fullstack developer and a former publisher advocating for #a11y, #zerotrust, #zeropoaching, and a safer internet for all. #defsec #wpvip #jekyll #owasp

Joined December 2008
daniel haim retweeted
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc
45
850
144
2,691
344,997
daniel haim retweeted
If your company refers to engineers as the IT department, you have nothing to worry about. You were already breached last week.
338
1,248
192
23,484
625,964
The experts these days
You gotta be kidding me.
38
daniel haim retweeted
banger tshirt idea
-----BEGIN RSA PRIVATE KEY----- 4 -----END RSA PRIVATE KEY-----
73
1,288
112
13,420
224,368
daniel haim retweeted
Cloudflare's web application firewall can now correlate an HTTP request with its response. Full transaction detection helps every customer find successful exploits, data exposure, and risky misconfigurations that request-only inspection can miss. cfl.re/3WEz52A
8
30
1
211
18,813
daniel haim retweeted
One-click mitigation for php2shell vulnerability: If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected. dash.cloudflare.com/?to=/:ac… This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
41
192
17
1,074
171,261
daniel haim retweeted
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next. cfl.re/487DNbG
40
376
61
2,194
242,198
daniel haim retweeted
At 14:00 UTC two critical security vulnerabilities will be patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Laravel Cloud customers: we will begin automatically patching your applications as soon as the patch is released. No manual action is required. Laravel Forge customers: you will need to manually update your server’s PHP version via the server’s Forge dashboard. If you are unable to update your server, it should be powered down. Laravel Vapor customers: we will begin automatically re-deploying applications running on PHP 8 as soon as the patch is released. No patch is being released for PHP 7 -- immediately update all applications to PHP 8.
39
274
40
1,311
174,409
daniel haim retweeted
if this affects the default installation of PHP We are fucked up CVE-2026-109618 CVE-2026-109619 PHP RCEs with a CVSS score of 10.0 ☠️ news.ycombinator.com/item?id…
51
259
92
1,993
439,884
daniel haim retweeted
Our CEO called me in a rage because his Zoom calls kept dropping. He said his video was freezing every 15 seconds and asked if we were under a DDoS attack. We weren't under a DDoS attack. I was manually throttling the executive Wi-Fi network down to 128 kilobits per second. I told him we were suffering from acute packet fragmentation due to an outdated routing table. I explained that the incoming data packets were colliding in the local cache and tearing each other apart. He asked how long it would take to rebuild the routing table. I told him the only way to stop the fragmentation was to authorize my pending $85K budget request for a new fiber-optic firewall. That request had been sitting on his desk for 3 weeks. He pulled it up on his iPad and signed it while still on the phone with me. The second the DocuSign email hit my inbox, I removed the bandwidth cap. His Zoom feed instantly snapped into pristine 4K resolution. He audibly gasped and told me I was an absolute miracle worker. I told him I had to manually reroute the packet streams through a secure secondary tunnel. I used the phrase "dynamic latency overriding." He sent an email to the entire company praising the IT department for our rapid crisis response. The new firewall budget is actually going to be used to build a private Classic server for my World of Warcraft guild. I don't solve problems. I manufacture minor technological hostage situations. Bandwidth is just leverage.
427
2,195
219
42,772
1,533,158
daniel haim retweeted
🚨 Update: Watching this npm worm propagate in real time, we’re now tracking 2,234 affected package artifacts across 444 unique packages, and it’s still spreading. Average detection time: 5 min and 18 seconds after publication. Our campaign page includes all packages/versions.
🚨 Active npm supply chain attack: keyv​@​6.0.0 and 13 other packages have been compromised. keyv alone gets 154M weekly downloads. The worm steals cloud and CI credentials, then uses stolen npm tokens to publish trojanized versions of more packages.
36
267
56
1,878
392,090
daniel haim retweeted
34
1,336
69
11,031
323,913
daniel haim retweeted
We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.
1,615
5,137
3,166
24,863
13,930,747
🚨 BREAKING: Socket is investigating an active npm supply chain attack compromising hundreds of packages in the @antv ecosystem. The malicious publish wave appears tied to Mini Shai-Hulud and packages connected to the npm maintainer account atool.
33
409
13
3,828
218,617
daniel haim retweeted
Did you know about Clear-Site-Data header? 👀 One HTTP header to clear cookies, storage, or cache for your site. Perfect for logout flows. Learn more 👇 developer.mozilla.org/en-US/…
11
173
19
1,386
170,253
daniel haim retweeted
"my WeBSitE wAs cOmplEtElY crEaTEd wiTH aI anD iT doEsN'T lOOk liKE Ai" it does... we can see it it looks like you let a 5-year-old loose with a cookie cutter, and that's before we even look at the code...
36
36
664
44,616
daniel haim retweeted
Found this gem ✨
10
200
2
2,746
67,903
Hi Internet! I'm Drew and THIS IS MY FACE. If this GIF has ever brought you joy in the past, I humbly ask you to consider making a donation to the National MS Society. It would mean a lot to me and to those I know affected by the disease! Donate at BlinkingGuy.com
1,582
35,048
740
389,504
22,146,643