π±ππππππ ππ ππππππ, πππππππππ, & ππππππππππ’. π±ππππππππ πππ ππππ πππππ & ππππππππππ. π·ππππ π / πππππ & πππππ. π²ππππππππππ. π²ππππππππ. π²πππππ πππππ’.
Not @ 33.0794078, 44.1315785
Joined September 2009
- Tweets214K
- Following568
- Followers46.4K
- Likes199K
Pinned Tweet
War, he sung, is toil and trouble;
Honour, but an empty bubble;
Never ending, still beginning,
Fighting still, and still destroying:
If the world be worth thy winning,
Think, O think it worth enjoying;
Lovely Thais sits beside thee,
Take the good the gods provide thee β
I ordered some more stuff and some stickers for friends from appalachiansyndicate.com/
after winning prize table loot. This optic kit is cool and much sturdier than I imagined. And thatβs not a marker. They even included a nice handwritten note.
We have men like this in every community in America. Weβre lucky he knew his duty. Never let him buy a beer or drink one lonely.
We can make them stay detained now but keep it short
π
This morning, two former senior FBI officials, Nikki Floris, 46, and Bradley Benavides, 56, surrendered on arrest warrants after being charged with lying to Congress about their roles on the Foreign Influence Task Force during the 2020 election.Β Floris and Benavides allegedly lied to Congress about their roles in the FBIβs Hunter Biden investigations, with one claiming they only learned about it from Wikipedia - despite evidence showing their involvement in helping shape the public narrative about Hunter Bidenβs laptop right before the election.
Β
Lying to Congress by anyone strikes at the heart of our democratic system, but when senior FBI agents lie to Congress believing they are above the law, itβs time to bring the hammer of justice down on them. When senior officials entrusted with safeguarding our nationβs security choose deception over duty, they undermine the very institutions they swore to uphold.
Β
Todayβs action makes clear that no one is above the law, and we will hold accountable all who obstruct the truth.
πΆππππππ π΄ retweeted
She's a 4, but she's a private key for a intermediary CA.
πΆππππππ π΄ retweeted
And the security shitshow continues... Four more things to add to yesterday's list. We're now at nine(!) major security issues and developments in just a few days.
6. ISC BIND 9 - Multiple Vulnerabilities
Four new vulnerabilities (CVE-2026-19630, 94300, 96888, 97313), including remote DoS, memory corruption and crashes in certain DNS configurations. Fixed in BIND 9.20.30 and 9.21.27.
kb.isc.org/docs/all-bind-advβ¦
7. Oracle Java / JSSE (CVSS 9.1)
CVE-2026-91403. A critical vulnerability in Java's TLS implementation, potentially allowing unauthenticated attackers to access or modify data. Affects Java 8, 11, 17, 21, 25 and 27, plus GraalVM.
oracle.com/security-alerts/aβ¦
8. Windows SMB Server DoS (CVSS 7.5)
CVE-2026-96325. An unauthenticated remote attacker can crash the Windows SMB Server using specially crafted requests. Not RCE, but still a serious availability issue for exposed systems.
msrc.microsoft.com/update-guβ¦
9. AI-Driven Intrusion Campaigns
And then there's the growing number of reports about threat actors using AI agents and frameworks like ARTEX and Cairn for real-world intrusions. Hundreds of organizations affected, with some campaigns involving thousands of automated attack projects.
Microsoft / ARTEX:
microsoft.com/en-us/securityβ¦
NorForge / Cairn:
norforge.com/blog/inside_caiβ¦
I'm starting to wonder what next week will look like...
(you can find 1.-5. in the quoted tweet)
π€ Made with AI
This week has been quite a shitshow already, and there are still 2 days to go
Hereβs a quick recap of the security mess weβve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Greatβ¦
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.php#202β¦
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-20β¦
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell-β¦
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell-php-rcβ¦
Corelightβs open-source Zeek and Suricata detection rules:
github.com/corelight/php2sheβ¦
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/patβ¦
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulnerabiβ¦
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unboundβs DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unbounβ¦
5. eMudhra CA disaster
And then thereβs this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Googleβs analysis and response:
blog.google/security/protectβ¦
Mozillaβs public incident investigation, including the technical findings, timeline and eMudhraβs explanations:
bugzilla.mozilla.org/show_buβ¦
β
And I canβt help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
Iβm not saying these particular vulnerabilities were discovered using AI. I havenβt seen evidence for that. But I do wonder whether weβre starting to see some of the effects.
The eMudhra case is obviously a different story. Thatβs a spectacular failure of key management and quality control.
Anyway, quite a week. And itβs only Thursdayβ¦
Bee moves like sheβs cold. One of her last trips out before she spends a long stretch shivering around her boss probably. Weird bug
