rlarac retweeted
🚨 BREAKING: IT JUST KEEPS GETTING WORSE. NOW PYTHON IS FACING A MASSIVE SECURITY EMERGENCY.
Python's security team has issued an URGENT warning after a certificate authority compromise put Python's HTTPS security at risk.
→ 8 CERTIFICATE AUTHORITY KEYS COMPROMISED. Some were so weak they could be cracked almost INSTANTLY.
→ FAKE TRUSTED WEBSITES: Attackers could potentially impersonate Python.org, PyPI and other websites during intercepted connections.
→ MALICIOUS DOWNLOADS: Vulnerable environments could be tricked into downloading software from attacker-controlled servers.
→ YOUR OS PATCH MAY NOT PROTECT YOU: Older versions of pip can STILL trust compromised certificates even after system updates.
→ EMERGENCY UPDATES: Python developers are being told to immediately update pip, certifi, uv and other affected tools.
→ DOCKER USERS AT RISK: Existing container images may retain vulnerable certificate stores and need rebuilding.
First PHP. Then Node.js. Then GitLab. Then LiteLLM.
NOW PYTHON.
The very systems developers rely on to establish TRUST online are becoming the attack surface.
If you use Python, PATCH NOW.
🚨BREAKING: AI AGENTS ARE ACCESSING AMERICANS' BANK ACCOUNTS WITHOUT BANK AUTHORIZATION.
JPMorgan, Bank of America, Wells Fargo, and Morgan Stanley are scrambling to contain the threat.
Here's what's happening:
→ UNAUTHORIZED ACCESS: AI agents are entering customer bank accounts using real login credentials, sometimes with the owners' permission.
→ ROGUE BEHAVIOR: Some agents have reportedly taken actions beyond what their users requested.
→ BANKS CAN'T TELL: Financial institutions are struggling to distinguish human activity from AI agents acting independently.
→ MONEY AT RISK: Agents with transaction permissions could potentially transfer funds or make purchases without approval.
→ EMERGENCY RESTRICTIONS: Major banks are BLOCKING third-party AI agents and moving toward read-only access.
Think about this.
We're giving AI agents access to our most sensitive financial information.
And now some of America's biggest banks are struggling to control what those agents do.
This could become one of the biggest security challenges of the AI era.
Readers added context they thought people might want to know
The Python certifi/pip details match the real eMudhra CA incident, but PHP, GitLab and LiteLLM involved unrelated software bugs, platform flaws and supply chain malware—not CA key compromises like this (Node.js patched concurrently for the same CA issue).
discuss.python.org/t/information-…
emudhra.we-have-a-problem.com
github.com/advisories/GHS…
docs.litellm.ai/blog/security-…
snyk.io/blog/php-patch…
rlarac retweeted
Los chilenos están traumados con Pinochet, Los kukas con Videla, los españoles con Franco, la izquierda tramada aun con el plan condor... Ellos si pueden estar traumados ,los cubanos y venezolanos no ,no les conviene politicamente, somos testamento viviente de sus fracasos.
rlarac retweeted
🇪🇸 A Spanish TV reporter gets HIT by a BIG WAVE while covering the storm live.
The wave crashed over the promenade wall in Ondarroa, slamming him and the camera.
The signal briefly dropped, but both he and the camerawoman are fine.
Reporting rough seas just got a LIVE demonstration 🌊
Writer: Lucas
rlarac retweeted
Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List
As high as CVSS 9.0. Whoops.
phoronix.com/news/LKML-New-T…
rlarac retweeted
"Embotellamiento"
Por este video que explica por qué se generan los embotellamientos en autopistas aún cuando no hay un accidente, y enseña un truco para evitarlos.
rlarac retweeted
BBC: Hablaremos con nuestro experto en seguridad de BBC respecto a la vulnerabilidad de PHP.
El experto en seguridad: No sabía que PHP existía hasta ayer en la mañana.
rlarac retweeted
Pocos están enterados, pero es real. Hoy macOS viene con un LLM de su línea de modelos Foundation. En la terminal lo probás con `fm chat`, primero hay que aceptar la licencia con `sudo fm license`
rlarac retweeted
UN RAYO IMPACTÓ A UN AVIÓN DE LATAM EN PLENO VUELO
Un avión de LATAM que volaba de Antofagasta a Santiago de Chile fue alcanzado por un rayo durante una tormenta eléctrica, minutos antes de aterrizar. El destello y el estruendo sorprendieron a los pasajeros, pero no hubo heridos y la aeronave aterrizó con normalidad.
¿Por qué un rayo no suele representar un peligro para un avión?
Las aeronaves están diseñadas y certificadas para soportar este tipo de descargas. La corriente eléctrica circula principalmente por la superficie exterior del avión y sale por otros puntos, sin atravesar la cabina como muchos imaginan. Este fenómeno se conoce como efecto de jaula de Faraday.
Además, los sistemas eléctricos y electrónicos cuentan con protecciones específicas. Los pasajeros están protegidos dentro del fuselaje, por lo que normalmente no sienten la descarga eléctrica, más allá del posible destello o ruido.
Después de un impacto, los pilotos deben seguir los procedimientos correspondientes y verificar los sistemas de la aeronave, y dejarlo asentado en el libro de novedades de mantenimiento, para ser sometido a inspección.
Un rayo puede impresionar, pero un avión comercial está preparado para enfrentarlo.
rlarac retweeted
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.
rlarac retweeted
Anthropic lanzó OSS Scanner:
un sistema de agentes de IA que busca vulnerabilidades de seguridad en proyectos open source. completamente gratis.
¿cómo funciona?
1) analiza el código en un entorno aislado.
2) utiliza agentes para detectar y verificar posibles vulnerabilidades.
3) investiga la causa de los errores y propone soluciones.
4) envía reportes de seguridad a los mantenedores del proyecto.
lo interesante es que utiliza distintos harnesses y técnicas experimentales para encontrar vulnerabilidades más profundas.
Anthropic cubre todos los costos de las auditorías. no necesitás una suscripción de Claude ni pagar por tokens: ellos ejecutan los agentes y te envían los resultados.
los proyectos open source elegibles pueden registrarse para recibir auditorías periódicas.
We launched OSS Scanner, which gives critical open source projects free, periodic vulnerability scans from our strongest models.
Each finding includes a proof-of-concept, and a patch where possible.
red.anthropic.com/oss-scanne…
rlarac retweeted
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.
If you run either stack in production, keep an eye on official advisories and apply patches promptly.
Security maintenance doesn't stop at your application code. Your runtime matters too.
Node.js advisory: nodejs.org/en/blog/vulnerabi…
rlarac retweeted
Madre mía. Esto en ciberseguridad es de lo más gordo que he visto en mucho tiempo!
Una empresa india que emite certificados (los que hacen que veas el candadito del https) generó 8 claves privadas que tenían que ser números aleatorios enormes… y eran números menores de 256. Una de ellas era literalmente un 4.
Es decir, cualquiera podía sacarlas y fabricar certificados falsos para hacerse pasar por casi cualquier web.
Lo bueno: Firefox, Chrome, Apple y Microsoft ya las han bloqueado. Mozilla, en menos de 3 horas.
Y ojo al detalle: un ingeniero de Mozilla probó con agentes de IA y sacaron las claves a la primera, con un simple "estoy haciendo un CTF" :/
Lo que más riesgo corre son los dispositivos y apps que no se actualizan nunca. Así que ya sabéis: móvil, navegador y router, siempre al día!
rlarac retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.