AppSecOnSteroids @AppSecOnRoids

I built with PHP in my early years. It was a difficult time in my life, but I've since recovered.

We’re shutting down too. We don’t use php I just don’t wanna work tomorrow.

MalShare @mal_share

a day ago

We are aware of the PHP vulnerability and are shutting down for the weekend.

14 37 731 514K 43

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP. Here is the short version of what happened and who got hit. 1. eMudhra (Trusted CA compromise) eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs. One of the intermediate CA private keys was literally the number 4. The other seven: 56, 66, 115, 155, 156, 230, 237. Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket. • Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs. • Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10). • 10-second check on any server: curl dv-g3b-emudhra.we-have-a-problem.com (TLS error = safe. 200 OK = still vulnerable.) 2. PingCAP / TiDB Cloud (10.6 TB breach) Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents. Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets. Who is affected in the leaked records: • Live credentials exposed in support tickets: - Pinterest: AWS keys for their pingcap-logs S3 bucket - CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets - DeBank: 38 presigned S3 URLs - An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys) • Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed: - Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap - E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook - Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM - Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life - Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase • Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery): - 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash. If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket. 3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619) Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch. Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c). Because C-level multipart parsing runs before line 1 of index.php: • App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it. • Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1). • Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.

I still have memory of doing this as a 2-3 year old kid. Like I clearly remember.

gal౨ৎ @prtygal777

4 days ago

such a precious moment

2K 54K 599K 67.4M 42K

Death of beauty.

Franz von Holzhausen @woodhaus2

5 days ago

Designed, engineered, and made in America

2K 3K 39K 1.4M 954

Sex is the most intimate thing two people can do. If you can repeatedly share that intimacy with strangers and walk away without a second thought, I don't believe you have capacity for love and bonding. You basically exist as an animal. I have never understood hookups.

the dream

Polymarket @Polymarket

6 days ago

JUST IN: Chinese bride surprises her groom with a $12,000 Nvidia RTX 5090 GPU at their wedding, bringing him to tears.

keyboard_arrow_left Previous keyboard_arrow_right Next

637 2K 27K 1.4M 2K

My new obsession - portals.

@MistaksWerMade Been saying the same. We already have flying cars - we call them helicopters. How about figuring out portals.

At this point, i want lex luthor portals not flying cars.

Prediction: the Tesla Roadster won’t make production. Such a gimmick.

ITS NOT A FLYING CAR. It jumps at best.

We still do not have flying cars despite this gimmick.

Elon Musk @elonmusk

6 days ago

Turns out the future does have flying cars

48K 100K 834K 78.5M 64K

What even is the point here?

Tesla @Tesla

6 days ago

Real life, baby

19K 97K 777K 97.5M 88K

@WatcherGuru Disappointing

We will never forget this iconic scene, Walter White Jr. RIP

Pop Base @PopBase

a week ago

‘Breaking Bad’ star RJ Mitte has died by suicide at the age of 34, TMZ reports. (tmz.com/2026/10/12/rj-…)

7K 34K 430K 25.5M 32K

STOP BENCHMAXXING.

I mourn the lack of good comedy shows in the last 10 years.