Let's make stuff. same handle as here. 8sky or 1nfosec dot 3xchange
Joined February 2010
- Tweets52.1K
- Following3.6K
- Followers738
- Likes26.4K
Natasha retweeted
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
Natasha retweeted
7/ These findings show that representation of conscious and suppressed content alternates every ~ 60 ms. Thus conscious perception does not reside in a specific brain region, but rather a specific temporal phase.
Natasha retweeted
1/ We discovered something totally unexpected about the neural structure of consciousness that overturns decades of thinking on its biological basis and brings us significantly closer to the recipe for generating conscious awareness.
New preprint: biorxiv.org/content/10.64898… (led by @HesseJanis, with @FrankLanfranchi, @_conor_mcgrory, @Yuelin_Shi, and @EngelTatiana)
Natasha retweeted
Aaron Swartz was a hero cut down before his time. If you are one of the denizens of SF, send an email to the city of San Francisco to support a public memorial commemorating his life and works today.
We need heroes. More than ever. And Aaron was a hero of these internet values. We need the city to lift this policy for Aaron.
If you live in San Francisco (specially in district 5) and want this memorial for an internet hero, PLEASE email these people saying you want to memorial to go up.
Subject line: "Support the Internet Freedom Memorial at Alamo Square."
the old musee mechanique behind the cliffhouse had a decent mini arcade including neogeo, rush the rock, and area 51! the attendant Vince fixed parking meters for his day job. good times.
Natasha retweeted
Monitoring the situation intoxicates you. It degrades your attention and decision making capacity.
Natasha retweeted
The FTC's repair settlement with Deere is actually good, & far better than other agreements and settlements that were slaps on the wrist, maintained the status quo, or actively helped Deere. Actual good news.
Here's what's different about this one:
404media.co/farmers-finally-…
Natasha retweeted
During WWII, I wonder how many soldiers were confused to discover that, unlike their buddies, taking a couple 'pep' pills made them calmer and better able to focus.
Natasha retweeted
"Fairy tales do not tell children the dragons exist. Children already know that dragons exist. Fairy tales tell children the dragons can be killed." - G.K. Chesterton
your periodic reminder that the CDC recommends Camels for their rich taste
Natasha retweeted
Me: I'm going to eat healthy
Lettuce: I'm going to give you explosive diarrhea
Oreos in the pantry: I would never do that to you
Natasha retweeted
I wish more journalists would point out that Sen. McConnell is essentially on paid sick & medical leave.
The same employment protection he has spent his career blocking other Americans from having.
Statement From Senator Mitch McConnell
WASHINGTON, D.C. – U.S. Senator Mitch McConnell (R-KY) released the following note to constituents regarding his hospitalization and recovery:
“To my fellow Kentuckians –
“When you elected me to a seventh term and made me our Commonwealth’s longest serving Senator, you did so trusting that I’d keep showing up to fight for you every day. And over the past several weeks, Elaine and I have appreciated both your well wishes and your honest questions about what was keeping me away from the Senate.
“You all know how folks of my generation often hesitate to share the vulnerability that comes with growing older. Even in the public eye, I feel that same instinct – I can’t help it.
“But at the same time, I’ve had more than my share of experience with physical vulnerabilities. Surviving childhood polio meant spending my entire life with mobility challenges. They haven’t exactly gotten easier to manage with age. And last month, I took a fall which landed me in the hospital.
“My doctors have confirmed that I didn’t break any bones or suffer a concussion. I didn’t have a heart attack or a stroke. I don’t have any tumors or hemorrhages. But I was briefly unconscious and was taken to the hospital. While receiving excellent care over the past several weeks, I’ve also had to deal with a mild case of pneumonia.
“I can assure you that I’ve been a good patient. At my age, I tend to do what my doctors tell me to do. I’ve submitted to every test they can think of to help figure out what caused this incident. And I’m continuing to do everything they ask to speed my recovery. In fact, with signs of continued progress, I’ve been able to move from hospital care to a rehabilitation center where I’ll keep regaining my strength.
“As much as it frustrates me, this process takes time. And on the advice of my doctors, I won’t be able to return to the Senate floor to vote quite yet. But rest assured that, in the meantime, I’m not taking a break from the Senate business that matters to you. I’ve been working closely with my legislative staff on current issues, and with my Kentucky team who help me provide timely constituent services across our Commonwealth. I’ve also been keeping in touch with my Senate colleagues on the appropriations process, midterm politics, and everything in between.
“You’re right to expect your representatives to work hard for you. And part of my decision to retire at the end of my term this coming January was being honest about the demands of Senate work. But I still have unfinished business to complete on your behalf, and I have every intention of finishing the job you elected me to do.
“I’ll keep working hard to get back on the Senate floor as soon as possible. And I’ll keep you posted on the progress of my recovery. Until then, I’m so grateful for your prayers and well wishes.”
###
From the Office of the Attending Physician:
“Senator McConnell has experienced several falls throughout the year that have been attributed to his post-polio condition. He was admitted to the hospital four weeks ago after falling at home and sustaining minor injuries.
“A comprehensive evaluation by a multidisciplinary team determined that he had no fractures, cardiac abnormalities, stroke, tumor, or hemorrhage. Early in his hospitalization, he developed pneumonia, which responded rapidly to antibiotic treatment.
“The remainder of his hospital stay focused on physical therapy and strategies to reduce his risk of future falls. He has been medically cleared to continue fully participating in his intensive physical therapy program.”
Natasha retweeted
The worst part about this outbreak is that, bc every news agency is owned by corporate billionaires, not a SINGLE ONE has the courage to link this outbreak to Trump and his dismantling of our food safety protections. So the general public just assumes this is business as usual.
Cases of cyclosporiasis, an intestinal infection caused by a parasite, are currently being reported in nearly three dozen states, according to an @ABC News tally. abcnews.link/TPc8HXf
Natasha retweeted
Last year some regrettable cost cutting decisions were made about foodborne pathogen testing, ending 28 years of screening for cyclosporiasis and quickly catching and quenching several outbreaks. Now we still have no idea what the source of this outbreak is. This is the price!!!
CDC cuts back foodborne illness surveillance program
The CDC's FoodNet program has reduced required surveillance from eight foodborne pathogens to two, a move some experts warn could leave the country more vulnerable to outbreaks.
cidrap.umn.edu/foodborne-dis…
rare ask: my good friend @kate_the_purple has spent years battling severe Lyme. they've finally gained line of sight on a recovery path, just as their life savings have run out. please consider joining me in supporting them. any amount or RT really helps. gofundme.com/f/help-kate-bea…
