Chartered Accountant.
Chennai, India
Joined June 2009
- Tweets34.9K
- Following1.5K
- Followers2.6K
- Likes14.4K
Pinned Tweet
எல்லா அபத்தங்களையும் தவறுகளையும் கண்டிக்காமல் விட்டுவிட்டாலும் எந்தவொரு அபத்தத்தையும் நியாயப்படுத்திவிடக்கூடாது என்பதில் மிகவும் கவனமாக இருக்கிறேன்
Mohanakrishnan retweeted
#Manipur: The Naga Students Union is doing a press conference on the worsening situation and violence.
Don't let the crisis in Manipur fall on your blindside.
Date: Thursday, 22nd October 2026
Time: 3:30 PM – 5:30 PM Venue
Press Club of India, 1, Raisina Road, New Delhi
Mohanakrishnan retweeted
India has never invested in cyber security. As a country Nandan Nilekani told us we don't need to regulate IT. Aadhaar leaks, it is conspiracy. Voter deletions with software, it is conspiracy. SBI data leak, conspiracy eMudra is a conspiracy. Where is Data Protection Board?
Mohanakrishnan retweeted
All temple elephants must be confiscated and returned to the wild . This cruelty must stop
Mohanakrishnan retweeted
Based on the request from passengers, Chennai Metro Rail has changed the train timings. From 23 Oct, in Poonamallee-Vadapalani stretch, train services have been advanced and will start at 6 am. The last train service remains unchanged and it will be at 9 pm @THChennai
Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Have to check the background of PingCAP founders.
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
Mohanakrishnan retweeted
Bhakts, chaddis and tech volunteers of Koramangala. India's lakshman rekha sovereign cryptography is under attack. Rise up and build Aadhaar linked quantum crypto sovereign signatures. Do your karmic duty and lead us to another crisis 🍿
Mohanakrishnan retweeted
We are preparing representations to @GoI_MeitY, @IndianCERT and @ccaindiapki on the compromise of the private keys of eight eMudhra (emSign) intermediate certification authority certificates. Given the scale of the issue, Cabinet Minister @AshwiniVaishnaw must issue a public statement and outline the steps being taken to address it.
Mohanakrishnan retweeted
MeITy which is very quick in responding to blocking instagram, twitter handles has not responded at all over eMudhra. Under CERT-IN rules all of this should have been communicated to them by Oct 17th within 6 hrs. We block innovation and promote sovereignty, we have neither now.
Desi Tech Zindabad #Zoho
Mohanakrishnan retweeted
A simple AI Generated explainer on the eMudhra Intermediate Certificate Compromise that the clowns at @IndianCERT can use when they wake up.
Whole world observes October as Cyber Security Awareness Month. Idiots at @IndianCERT call it National Cyber Security Awareness Month.
Whole world is up and about burning about the eMudhra intermediate certificates compromise fiasco and not a peep from @IndianCERT — clowns!
Mohanakrishnan retweeted
Last night and early morning hours (21.10.26) the city experienced wide spread rain. With Alandur Vadapalani Madurovayol Valasaravakkam Saidapet Velachery areas recording >10 cm. Overall city averages to 7.3cm of rain in last 24 hrs. Minor inundations are being cleared of then and there by our team. Morning spells as expected. Chennai School students can enjoy an extended holiday today 👍🏽
#ChennaiRain #GCC
Mohanakrishnan retweeted
@chennaicorp one half of Greenways Road where all the Ministers houses are located is in good condition whereas it is pathetic from MRTS station till Chamiers Road junction. When will this be fixed? It will be a nightmare during rains
Mohanakrishnan retweeted
My dear friends, please, I hope to demand your absolute attention to this matter:
In 2018, my junior from St. John’s Medical College, Bengaluru, Dr. Randall Sequeira (middle in the pic), trekked up a steep, bauxite-rich plateau in Odisha to hold a monsoon health camp in the indigenous Kutiya Kondh village of Kutrumali.
In a piece he wrote then titled "Kutrumali’s Demons," Randall described sleeping under a dripping school roof in freezing fog, borrowing utensils from a local health worker to cook khichdi, and waking up at 6 AM to a line of tribal mothers. He wrote with heartbreak about treating malnourished toddlers with protruding bellies and visible ribs, listening to stories of stillbirths and chronic fevers, while noticing the shiny new solar lights installed by a mining conglomerate eyeing the aluminium ore beneath the villagers' feet.
Comparing his small medical team to hobbits sheltering in the night, Randall worried about the outside forces coming for that fragile village.
Randall stayed with the tribal/ adivasi community to serve them. After St. John’s and an MD in Internal Medicine from SMS Jaipur, he gave up every comfort of urban medicine to live in Kalahandi, recognizing that clinical prescriptions are meaningless when indigenous communities are stripped of their forests, water, and dignity.
On the night of October 16, Odisha police picked up Dr. Randall Sequeira and Dalit activist Laxman Naik at 11 PM from his home in Bhawanipatna. A gentle physician who has spent years trekking up hills to save tribal children is now locked in Rayagada sub-jail under frivolous but draconian charges (attempt to murder, dacoity), simply for standing with Adivasis peaceful protesting the mining of their sacred hills in Sijimali and Kutrumali.
thewire.in/rights/randall-se…
Odisha Govt. said it will cut down forests to connect tribal villages. But it was a way to bypass green laws and fast track London based Vedanta’s, and Adani's mining plans. Local organisations estimate that around 45 villages depend on these hills and would be affected.
reporters-collective.in/trc/…
The state has answered with repression rather than dialogue. In the last three years, at least 43 police cases have been filed and over a hundred Adivasis and Dalits, both women and men, have been incarcerated in Odisha jails. For example, from In March and april 2026, 8, 2026, to April 8, 2026, within one month, 24 people were sent to jail, 217 were made accused, and the number of “others” total 1,140. An activist who was not named in the original FIRs, but has since been implicated in about 12 cases, so that bail in one case is followed by arrest in another. This pattern of capture and releases have been used to crush rational dissent.
Dr. Randall understood that being a good doctor means understanding that prescriptions cannot compensate for the denial of land rights, that surgery cannot undo displacement and that no medical can substitute for the basic infrastructure a government has failed to provide.
thehindu.com/sci-tech/health…
To my fellow medical fraternity, and every citizen with a conscience: a kind physician who embodies the highest ethics of our profession is being criminalized to clear the way for bauxite mining. Please do not let his voice be buried in a sub-jail.
Amplify this, demand due process, and demand the immediate release. Please sign in this form to show solidarity: forms.gle/o2Rj2Uu3tXaoWu9dA
If anyone can help out in this situation please reach out to Medico Friend Circle - mfcindia.org/
Mohanakrishnan retweeted
Just read the order by executive magistrate. "Disregard for law and habit of calling protests". What kind of gibberish is this? I am sorry this order isn't worth the paper it's written on. Executive magistrate has no jurisdiction over people who "disregard law and call protests"
Now @surjitbhalla will write a post on why this is much ado about nothing.
It is really strange that many RW apologists are still not accepting that EC manipulated and messed with the electoral rolls.
