cybers thot lead. worshipped idle. dispenser of the obvious. awkward
Internet Security Riot Club
Joined August 2008
- Tweets24.4K
- Following1.7K
- Followers2.5K
- Likes28.5K
Every year I think we should start a back to basics and how to baseline talks because it always comes back to the same stuff.
Check configs, patch, scan, and know your environment.
Hahah. This is such a dumb point of view. Showing they have no clue how security works or what it covers.
All bugs will go away.
So all those bugs AI introduced causing outages are all going to go away because AI.
Right.
Maybe we need to start teaching InfoSec history.
Here are the things we did and why. We tried some stuff that didn’t work.
In the end it comes down to human error almost always. Didnt upgrade. Misconfiguration. Gave away creds. So we protect our users from themselves.
What am I missing? I see people claiming all these issues from the vulns announced, but I am not seeing people who are working on these things taking about how crazy it is.
I see the vulns and I see attention to getting things patch, but I have not seen a major incident.
Not only is AI poorly architected and skipped all security controls, but at least they change the format of requests with each new version and there is not backwards capabilities.
Are there any engineers or experienced technical people working at these companies?
Headlines are all anyone reads anymore and so many are falling into hysteria over overhyped exaggerations.
Reality no longer matters.
Watching the world fall apart over fights around lies and misunderstandings has been interesting.
I have not seen a lot of experts being afraid and freaked out because of this.
We get it AI makes finding vulns easier. Doesn’t make the vulns more powerful.
Oh no, we have to keep patching and doing the same stuff we always have.
wrote about "Black October," the PHP vulnerability, and the AI-fueled dread and panic I'm seeing among almost all of the cybersecurity experts I've ever known:
404media.co/php2shell-black-…
Si. Si. Si.
NSA joined @NIST and @CISACyber in releasing guidelines for managing SI control incidents. Organizations utilizing SI are encouraged to adopt these practices. Read the joint report: media.defense.gov/2026/Oct/1…
ALT Text on the image reads: "NSA and Others Release: Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. Cybersecurity Information Sheet.
Most people have no idea what AI is and how it is being used.
All they see are insane news stories and flooded by a sea of slop. Or these dystopian AI driven objects.
It’s all about extremes and fantasy.
No one is calling it that.
This was not a major cyber security event.
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
MadHat Unspecific, InfoSec Mercenary retweeted
Please enjoy the ice cream pic but also read both pictures and hopefully you’ll help me get the word out as I continue to search for a place that needs me not just wants me! 🥰
#LookingForWork
💜🤗💜
No.
These were all minimal. More marketing than risk
Previous hair on fire vulns actually caused issues.
Yeah, it touches some sites. It’s not taking down the internet.
Having a few vulns announced one day does not make it historic.
🚨 THE INTERNET BROKE TODAY 🚨
Oct 21, 2026 will go down in history
1. eMudhra : Private key was literally "4". 8 keys forged ANY website for 17 months. 60M+ certs at risk.
2. SBI CONFIRMED. 3,897 customers' mobile, DOB, address + loan data found on dark web.
3. Rajasthan Police 🇮🇳ALLEGED hack. Group claims 70,000 identity records + 59,460 numbers for sale. Unverified.
4. php2shell [9.2] Unauth RCE in PHP. 70% of the web. WordPress, Drupal, Laravel. CISA: Patch or GO OFFLINE.
5. GitLab [10.0/10] PERFECT SCORE. Unauth RCE, no login needed.
6. Node.js [CVE-2026-111497] Brotli decoder RCE + TLS bypass. 10 CVEs patched today. Also blocked eMudhra.
7. Railway BREACHED TODAY. Env variables decrypted. Your API keys & DB passwords exposed. Rotate all.
8. OpenCode BREACHED. OpenAI, Anthropic, Google API keys exposed for Console users. Distillation attack. Bills run up in $$$$.
9. LiteLLM PyPI v1.107.0 was MALWARE today morning. Steals credentials + backdoor.
10. Plex2Shell ACTIVELY EXPLOITED. Hackers installing cryptominers LIVE. CISA KEV, deadline Oct 23.
AI found the bugs. AI is exploiting them. Humans can't patch fast enough.
Patch. Rotate. Revoke. Update.
RT to save someone's server ♻️
#CyberSecurity #DataBreach #India #php2shell
