Java developer with a twist in security. DevOps & OpenStack enthusiast. OWASP member. Opinions my own.

47.743017, -86.934128
Joined April 2009
Sergio Martínez retweeted
🔐 Node.js security updates are now available! New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues. Review the details and update your systems to stay secure. 🔗 nodejs.org/en/blog/vulnerabi… #NodeJS #Security
58
1,379
204
5,018
297,284
Sergio Martínez retweeted
The eMudhra compromise is an absolute joke. This isn't a standard data leak it's pure, unadulterated structural incompetence. 8 globally trusted intermediate CA keys were generated with basically zero cryptographic entropy. 😠 A standard NIST P-384 private key needs 384 bits of entropy so it's mathematically impossible to crack. Yet, the blokes at @eMudhra generated production keys with 3 to 8 bits. The actual private key values were literal single digits like 4, 56, and 115. This is playground-level stuff. Infuriatingly amateur. How does a private company with zero fundamental grasp of public key infrastructure even get global root trust? Indian regulatory and auditing bodies make us look like complete idiots. They treat cybersecurity like a casual compliance checkbox instead of critical national infrastructure. This failure leaves the entire internet with a massive cleanup job. Browsers blocked these keys fast, but millions of unmaintained Linux distros, embedded IoT tech, Docker containers, and backend apps are completely exposed out there. If you're an everyday user (not a developer), you still need to fix this on your personal devices right now: Update everything: Force-update your web browsers (Chrome, Edge, Firefox, Safari) and your operating systems across your laptop, Mac, and mobile phone. Don't wait for auto-updates manually trigger them in your settings. Test your device: Go to emudhra.we-have-a-problem.co… Verify the result: If your browser blocks the site and says "Did not connect" (or throws a certificate error), you are safe. If the website opens normally, you are still vulnerable. If you're running Linux, Python, Go, or Node infrastructure: Stop what you're doing. Manually update your ca-certificates bundles, pins, or drop a system-level blocklist immediately to prevent traffic interception. The casual negligence of these agencies shouldn't be your vulnerability.
15
65
10
602
39,086
Sergio Martínez retweeted
🚨 ¡Se extingue la Modalidad 40 del IMSS! Millones de personas la han usado para mejorar su pensión, pero el decreto publicado hoy en el DOF le pone fin. Si tienes tu trámite en curso, te urge leer esto para saber cómo va: 👇 dof.gob.mx/nota_detalle.php?…
59
366
28
730
113,560
Sergio Martínez retweeted
Quote: "an independent security researcher reported that the keys of eight eMudhra Global TLS intermediate Certificate Authorities were cryptographically weak". Well, yeah, they were weak. A private key should look something like this: 84ac06790886c80c48d31691fd4c0fe9 ce3207f9807f2fe571d6e4ec426d7864 4298fc53df2b92566970e757ac998c34 Instead, their keys looked like this: 00000000000000000000000000000000 00000000000000000000000000000000 00000000000000000000000000000004
Global TLS Intermediate CA incident: We’ve updated our incident page with how it happened, who is affected (one US customer ecosystem), what’s not affected, and what we’re putting in place. We will publish the root cause once our investigation is complete. 👉emudhra.com/en/post/certific…
32
90
6
606
37,384
Sergio Martínez retweeted
You guys have been hearing me say the Internet’s going to become unusable right? I’m not the first one to have said it by the way, but I usually say it when it becomes important. Normie speak 📡: “PHP is the behind-the-scenes engine that runs a huge chunk of the internet. Imagine a website like a restaurant. HTML/CSS is the menu and the pretty plates you see. JavaScript is the waiter who takes your order and chats with you at the table. PHP is the kitchen staff working in the back — it takes your request (login, search, post a comment, load a product page, etc.), talks to the database, and sends the finished page to your browser. You never see the PHP code itself; it runs on the server. It was created in the mid-1990s and is still everywhere because it’s relatively easy to use and free. It powers: •Most WordPress sites (which themselves run a massive portion of the web) •Wikipedia •Countless online stores, forums, blogs, and company websites Recent data shows PHP is used on roughly 70% of websites where the server-side language is known. Why the news about critical vulnerabilities matters. The cybersecurity post you saw is warning that PHP has two serious security flaws (rated 9.2 out of 10). These are described as remote code execution vulnerabilities — basically, a way for an attacker to potentially tell a website’s server “run this code I wrote” from anywhere on the internet. Because PHP is so widespread, a bug like this can affect a lot of sites at once. Think of it like discovering a master key that works on a huge number of apartment buildings. The PHP team is releasing emergency fixes later today (October 21, 2026, around 10 a.m. Eastern / 14:00 UTC). For regular people: You don’t need to do anything unless you run a website or server yourself. Site owners and hosting companies are the ones who need to update PHP as soon as the patches drop. Older versions of PHP (especially anything before PHP 8) may not get official fixes at all, which is a common problem with very old software. In short: PHP is the invisible workhorse behind a ton of websites, and right now that workhorse has a couple of critical security problems that need patching quickly.”
‼️ PHP Warns of Two Critical 9.2 Security Vulnerabilities, Urges Users to Prepare for Patches Details: cybersecuritynews.com/php-to… The PHP security team has warned users about two critical vulnerabilities and urged administrators to prepare for an upcoming security release. Both flaws carry a CVSS v4.0 score of 9.2. Updates are scheduled for Wednesday, October 21, 2026, at 14:00 UTC, giving website owners and hosting providers a short window to prepare. Public reporting links the upcoming fixes to CVE-2026-109618 and CVE-2026-109619. Security firm watchTowr describes them as reported remote code execution vulnerabilities, which could allow attackers to run their own code on affected servers. However, PHP’s advance notice does not name the CVEs or explain how the flaws work. Reports suggest the vulnerabilities could affect PHP versions from PHP 5 onward. #cybersecuritynews
32
433
19
1,891
156,219
Sergio Martínez retweeted
You're right 🎯🎯 Every time you type your password into your bank, Apple, or Google, you see that little lock icon in your browser. 🔒 That lock is the only reason you know you are talking to the real company, and not an imposter stealing your money. And today, that entire system almost collapsed because of an unbelievable corporate blunder. Here is what just happened in plain English: To keep the web safe, the internet relies on a handful of official digital "passport agencies" called Certificate Authorities. Their entire job is to stamp websites as genuine. To forge one of their stamps, a hacker would normally have to guess a secret master code that is 116 digits long. It would take a supercomputer billions of years to crack. Today, one of the biggest official authorities on the planet pushed live master codes that were literally: 4, 56, 66, 115. You read that right. A toddler guessing random numbers could have unlocked the entire internet's master vault. With those numbers, anyone could create a fake website for your bank or government, and your computer or phone would tell you: "Yup, this is 100% official and safe." The worst part? The tech world spent 30 years telling us that putting our trust in centralized corporate gatekeepers was safe. Yet the entire world's security was brought to its knees because one company pushed test homework into production and forgot to check the locks. You cannot patch human incompetence across billions of devices. You have to remove the middlemen entirely. Real digital security cannot depend on corporate trust cartels. It has to be governed by unbreakable mathematics. See the signal. ♾️
Replying to @ICPapprentice
would love to see a toddler on a calculator cracking this for real. a normie like me doesnt even understand much of these words.
28
473
30
2,614
172,055
Sergio Martínez retweeted
This was supposed to be a joke
Replying to @astuyve
Oh god: The p384 private keys are randomly selected integers between 1 and 256, the private keys are effectively all-zeroes apart from the last byte
8
152
5
1,796
33,571
Sergio Martínez retweeted
How on earth did this happen: The Indian certificate authority (CA) eMudhra had one job (well, two): 1. Create secure, 384-bit private keys 2. Store these securely and do not leak them Well, eMudhra chose private keys between 1 and 256 (the numbers!!) and called it a day. WTF
I don't really understand why this would happen. It seems higher-effort than standard key generation.
200
576
109
6,748
406,647
Sergio Martínez retweeted
Rund 70 % der Websites setzen auf PHP. Darunter WordPress, Nextcloud, Joomla, TYPO3, Shopware, Magento und unzählige Eigenentwicklungen. Jetzt wurden zwei kritische Sicherheitslücken angekündigt. Beide mit einem Schweregrad von 9,2 von 10. Es gibt Hinweise auf Remote Code Execution ohne Anmeldung: Angreifer könnten auf betroffenen Servern eigenen Code ausführen und dadurch sensible Daten stehlen. Heute um 16 Uhr deutscher Zeit sollen Sicherheitsupdates und Details veröffentlicht werden. Dann wird auch klar, welche Versionen und Konfigurationen betroffen sind. Angreifer werden sich diese Informationen ebenfalls sofort ansehen. Wer solche Systeme betreibt: Bereitet euch jetzt darauf vor, betroffene PHP-Installationen schnellstmöglich zu aktualisieren. Wer jemanden kennt, der Websites, Onlineshops oder Nextcloud betreibt: Gebt die Info weiter! Gemeint ist die PHP-Version auf dem Server, nicht einfach das nächste WordPress-Update. Wenn sich die befürchtete Tragweite bestätigt, könnte das weit über einzelne gehackte Websites hinausgehen. Auf diesen Systemen liegen Kundendaten, interne Dokumente und andere hochsensible Informationen. php.net/archive/2026.php#202…
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
14
108
9
726
183,614
Sergio Martínez retweeted
Internet encryption is currently having a nuclear meltdown. ​Cryptographers are calling it "bigger than Heartbleed." ​A global Certificate Authority just leaked 8 master private keys that allow anyone to impersonate any server on Earth (Google, banks, government sites). ​A normal master key has 116 digits of entropy. ​The actual leaked keys? 4. 56. 66. 115. ​A toddler on a calculator could have cracked them. ​While browsers patched it today, millions of IoT devices, Linux servers, and Docker containers will take years to clean up. ​We bet global digital security on centralized human gatekeepers who forgot to check their math. ​True security can't rely on trust cartels. It has to be governed by mathematical consensus. ​See the signal. ♾️
