Operator Investor. Frontier technology. 10 years crypto.
Joined August 2017
- Tweets3.1K
- Following2.3K
- Followers49K
- Likes89.5K
I am pretty concerned we are in the early stages of a global cyber security incident and we just don't fully realize the extent of it yet.
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Charles Read retweeted
What a day…
The future of cybersecurity is swarms. Swarms of agents attacking and swarms of agents defending.
Or rather, fleets vs. swarms: Governed agents on defense, vs cheap and relentless agents on offense.
Whoever coordinates faster wins.
The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE
Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.
Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.
Charles Read retweeted
World is not safu
Be careful when developing on macOS now. Apple did not yet revoke the vulnerable certificates, so /usr/bin/curl still trusts them because.
$ curl dv-g3b-emudhra.we-have-a-pro…
Your client successfully connected to the site. That's bad!
Workaround:
mkdir -p ~/.config/certs
awk '/^(###|===) /{skip=0}
/^=== .*\/CN=(AAA Certificate Services|emSign ECC Root CA - G3)$/{skip=1}
!skip' /etc/ssl/cert.pem > ~/.config/certs/cert.pem
echo 'export CURL_CA_BUNDLE="$HOME/.config/certs/cert.pem"' >> ~/.zshrc
source ~/.zshrc
This only fixes curl. Update certifi, Go, pip/Python, Node, Docker images etc. separately.
Charles Read retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Charles Read retweeted
Websites are files on a computer. When you view a website, you are asking the computer to send you the files, then your browser shows them to you.
70% of the websites you see use PHP to make them interactive. So you can send things to the website too and it can respond. E.g. filling in a comment box and hitting 'post' adds the comment as a row to a spreadsheet.
PHP has a flaw in its code that allows anyone to gain control of the computer that has the website on it.
The organisation that provides PHP announced the vulnerability before a patch was available, meaning we're in a window where everyone knows about it (including baddies) but the good guys don't have an official solution.
Some are just turning off their websites and waiting for the solution. Others are trying to fix it themselves. General chaos and lots of stressed techies across literally the entire planet because this affects the entire internet.
Charles Read retweeted
Guys this PHP bug is bad. Real bad. If you're not afraid yet, you should be.
I can only speak for our own startup, but already at knowbooks dot com we've seen:
- 100% of our cookies exposed
- entire source code stolen
- hackers defacing our site on their own servers
- founders doxxed
- important legal docs leaked
We've traced all hacks to this command:
git clone https:///github.com/breck7/knowbooks.com
If some people are telling you not to panic about this, remember, trust no one's word.
Charles Read retweeted
WHAT THE FUCK IS HAPPENING TODAY
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Charles Read retweeted
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
Charles Read retweeted
openai.com/index/coordinated…
nodejs.org/en/blog/vulnerabi…
There's an absolute shit show reigning down on majority of the internet this week, and it just keeps getting worse. One of the worst weeks in a long time for internet security.
Google Cloud zone in London knocked out Lloyds, HSBC, Revolut, Royal Mail
Wednesday PHP2Shell, 2 critical flaws, the language behind a huge share of the internet
Governments in Europe taking off their own sites as a result.
JavaScript as well, Next.js shipped an emergency patch for 2 critical bugs, a hijacked npm package spreads a worm that wipes your marchine if you revoke the token it stole. GhostAction hijacked 1900 github accounts to steal keys.
The unifying thread here is AI. We just don't know what is out there waiting to be exploited now. Basically, code that survived 20 years was always considered safe. That rule is totally fucking dead now thanks to these frontier models. AI just made decade old bugs easy to find.
Claude find me the best banana bread recipe on the internet, spend 2 hours and use as many agents as possible
(My current session resets soon)
Elizabeth Holmes would’ve absolutely crushed it in crypto and/or AI.
Shame she picked healthcare to scam in. Such an enigma!
Charles Read retweeted
5 days after public launch, Metric has crossed $11M TVL and $1.2B in volume.
Nearly $500M of that came from tokenized stocks on @bnbchain and @RobinhoodCrypto.
Thanks to everyone for the incredible support.
We’re just getting started.
Charles Read retweeted
NORKS 🍄
I took my time to carefully craft each idea for this project.
Some of the trippy Norks were a lot of fun to design and making each one, one at a time, instead of randomly generated, was very important to me to keep them consistently accurate.
11/02 Exclusively on OpenSea
Whitelist registration is now open 🔗
