CyberSecurity 🧑🏻💻 & Martial Arts 🥋 All tweets are my own. My posts are my personal views. They do not represent the views of my company 🇬🇧 🇦🇪 🇸🇦
Dubai, United Arab Emirates
Joined July 2009
- Tweets16.3K
- Following2.3K
- Followers1.2K
- Likes9.5K
Pinned Tweet
Is AI Changing the Cybersecurity Game? @GISECGlobal UAE pre-event show
youtu.be/BhtqYWWTFm0?si=wCFX…
Stephen Marriott retweeted
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
The @FCDOtravelGovUK posts a flurry of advisories for the Middle East, including updates for all GCC countries.
FCDO Update for the UAE: The context in the Middle East remains deeply unpredictable and the risk of sudden escalation is high. Since conflict began in early 2026, Iran has stated its intention to target locations associated with the US and Israel. @ukinuae
FCDO Update Saudi Arabia: In addition to the threat from Houthi attacks, the wider context in the Middle East remains deeply unpredictable and the risk of sudden escalation is high.
Nice write-up by @rik_ferguson PHP2Shell: keep your head, count the cost. linkedin.com/pulse/php2shell…
A newly disclosed Brotli decoder vulnerability (CVE-2026-111497) could allow memory corruption and potential remote code execution via crafted compressed data. Affected platforms include Node.js, Bun, Envoy Proxy and Istio. patchtheplanet.org/brotli
RUH Airport Update: Terminal (1) will be designated for domestic flights and Terminal (2) for international flights operated by national carriers at King Khalid International Airport in Riyadh, effective Sunday, 25th October 2026
U.S. MISSION UAE
The Travel Advisory for United Arab Emirates was updated on 23rd October 2026, to reflect the threat of increased Iranian-supported Houthi regional aggression.
ae.usembassy.gov/travel-advi…
U.S. MISSION SAUDI ARABIA
24th October 2026 Travel Advisory.
The Department of State has ordered non-emergency U.S. government employees and U.S. government employee family members to leave Saudi Arabia due to safety risks.
sa.usembassy.gov/travel-advi…
The General Authority of Civil Aviation (GACA) announces that King Fahd International Airport in Dammam was targeted by an attack on the evening of Wednesday, October 21, 2026, corresponding to 10 Jumada Al-Awwal 1448 AH.
Millions of PHP Instances Exposed - What Organisations Need To Do Right Now @Unit42_Intel
paloaltonetworks.com/blog/20…
The joys of IT …!
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Saudi Arabia FCDO Updated information about King Khalid Airport which continues to be targeted and ongoing threat from terrorism in Saudi Arabia.
Time updated:
12:35pm, 21 October 2026
The UK Ministry of Defence (MoD) has confirmed additional military support to Saudi Arabia, with RAF Typhoons set to conduct defensive air missions aimed at protecting Saudi airspace from drone and missile threats.
The Houthi attacks on our ally Saudi Arabia are dangerous for the region.
Today @wesstreeting approved further UK military support for Saudi Arabia. RAF Typhoons will fly defensive air missions to protect Saudi airspace from drones and missiles. This builds on the air defence and air-to-air refueling support we have already provided.
Video credit: @BBCNews
Stephen Marriott retweeted
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
For more⬇️
ncsc.gov.uk/news/critical-se…
Stephen Marriott retweeted
تم إطلاق إنذار من المنصة الوطنية للإنذار المبكر في حالات الطوارئ في مدينة الرياض للتحذير من خطر، اتبع الآتي:
A warning has been issued by the National Early Warning Platform in Riyadh City to alert of a potential danger. Please follow the instructions below:
