Risky business
Austin, TX
Joined July 2012
- Tweets7.7K
- Following1.2K
- Followers603
- Likes6.3K
With AI agents, we are all "problem makers" now, whether that is our natural inclination or not
This doesn't necessarily mean "managers", though communication skills will certainly be more important than they were before
Clear thinking remains as important as ever
In a Twitter space with @eigenrobot and @michaelcurzi tonight I mentioned a half-baked idea I've been kicking around lately: a distinction between "problem makers" and "problem takers"
Two buttons meme:
* Be legible to insurers and governments so you can get a payout/bailout when your insecurity inevitably bites you
* Try to evade the vulnerabilities of the herd with heterogeneity by vibecoding everything, and bear sole responsibility for the whole stack
Remote code execution in MS Paint. What are we even doing anymore?
msrc.microsoft.com/update-gu…
> we need to hold on for ~18 months
eMudhra exiting the global SSL/TLS certificates business due to "social media"
emudhra.com/en/press-release…
"Like many of the largest businesses in the country, we were affected by the recent PHP vulnerabilities that were discovered and exploited by advanced artificial intelligence."
vs.
"We ran dozens of agents and told them 'make no mistakes' on our vibe-coded identity service."
BIND 9 (most popular DNS server) potential RCE. Combine this with the eMudhra certs and we might have us a gooood ol' time
Thankfully, sounds nontrivial to exploit
is it time to turn the internet off yet
kb.isc.org/docs/cve-2026-943…
*Cybersecurity LinkedIn guru voice*
You don't move fast enough. You don't do CI. All belt, no suspenders.
Solution: remove the "A" from the CIA security triad. We never cared about it anyway.
They can't hack what's already offline. You're not just secure; you're a trailblazer.
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Charles Neill retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
We are beginning to see what I feared years ago with LLMs: the robots find vulnerabilities at superhuman speed, patches land continuously to fix the latest issues, and humans struggle to keep up
Into this mess steps the supply chain compromise that owns you for moving fast
It's unfortunate that this probably isn't the last time we'll see something like:
Vendor discloses vulnerability under embargo to trusted parties -> FUD starts on X -> researchers say they maybe found it with LLMs -> trusted parties break embargo to look good to their own customers -> attackers get the patch to validate exploits -> people thinking they're prepared for disclosure still get popped early
"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."
thephp.foundation/blog/2026/…
To give you an idea of what this means, some joker generated a cert for google.com and "." that @censysio currently reports as trusted in all browsers they use for validation
platform.censys.io/certifica…
The government website where India tracks its legitimate CAs is currently down. I wonder why.
(This wildcard was *not* issued by one of the affected intermediate certs, to be clear. I'm sure that's cold comfort to them right now, though)
cca.gov.in/e_mudhra.html