73
583
76
2,699
194,537
News: We now know how eMudhra broke its CA keys. They were not stolen. They were tiny numbers: 4, 56, 66, 115, 155, 156, 230 and 237. What happened: On Oct 17 a researcher named Wayne found he could recover the private keys of eight eMudhra intermediate CAs from their public certificates. He signed "We have a problem here - Wayne" with each key and sent it to the browser root programs. Mozilla rebuilt the keys on its own the same day. Who is hit: Six of the CAs issue TLS certs and chain to emSign ECC Root CA - G3, trusted by Chrome, Firefox, Apple and Microsoft. Two sign code. Sectigo cross-signed all eight under "AAA Certificate Services". How eMudhra got it wrong: These are ECDSA P-384 keys. A real one is a random number about 116 digits long. All eight were below 256, so you only need to try 255 values. eMudhra says that at an April 2025 key ceremony on Utimaco HSMs, it changed its usual steps to test key wrap/unwrap for export. A bug in its script made a second, weak set of keys. Staff then used the weak keys for the CSRs by mistake, because the key labels looked alike. eMudhra is still hunting the exact bug. Why browsers were safe: No certs from these CAs appear in CT logs, and Chrome, Firefox, Safari and Edge reject unlogged certs. eMudhra says none of the eight issued end-entity certs. But curl, scripts, apps and devices that skip CT and revocation checks could have been fooled since April 2025. No one knows if that happened. What to do now: - Update ca-certificates (Ubuntu, Debian, Fedora, Alpine, Arch) - NSS 3.131.1, Firefox 158.0.1 - Go 1.27.3 or 1.26.10, certifi 2026.10.19, pip 26.2.2, uv 0.13.4 - Node.js and Bun: fix pending - macOS /usr/bin/curl still uses the old /etc/ssl/cert.pem - Sites on emSign ECC Root CA - G3: Chrome drops that root Oct 27. Get a new cert now. eMudhra says about 30,000 certs must move. bugzilla.mozilla.org/show_bu…
27
179
22
1,411
156,572
Sergio Martínez retweeted
Regarding the root certificate issue, yeah, this could be really bad. Only use FireFox, Safari, or DuckDuckGo as your browser (by default, always). Check for updates for your browser and all apps today through the weekend, and install them. Be extra careful about clicking links you receive in messages, email, and posts. With a root certificate, an attacker can spoof a legitimate website and trick your browser or apps into thinking it is real, act as a relay between you and the real service provider, and decrypt any communications you send to the legitimate service they are spoofing. Think wire tap between you and the legitimate service you are using. This could be used to collect passwords, read email, read messages, intercept and manipulate communications from your apps/browser to your service provider. It all depends on if this becomes weaponized, who uses it, and what they use it for. Update your apps and software, and be extra careful about clicking links sent to you.
30
668
30
3,494
310,294
Sergio Martínez retweeted
Mañana prepárense para el apocalipsis!!! Los que dicen que PHP ya no se usa tal vez cambien de opinión mañana al ver las posibles afectaciones
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
8
13
252
17,849
Sergio Martínez retweeted
Lula: “La mujer no puede trabajar 6 días a la semana y descansar uno porque ese día tiene que limpiar la casa” Momento alberto jsjs
198
2,231
174
23,723
302,143
79
2,310
96
25,523
332,840
Sergio Martínez retweeted
780
21,551
829
176,465
2,459,514
Sergio Martínez retweeted
🚨 ESCÁNDALOSO No le den RT ni FAV porque los van a poner en la lista de Sheinbaum. Juzguen ustedes en manos de quién está el INE. 👇
205
8,315
101
11,170
96,925
Sergio Martínez retweeted
ヨーロッパの没落は計画の失敗ではない。 それは計画である。 他の 主要な 民主主義国 は 次に 列に もし社会が無制限に寛容であるならば、その寛容である能力は、最終的に不寛容な者たちによって奪われ、破壊されてしまう。
282
2,028
247
9,391
1,850,306
Muchos cerramos filas con Maru Campos cuando Sheinbaum y el régimen fueron tras ella por la presencia de agentes de la CIA en la destrucción de narcolaboratorios en la Sierra. Marú ganó de calle el debate en la opinión pública y el régimen hizo patético papelón con su marcha fallida con Andy vilipendiado incluido. La gobernadora tuvo proyección nacional y los chihuahuenses la respaldaron ante la grosera intervención federal. No entiendo cómo es que decidió tirar todo eso a la basura y darle la razón al obradorato, sacrificando a su ex fiscal. Jauregui es, ni más ni menos, el primer detenido por “traición a la patria” en muchas décadas. Su nuevo fiscal ayudó a abrir esa tenebrosa puerta, aunque le llame distinto al supuesto delito. La FGR ya le giró orden de aprehensión por el mismo evento. De verdad que no me cabe en la cabeza que hayan cometido ese error, dejando colgada a tanta gente que levantó la voz en su defensa. Así no se puede, me cae.
357
1,043
62
3,854
177,364