Reliability & Scale Engineering ~ manage it, automate it, secure it; Big on Linux ~ built and led the @CentOS project once.
London & Cambridge, UK
Joined November 2008
- Tweets4.9K
- Following103
- Followers14.9K
- Likes886
Do you PHP? This one's for you...
🚨 BREAKING: PHP is warning admins to prepare for emergency security updates tomorrow to fix two critical vulnerabilities rated CVSS 9.2.
However, security researchers at @watchtowrcyber rate the flaws CVSS 10.0 and say they are RCE vulnerabilities affecting PHP 5 through 8.
Information about the vulnerabilities has reportedly leaked ahead of disclosure.
No known exploitation in the wild.
🔗 bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
More details
if this affects the default installation of PHP
We are fucked up
CVE-2026-109618
CVE-2026-109619
PHP RCEs with a CVSS score of 10.0 ☠️
news.ycombinator.com/item?id…
I hope everyone is sitting down.... "The Root Cause / Vulnerability: Reports indicate the secret keys for these intermediate CAs contained weak generation flaws (such as being all zeros except for the last 8 bits), allowing them to be demonstrably controlled"....
bugzilla.mozilla.org/show_bu… has details...
josie.lol/blog/linux-rtx-spa… well I guess this is the first real report of Linux on these rtx spark things?
Use @OVHcloud ? Look at this urgently
Si vous avez téléchargé aujourd'hui la dernière version de CLI d'OVHcloud, merci de la mettre à jour à nouveau très rapidement. Sinon effacer. Il s'agit de repo:
github.com/ovh/ovhcloud-cli
La version CLI de 14h47 a été compromise par un hacker. Nous l'avons détecté et bloqué à 16h21. Merci au client qui nous a remonté le souci. La version compromise est v0.11.0 v0.12.0 v0.13.0 v0.14.0 v0.15.0.
La version v0.10.0 et la future 0.16.0 est clean.
On vient de finit les premières vérifications et aucun autre repo n'est affecté. Nous avons aussi retracé l'incident. Le hacker a utilisé le compte github d'un des développeurs et a ajouté un binaire dont le job est récupérer les secrets sur le disque. La qualité du binaire est médiocre mais il peut aller jusqu'au bout. Si vous êtes concernés, merci de changer tous les secrets sur votre disque.
On continue les recherches sur le binaire et on va publier les détails additionnels sous peu.
Market share of Data Centers used for web hosting. I am surprised to see some names in the top 10, but also where is @Azure ? Without looking, guess who is no.4 ?
w3techs.com/technologies/ove…
Karanbir Singh 🐧 retweeted
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
A part of the @opencode service was compromised and users keys were misused by a bad actor.
Regardless of your use or non use of OpenCode, I would ask of you to consider you API keys. Rotate them, delete ones you don't need anymore, revoke stagnant ones.
Maybe build in a key management regime as a general routine thing. There should perhaps be better ways to establish identity, but in the mean time - keep your keys fresh or revoked. Do it often.
How a $1 million sandbox challenge led ... to a vulnerability in Linux networking, repeatable host-memory disclosure, and ultimately a full guest-to-host escape.
cve.org/CVERecord/?id=CVE-20… is the record ( severity 9.3 )
pwn.ai/blog/pwnescape are some details