Pinned Tweet
Cybernetics wasn't about robots as much as it was about systems that sense their environment, compare reality against a goal, act, observe the consequences, and adjust.
myth retweeted
I highly recommend cloudflare's security audit skill: github.com/cloudflare/securi…
Run it on all your software. Run it with the free models. Use it even if you used a model to audit something - it will find much more things. Works in all agent harnesses and is model independent.
myth retweeted
Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.
tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.
The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.
The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.
@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.
For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.
Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.
If you’re interested in learning more, you can read our blogs:
Vulnerable roots: blog.cloudflare.com/emudhra-…
PHP vulnerabilities: blog.cloudflare.com/php-vuln…
myth retweeted
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
myth retweeted
the good thing about the eMudhra CA private key mess is that we can finally use https on localhost
myth retweeted
In response to the eMudhra / emSign certificate security incident we've published guidance for Python users to update CA certificates: discuss.python.org/t/informa…
#security #Python #pki
discuss.python.org/t/informa…
myth retweeted
As if PHP2Shell wasn't enough for one day... now GitLab. 😅
🚨 CRITICAL GITLAB ALERT (CVSS 10.0)
CVE-2026-110264 could allow unauthenticated RCE on self-managed GitLab servers.
⚠️ Potentially affects 12 years of releases, dating back to 2014.
Patches available. Update immediately!
docs.gitlab.com/releases/pat…
#gitlab #cybersecurity
myth retweeted
Tested all 12 compromised eMudhra certificate chains (where an intermediate CA private key was literally 4) across macOS, mobile browsers, Go, Node, Python, and Java today.
Here is what is actually safe, what is still exposed, and two gaps in the current macOS workarounds.
1. What is already safe (don't panic)
• Desktop browsers: Chrome, Safari, Edge, Brave, and Firefox (158.0.1+) are safe.
• iOS & Android in-app browsers: X on iOS (SFSafariViewController) and updated Chrome Custom Tabs on Android enforce Certificate Transparency (requiring >= 2 valid SCTs). Since zero fraudulent certs were logged to CT, they reject all 8 keys automatically.
• Mobile exceptions:
- Firefox on Android < 158.0.2 had a startup bug (Bug 2084311) where OneCRL didn't sync. Update to 158.0.2 (out today).
- Android 13 and older don't get Google Play system CA updates, so apps using raw Android WebView (where CT is off by default) still trust the roots unless you disable `emSign` and `Comodo AAA Services` under Settings -> Security -> Encryption & credentials -> Trusted credentials.
2. Two gaps we found on macOS today (even after running the official workaround)
Safari is safe because it enforces CT. Non-browser tools on macOS (`curl`, `git`, `python3`, `nscurl`, and `Go < 1.27.3`) do not enforce CT.
When testing all 12 chains on an updated Mac today, 9 were blocked, but all 3 `G3B` chains (`dv-g3b`, `ov-g3b`, `ev-g3b`, private keys 156, 155, 115) still returned HTTP 200:
• Why: Apple's Valid DB set `checkOCSP = 1` instead of removing the `emSign ECC Root CA - G3` root. `ocsp-c.emsign.com` (`G3C`) is up and returns `revoked`, so `G3C` is blocked. `ocsp-b.emsign.com` (`G3B`) is currently down returning `HTTP 503`, so macOS `Security.framework` soft-fails open and trusts `G3B`.
• Why the `/etc/ssl/cert.pem` workaround still returns HTTP 200 on `G3B`: Apple's `/usr/lib/libcrypto.46.dylib` (`X509_verify_cert`) links `TrustEvaluationAgent.framework`. When a cert isn't in `/etc/ssl/cert.pem`, Apple's LibreSSL falls back to `Security.framework`, hits the 503 on `ocsp-b.emsign.com`, and approves the cert anyway.
Fix on macOS (also works without sudo on MDM-locked work Macs):
1. Strip the 2 roots into a clean bundle:
awk '/^(###|===) /{skip=0} /^=== .*\/CN=(AAA Certificate Services|emSign ECC Root CA - G3)$/{skip=1} !skip' /etc/ssl/cert.pem > ~/.ca-cert.pem
2. Disable Apple's TrustEvaluationAgent fallback and point CLI tools to the clean bundle in `~/.zshrc`:
export OPENSSL_X509_TEA_DISABLE=1
export SSL_CERT_FILE="$HOME/.ca-cert.pem"
export CURL_CA_BUNDLE="$HOME/.ca-cert.pem"
export GIT_SSL_CAINFO="$HOME/.ca-cert.pem"
3. Backend runtimes (bundle their own CA stores and ignore OS updates)
• Node.js: Update to v22.23.4, v24.22.1, or v26.12.1.
• Go: Update to Go 1.27.3 or 1.26.10 and recompile binaries (hardcodes SPKI blocklist in `crypto/x509`, bypassing the macOS 503 soft-fail).
• Python: Update inside every virtualenv (`pip install -U "certifi>=2026.10.19" "pip>=26.2.2"` and `uv >= 0.13.4`).
• Rust: Rebuild with `webpki-roots >= 1.0.10` / `rustls-webpki >= 0.103.16` (`rustup >= 1.29.2`).
• Java (OpenJDK / Oracle): No upstream release yet. Delete both roots from `cacerts`:
keytool -cacerts -storepass changeit -noprompt -delete -alias emsigneccrootcag3
keytool -cacerts -storepass changeit -noprompt -delete -alias comodoaaaca
• Linux / Docker: Update `ca-certificates` (Ubuntu `20260816ubuntu0.24.04.1`, Debian `20250419+deb13u1`, Alpine `20261020-r0`, Fedora `2026.2.92_v9.0.319`, Arch `3.131.1-1`) and rebuild base images.
Verify any CLI or runtime with:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. HTTP 200 = still exposed.)
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
myth retweeted
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.
If you run either stack in production, keep an eye on official advisories and apply patches promptly.
Security maintenance doesn't stop at your application code. Your runtime matters too.
Node.js advisory: nodejs.org/en/blog/vulnerabi…
Yes, if you code (vibe code included) you are affected and you should patch your systems.
This is not a drill.
‼️ BREAKING: 8 Private keys belonging to eMudhra intermediate certificate authorities (CA) have been compromised.
Chrome and Firefox blocked the affected certificates within hours. Go, NSS, and other software have issued fixes.
Full details - thehackernews.com/2026/10/ei…
myth retweeted
It's worse than Heartbleed. it should be on the front page of every newspaper in the morning (but it wont be)
It's so weird living in a tech dominated world where everyone has a smartphone and is on the internet constantly..
..yet most people will never even hear about this.
myth retweeted
What a terribly poor situation. And it happens because of lack of actual meritocracy in India.
What is eMudhra business model? Regulatory capture. What is their competency? Being in cahoots with the govt.
All govt organisations and PSU banks use them and they are one of the “recognised” authorities to digitally sign documents and all that - why? Because they had “contacts” in government to get into this position
No private company actually use them of course because the experience of using them is dogshit and no one competent enough trusts them.
But after getting such large PSU banks and orgs in India on board they went to other South Asian and Middle Eastern countries and got them onboard as well. And as of last week before the certificates were breached many popular financial institutions were using them.
Like if someone brute forced their certificates; within first 256 attempts all 8 intermediate certificates would be gotten.
Till now only reason they were not; was because no one thought it would be useful to brute force 2^384 combinations. Basically they never locked the door and no one actually tried to push it open all these years.
myth retweeted
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next. cfl.re/487DNbG