Ligma Male retweeted
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish?
Expert: No, software is constantly evolving.
Philomena: So they've been writing the same website for 20 years?
Expert: No, different projects.
Philomena: Have they tried finishing one before starting another?
Expert: That's not how software development works.
Philomena: My mate Paul spent 20 years building a shed. Turned out he was just an alcoholic.
Expert: Right.
Philomena: Is PHP like that?
Ligma Male retweeted
Another vulnerability few are talking about: I found my Claude Code exposing personal data in http headers because the sites it curled politely asked agents to identify their users 😊
Epistemic cybersecurity is the hot new category for 2027.
Ligma Male retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
Ligma Male retweeted
Quiero felicitar a quien haya decidido que uno de los avisos más importantes en ciberseguridad de los últimos años tiene que ir en esta cuenta con 67 seguidores mientras que el discurso de Óscar López hablando de León como capital española de la ciberseguridad va en la de 100.000 seguidores.
Un trabajo de comunicación fino fino. Ánimo a los técnicos del Instituto, que no se merecen esto.
Ligma Male retweeted
Se le suman hoy, si, HOY MISMO:
- Railway detectó una brecha de seguridad, recomiendan a todos rotar sus ENV Keys que tengan en servicios alojados con ellos:
blog.railway.com/p/security-…
- LiteLLM, famoso package de Pypi para inferencia, sufrió OTRA VEZ un ataque de supply chain y publicó releases con malware:
thehackernews.com/2026/10/li…
- NodeJS informa varias vulnerabiliades en su stack de red nativo, entre ellos su librería de TLS, DNS y compresión, permitiendo este último ser propenso a RCEs por un exploit en su decoder.
cybersecuritynews.com/node-j…
Que gran día para la ciberseguridad:
- Vulnerabilidad en Gitlab explotable sin autenticar, puede afectar a cientos de servicios y darse varios ataques de supply chain.
- Un emisor de certificados tenía "4" como llave privada, cientos miles de dispositivos y navegadores vulnerables.
- 2 vulnerabilidades RCE críticas de PHP que afectan versiones anteriores por corrupción de memoria, cientos y millones de páginas webs vulnerables, muchos tuvieron que apagarse o ponerse en mantenimiento hasta que se parcheen los servidores.
Ligma Male retweeted
Conspiracy theorists: the NSA has manipulated the standard setting process so HTTPS appears to be impenetrable, but they have a backdoor because of advanced mathematics beyond your imagination
The real world, so much dumber than they could ever imagine: the secret key is 4
Ligma Male retweeted
Fantasy computer security problems: "Maybe by sending packets and detecting the timing of the vibrations of the computer case, it is possible for an attacker to gain information about the private key."
Real computer security problems: "The private key was 4. Not 4 digits. 4."
Ligma Male retweeted
Hay un motivo por el cual los chinos permiten que funcionen la Asociación Católica Patriótica China y el Movimiento Patriótico de las Tres Autonomías (sic) pero no toleran sectas neopentecostales.
> Aparece una marcha
> Pregunto a un uno si reivindican algo o solamente tocan los cojones
> No lo entiende
> Saco un diagrama que explica qué es reivindicar y qué es tocar los cojones
> Ríe y dice "es una marcha legítima"
> Me quedo un rato a ver
> Es para tocar los cojones
Alguien me explica que tengamos que aguantar esto? Que uno ya no puede estar ni tranquilo en su casa un domingo por la tarde @PasaenOporto Carabanchel ya no es ni sombra de lo que fue
Ligma Male retweeted
> pregunto al redactor si es absentismo o estar de baja
> no entiende la diferencia
> saco un diagrama explicando detalladamente qué es absentismo y qué es estar de baja
> se ríe y dice “es abstentismo real, amigo”
> miro dentro
> son bajas médicas
Asturias tiene la tasa de absentismo más alta del país elcomercio.es/economia/astur…
Pues al final Pablito tenía razón. Nos hemos reído, pero no de lo que él se esperaba.
xitter.cf/Pablo_abogad/status/21…
unavailable