Towards 2000 by Raymond Williams is prescient. Definitely worth a revisit particularly relating to Wales, what he called Plan X which is the politics of being unable to solve societies problems. And the left could not simply promise the same outputs under different ownership.
1/2
This should be a cast iron warning to any government closer to home. Like down the Bay.
bbc.co.uk/news/articles/cvj6…
Brilliant
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
In 1999 I was working for Sony R&D in Oxford, one of only 20 people and between us we were running over 200 computers - Sun Microsystems, DEC Alphas mostly onsite. One day a Y2K contractor turned up in a 911 Turbo to update all our machines. It took weeks. This reminds me of that
Tegid Roberts retweeted
BBC Monitoring has an interesting article on how Russian TV has covered some recent events in Wales - specifically the September indy match and Plaid/SNP/Sinn Fein meeting - in the broader context of increasing references to UK sescessionist movements monitoring.bbc.co.uk/product…
Exactly right. I have some experience in this industry, having NED a video game company for a number of years in the past. WG Dev Bank was not interested at all.
WG should sell this on the back of resilience & upkeep costs.
Compared to overhead lines, underground lines have a lower risk of starting a wildfire and reduce the risk of the supply being interrupted by outages during high winds, thunderstorms or heavy snow or ice storms
1/
😳
I spent last night watching my honeypot server get hit 14,000 times in six hours.
And almost none of the traffic was human.
I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.
The shape of the threat has changed.
When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.
These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.
The numbers coming out of October are the ones keeping me up.
Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.
Ransomware incidents jumped 41% in a single month.
In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.
In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.
A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.
I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.
What I want people outside the industry to understand is why this specific moment feels like a hinge.
For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.
An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.
The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.
I'm not writing this to spiral anyone out.
Most of this fight genuinely isn't yours to win.
But the small things still matter more than people think.
Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm.
It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.
@mattshumer_ has summed it beautifully.
Drop everything and go give it a read. Nothing is more important than this article right now.
Absolutely nothing to see here.
NSA and others releases guidance on applying prevention tactics to strengthen defense of U.S-based programmable logic controllers being targeted by cyber actors using AI. Learn more:
media.defense.gov/2026/Aug/1…
#cybersecurity #AI
Oh dear
“In late spring 2020, a source I knew to be reliable called me with a story,” writes Matthew Cole. “The Dutch government had hacked into Jared Kushner’s phone and monitored him as he accessed a Dubai-based bank account. What was odd, the source said, was that the money in the account—hundreds of millions of dollars—had come from a bank in Azerbaijan. Most importantly, Kushner appeared to have transferred significant amounts of money from the Dubai account to other individuals, including a warlord, a mercenary and a one-time hit man. The story sounded preposterous, I told my source. And yet.
Six months later, I found myself speaking with someone else about the UAE government and their use of mercenaries in conflicts around the Middle East and Africa when I asked, on a whim, whether they knew anything about Kushner and bank transfers from a UAE account. My acquaintance grew quiet. Then they replied, ‘Yes.’” Kushner’s lawyer denied the bank account existed.
Read an exclusive excerpt from Cole’s book, ‘Princes and Thieves: Jared Kushner and Mohamed bin Zayed’s Secret Plot to Remake the Middle East’: vanityfair.visitlink.me/Q5_W…
Tegid Roberts retweeted
🔔 Saron ED (Sir Gaerfyrddin - Carmarthenshire Council) By-election result:
🌼 Plaid Cymru GAIN from Labour
Congratulations to Cllr Nicholas Craig Davies
Well disappointing though it is it takes some nerve for Drakeford who was for decades either behind the scenes or at the helm to say this as the WG during his time did nothing to reform council tax in Wales.
Excellent - and scathing - from @MarkDrakeford on Plaid Cymru's broken promise on Council Tax reforms.
There are already winners and losers in the system, and currently those who lose out are those least able to afford to do so.
Tegid Roberts retweeted
Back before 2008, a few savvy investors realised the bubble was about to burst, and purchased credit default swaps that would pay out when it did.
Today, there's a surge in CDS trading again - this time, linked to the debt of the big tech companies.
graceblakeley.substack.com/p…















