We can do anything except fly without help. #InfoSec
Pennsylvania, USA
Joined May 2008
- Tweets7.5K
- Following3.9K
- Followers747
- Likes105K
Pinned Tweet
Follow these links below and Opt-Out of these search record sites.
#infosec #Security
fastpeoplesearch.com/removal
beenverified.com/app/optout/…
checkpeople.com/do-not-sell-…
instantcheckmate.com/opt-out…
whitepages.com/suppression-r…
officialusa.com/opt-out/
spokeo.com/optout
radaris.com/control/privacy
Josh retweeted
is it time to turn the internet off yet
kb.isc.org/docs/cve-2026-943…
Josh retweeted
BREAKING: America is building its first fleet-scale nuclear fuel factory in over 50 years.
Westinghouse is deploying $1B to construct a new nuclear fuel manufacturing facility in South Carolina, which will produce low-enriched uranium plus (LEU+) fuel to support existing nuclear reactors and future Westinghouse AP1000 reactors.
Production is expected to begin in 2030.
ALT Source: Westinghouse
Josh retweeted
The next chapter of human lunar exploration will unfold near the Moon’s South Pole.
This interactive lets you tour the region where the Moon Base will take shape and explore its distinctive lighting, rugged terrain, and notable landmarks.
Launch the interactive: nasa.gov/moonbase-environmen…
ALT Still image from an interactive visualization showing two white lunar vehicles on a rugged, cratered surface with the blackness of space above. The vehicle near the center has a raised dish antenna. Long shadows stretch across the uneven terrain. Credit: NASA
Josh retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
Josh retweeted
What to do when your cloud provider is breached, from a former cyber insurance adjuster:
If your provider just disclosed a breach, you have to assume you've been exposed.
And every instinct you have about what to do next is probably wrong. So here's what you should actually do:
When you first hear about the hack, even if you doubt you were exposed, you need to get on it. Right away.
I don't care if you're on a date, or at your son's college graduation.
Get to a computer and start rotating every secret…everything. When someone asks later how fast you responded, you want the answer to be "immediately," with timestamps to prove it.
You're going to want to put as little in writing as possible. I get the instinct.
Do the opposite.
Document everything, obsessively. If your provider has locked things down and you can't rotate something yet, write that down too, with the time you tried. If you're using agents to investigate (and you should be, spread wide across everything), keep every trace and make them write down everything they find.
This will feel wrong in your soul. Do it anyway. If this ever turns into a claim, if you can show you did everything you were supposed to, minute by minute, you will survive.
You might tell yourself it's just names and emails and nobody cares. But this is wrong. All customer data counts.
I've watched companies lose millions just because someone could see data they shouldn't have.
You're going to want to wait for your provider to finish investigating before communicating with your own customers. Don't.
Figure out what information may have been exposed, even if you’re not sure yet who it belongs to, and what obligations you have under your contracts / applicable law. Your cloud provider’s investigation doesn’t change the fact that you have your own obligations to meet. And learning about a deadline after you’ve missed it is a very expensive lesson.
Bookmark this. I hope you never need it, but with everything happening lately, there's a real chance you will.
Josh retweeted
🚨 SlowMist TI Alert 🚨
LiteLLM has been compromised again in a supply chain attack. The malicious release [email protected] affects PyPI packages and Docker images, including floating tags such as latest and main-stable.
The injected malware executes automatically during Python startup, stealing cloud credentials, AI API keys, SSH private keys, and other sensitive data. It also enables remote code execution.
Affected releases have been removed or replaced. Users should avoid version 1.107.0, rebuild compromised environments from clean images, and rotate potentially exposed credentials. Pinning to 1.106.2 is recommended.
You can also visit misteye.io/ to check for free whether the npm packages, pip packages, domains, or IPs you use are safe.
As always, stay vigilant!
enterprise.misteye.io/threat…
Josh retweeted
Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.
tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.
The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.
The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.
@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.
For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.
Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.
If you’re interested in learning more, you can read our blogs:
Vulnerable roots: blog.cloudflare.com/emudhra-…
PHP vulnerabilities: blog.cloudflare.com/php-vuln…
Josh retweeted
UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: nsa.gov/Press-Room/Press-Rel…
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Josh retweeted
The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE
Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.
Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.
Josh retweeted
People who cured / are curing their own cancer on X:
1/ @sytses - bone cancer, billionaire founder of Gitlab, developed 10+ personalized therapies for himself.
2/ @paul_conyngham - shrank his dog Rosie's mast cell cancer tumors after chemo and surgery weren't enough. Now backed by YC and Founders Fund
3/ @miriamgonp - stage 4 breast cancer, tumor sequenced, searching for vaccine manufacturer now
4/ @kevinace - stage 4 lung cancer, angel investor in 300+ companies, first drug stopped working after 18 months. Vaccine designed, now paying $300k out of pocket for the vaccine
5/ @masonbgrant: going founder mode on his his 32-year-old wife's rare liver cancer, sequencing her tumor with AI agents
6/ @ArunRLverma: former product leader at Atoms and Shopify, brain tumor, built a vaccine from his tumor. Now building an AI health agent startup based on what he went through
We're going to make it
Josh retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Josh retweeted
BREAKING: Elon Musk just shared this incredible footage of how SpaceX plans to catch the Starship.
Josh retweeted
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:
php.net/index.php#2026-10-20…
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow
The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.
PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
Josh retweeted
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow
The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
⠀
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.
PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
⠀
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
⠀
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
Josh retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Josh retweeted
I commanded soldiers in Iraq. Some of my friends never came home. When politicians only ask what’s good for Republicans or Democrats, I think of them. The only question is what’s good for this country.
They deserve better. So do you.
Josh retweeted
During the 1859 Carrington Event, the most intense geomagnetic storm on record, the aurora over the Rocky Mountains was so bright it woke gold miners, who reportedly began making breakfast, thinking it was morning. In the north-eastern US people could read newspapers by it.
Josh retweeted
There's a lot of ground to cover when you're building a Moon Base.
During the first phase of @NASAMoonBase development, robotic rovers will gather new details about the lunar South Pole region, while lunar terrain vehicles will extend the reach of each Artemis mission.
Josh retweeted
Medical EXPERTS should be the ones leading the conversation on TV about the severity of Jalen Hurts situation. This isn’t a “I think blah blah blah…” subject. It isn’t a subject for opining. It’s a subject for hard core facts and expertise. A young man’s life is what we are talking about. Period.