. Older versions of PHP (especially anything before PHP 8) may not get official fixes at all, which is a common problem with very old software. In short: PHP is the invisible workhorse behind a ton of websites, and right now that workhorse has a couple of critical security problems that need patching quickly.”
‼️ PHP Warns of Two Critical 9.2 Security Vulnerabilities, Urges Users to Prepare for Patches Details: cybersecuritynews.com/php-to… The PHP security team has warned users about two critical vulnerabilities and urged administrators to prepare for an upcoming security release. Both flaws carry a CVSS v4.0 score of 9.2. Updates are scheduled for Wednesday, October 21, 2026, at 14:00 UTC, giving website owners and hosting providers a short window to prepare. Public reporting links the upcoming fixes to CVE-2026-109618 and CVE-2026-109619. Security firm watchTowr describes them as reported remote code execution vulnerabilities, which could allow attackers to run their own code on affected servers. However, PHP’s advance notice does not name the CVEs or explain how the flaws work. Reports suggest the vulnerabilities could affect PHP versions from PHP 5 onward. #cybersecuritynews
33
444
22
1,946
165,731