Christopher Harrison @Xchrisharrison

@levelsio Doesn’t really make sense let’s be honest

@SaidHaschemi Claude has NPC level dad joke humour too.

@thebeautyofsaas Zero to One by Peter Thiel

@justalexoki It’s the first article on the biggest news channel’s website in UK.

@freemanjiangg What is your general plan as to where you will work and buy equipment and supplies from etc I’m curious

@jackfriks Is this an M1 Max? I still have my 64gb one. Still blitzes everything lol. I reckon do the upgrade 18gb is not enough

@ZubyMusic It’s never been easier if you approach things properly yeah, but the distractions and bullshit have never been greater too - bad food, social media, the pathetic competition themselves, materialism etc

@lou3ee It’s not man. London is bad but NY is really bad 😆

@GrumpyAgencyGuy You should buy a Tissot PRX. Like 400 GBP, Swiss made and very classy and high quality. Loads of different colour styles. This is one of the very best watches you can get without a crazy price tag

@the_cia_hacker Cloudflare already did. People were exploiting it 4d before the announcement

@KingKong9888 Someone's on the other side of every one of those central bank buys. Who's selling?

@deedydas Worst part is it scales. One person with an agent can point it at every exposed PHP box on the internet overnight and there's no skill ceiling stopping them

@almokhtar_al Unexpected processes only catches the RCE though. The memory leak variant leaves no files or processes behind, just oversized PHPSESSID cookies and 500s, so rotate secrets anyway

Those chickens will need a password manager by 2028 😂 wild times x.com/Jason/status/2…

@jason @Jason

a day ago

Do php and nodejs now? Cybersecurity moving to top issue in crazy world Gonna buy more ammo and chickens

4 10 347 60K 44

Every self hosted GitLab since 2014 has had a bug that lets a stranger run code on the server holding all your source code CVE-2026-110264, CVSS 10.0, the maximum. It's an integer overflow in Onigmo, the regex engine built into Ruby. Feed it a specially crafted regex, GitLab gets the size of the compiled program wrong, writes broken instructions, and the attacker gets to run commands on your box The bit that should keep you up tonight: it runs as the git user. The one that owns every repo and very likely your CI secrets too And it's a sequel. On Oct 12 GitLab patched a sister bug (CVE-2026-97229, also a 10.0) where you commit a poisoned .gitlab-ci.yml to a public project and the regex compiler does the rest. The same researcher, joaxcar, has now found 4 code execution bugs in GitLab's regex engine in one month. Patched on the 12th? You're NOT done GitLab.com is already fixed. This one's for the self hosted crowd What to do rn: 1. Check your version at /help. Fixed is 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. Anything older than 18.11 needs to get to at least 18.11.13 2. Upgrade. There's no workaround for this one, patching is the only fix 3. Plan for downtime. 19.4.3 and 19.3.6 have database migrations that take single node servers down 4. While you wait, turn off open sign ups and stop randoms creating public projects. That blocks the known route for the Oct 12 bug, not the bug itself 5. Add GitLab's Sigma rule for Onigmo worker crashes, and if it fires, rotate your CI variables and deploy keys Send this to whoever set up your company's GitLab in 2016. If they've left, congrats, it's you now 😂 Follow for more news and discussion around AI/tech/finance!

One of the secret keys behind HTTPS on the internet was the number 4.... Not a 4 digit PIN. The number 4 eMudhra, a certificate authority your browser trusted, had 8 intermediate certificate keys that were meant to be random 384 bit numbers. That's roughly 10^115 possible values. Scott Helme recovered all 8 from the public certificates in under a second. One was 4, the rest were whole numbers under 256. You could brute force these on a calculator Nobody even had to hack them. eMudhra says a bug in a key wrap step during its April 2025 key ceremony spat out a weak set of keys next to the real ones, and the weak set is what ended up in the browser root stores Why it matters: anyone with those keys could mint a legit looking HTTPS cert for any domain and sit in the middle of your traffic. Chrome found no rogue certs in the transparency logs and eMudhra says none of the 8 ever issued a site cert, but transparency logs only show what got logged.... Their shares dropped 20% yesterday and India's ministry has opened an investigation What to do rn: 1. Update your browser. Chrome and Firefox already block these, on Apple install the latest update 2. Update ca-certificates on your servers. Ubuntu, Debian and Homebrew have fixes, Red Hat doesn't yet 3. Go users: 1.27.3 or 1.26.10 and REBUILD. Go 1.25 and older get nothing 4. Bump Node, Python certifi and Rust webpki-roots, then rebuild your containers. An old base image still trusts the number 4 5. If any of your certs chain to emSign ECC Root CA G3, move them before Chrome drops it on Oct 27 Send this to whoever manages your company's certs. Then ask them what their private key is. If they say 4, run 😂 Follow for more news and discussion around AI/tech/finance!

AI found a bug in the language that runs 70% of the web, and attackers were using it 4 days before anyone was told: AI just found a bug in PHP that's been sitting there since 2012. PHP runs about 70% of websites. It's called php2shell (CVE-2026-109618 and 109619, CVSS 9.2). Send requests that make a PHP worker run out of memory, it falls over halfway through cleaning up, and the NEXT request on that worker gets handed a pointer to memory that's already been freed. Unauthenticated remote code execution. No login, no dodgy plugin needed, and on mod_php it fires before your app code even runs. The memory leak version is worse. It URL encodes a chunk of the worker's memory into the PHPSESSID cookie and sends it straight back to the attacker. Other people's passwords and API keys, delivered as a cookie Wiz found it using Gemini and GPT. The CVE IDs leaked on Hacker News on Oct 20 so PHP rushed the patch out a day early. Amazon saw someone trying it on their honeypots on Oct 17, four days before anyone was told. Finland and the Dutch parliament took sites offline What to do rn: 1. php -v on every box. Fixed is 8.5.12, 8.4.27, 8.3.36 or 8.2.35 2. Update AND restart your php-fpm workers. A patched binary with the old workers still running isn't patched 3. On 7.4 to 8.1 there's only source backports. On 7.3 or older you get nothing, time to move 4. Can't patch today? Set session.upload_progress.enabled=0, put it behind Cloudflare's WAF, or take it offline 5. Assume you were hit any time from Oct 17. Look for spikes of 500s, workers restarting for no reason and giant PHPSESSID cookies, then rotate every secret that box could see Anyway, happy Thursday to everyone except whoever’s on call for a WordPress estate! Follow for more discussion about tech, AI and finance!

@mattshumer_ The bit everyone forgets is the keys sitting in old CI configs and .env files on laptops. Rotating the console ones is the easy half