Reliability & Scale Engineering; Big on Linux ~ built and led the @CentOS project once.
London & Cambridge, UK
Joined November 2008
- Tweets4.9K
- Following105
- Followers14.9K
- Likes893
Karanbir Singh 🐧 retweeted
The @fosdem cfp's are coming in - are you going ? To speak ?
Karanbir Singh 🐧 retweeted
‼️ Attackers are exploiting a critical Fortinet FortiSIEM flaw that lets them run code without logging in, Canada's Cyber Centre says.
Horizon3 released an exploit for CVE-2026-106173 on Oct 20. Version 7.5.1 fixes it.
Fortinet still lists the flaw as not known to be exploited.
Karanbir Singh 🐧 retweeted
Fantastic to see this in the BBC site. Ultimately, open source and the Linux ecosystem exists purely because of the great people in it.
bbc.co.uk/news/articles/cw30…
Alright campers, rise and shine. We have patches to apply, cve hysteria to enjoy and other such fun things to start our weekend off right.
"Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell."
nitter.click/AikidoSecurity/…
Karanbir Singh 🐧 retweeted
Ruby’s turn 😅
Remember the GitLab bug? Well now it moved upstream into Ruby.
Multiple 10.0 CRITICAL exploits.
Patch now 🚨
Happy Friday 🤠
ruby-lang.org/en/news/2026/1…
Karanbir Singh 🐧 retweeted
The PHP security team is advising everyone to set this config until the next patch:
session.upload_progress.enabled=0
I’ll be cutting a release shortly where serversideup/php will do this for you by default ⚡️
php.net/archive/2026.php#202…
Dear @BBCNews you are going to need a replaced Cyber Correspondent
What
🚨 CONFIRMED: PHP has officially acknowledged another RCE vulnerability, CVE-2026-115560, affecting specific session configurations even after the October 21 patches.
A separate issue, not a bypass of the original fixes. A patch is planned.
We've updated our defensive toolkit:
github.com/syhunt/php2shell-…
#php #cybersecurity
Karanbir Singh 🐧 retweeted
In response to the eMudhra / emSign certificate security incident we've published guidance for Python users to update CA certificates: discuss.python.org/t/informa…
#security #Python #pki
discuss.python.org/t/informa…
Looks like it's real
An urgent notice from the Railway team
blog.railway.com/p/security-…
Karanbir Singh 🐧 retweeted
Quote: "an independent security researcher reported that the keys of eight eMudhra Global TLS intermediate Certificate Authorities were cryptographically weak".
Well, yeah, they were weak. A private key should look something like this:
84ac06790886c80c48d31691fd4c0fe9
ce3207f9807f2fe571d6e4ec426d7864
4298fc53df2b92566970e757ac998c34
Instead, their keys looked like this:
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000004
Global TLS Intermediate CA incident: We’ve updated our incident page with how it happened, who is affected (one US customer ecosystem), what’s not affected, and what we’re putting in place. We will publish the root cause once our investigation is complete.
👉emudhra.com/en/post/certific…
Readers added context they thought people might want to know
eMudhra minimizes the scope by claiming only "one US customer ecosystem" is affected. In reality, 8 of its CA certificates had catastrophically weak private keys (one being simply the number 4), allowing anyone to forge trusted HTTPS certificates for any website on the internet.blog.google/security/prote…
Just when it felt like we were done for the day
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Karanbir Singh 🐧 retweeted
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security thephp.foundation/blog/2026/…
Here we go
PHP Security Advisories are out:
RCE via OOM corruption (9.2/10): github.com/php/php-src/secur…
RCE via stale global state (9.2/10): github.com/php/php-src/secur…
Need to upgrade to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 ASAP to mitigate. Updates rolling out now. #PHP
Karanbir Singh 🐧 retweeted
Linux Kernel 7.3 Officially Released, This Is What’s New lxer.com/module/newswire/ext…
Karanbir Singh 🐧 retweeted
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
For more⬇️
ncsc.gov.uk/news/critical-se…
