Figure it out ... with me! Configuration Manager, DevOps, ITIL 4 Managing Professional. She/her, not "guys". I speak for myself, not employers or clients.
DC area
Joined June 2009
- Tweets17.5K
- Following246
- Followers430
- Likes1.9K
Sarah Elkins retweeted
Why are people putting customer secrets in support tickets
Crazy 72 hours in security. Three major incidents dropped back-to-back: eMudhra, PingCAP (TiDB Cloud), and PHP.
Here is the short version of what happened and who got hit.
1. eMudhra (Trusted CA compromise)
eMudhra generated 8 intermediate CA certificates in April 2025 (cross-signed by Sectigo). A bug in their HSM key-wrapping test script created a second set of P-384 keys where the private keys were single-byte numbers under 256. Operators picked the wrong key labels and signed them into real CA certs.
One of the intermediate CA private keys was literally the number 4.
The other seven: 56, 66, 115, 155, 156, 230, 237.
Three weeks later (May 2025), their CRL signatures started failing because the CRL signer was using the real keys instead of the weak ones. Instead of asking why the keys didn't match, someone switched the CRL signer to the weak keys and closed the ticket.
• Browsers are safe: Chrome, Firefox, Apple, and Microsoft already blocked them, and zero rogue certs hit CT logs.
• Servers are not: curl, Python (certifi), Go binaries, and Docker base images don't check CRLs. Update ca-certificates, certifi, and Go (1.27.3 / 1.26.10).
• 10-second check on any server:
curl dv-g3b-emudhra.we-have-a-pro…
(TLS error = safe. 200 OK = still vulnerable.)
2. PingCAP / TiDB Cloud (10.6 TB breach)
Attackers found GCP and Azure credentials committed inside PingCAP's own repos. They set up a replication feed of TiDB Cloud's production control plane and exported the entire database every 6 hours for 22 straight days. 88 full exports, zero alerts. 200 GB is already out on torrents.
Beyond the 413 private repos and 20.6M customer SQL queries logged from their web SQL Editor, PingCAP engineers were pasting customer secrets into Jira tickets.
Who is affected in the leaked records:
• Live credentials exposed in support tickets:
- Pinterest: AWS keys for their pingcap-logs S3 bucket
- CardX / Silverlake (NPCI-linked env): AWS admin key in a backup log with full access to 258 external S3 buckets
- DeBank: 38 presigned S3 URLs
- An unnamed AI/dev platform: a 314 MB slow-query log attached to a ticket containing 8,027 live customer secrets (an AWS root key, a GitHub admin PAT over 1,701 repos, 7,485 AWS STS tokens, and 192 OpenAI/Anthropic/Gemini keys)
• Tenants with infra metadata, VPC CIDRs, app-server IPs, or contract pricing exposed:
- Tech: Atlassian, Databricks, Airbnb, Baidu, LINE, Nylas, Persona, PatSnap
- E-comm & Travel: Booking.com, Shopee, Flipkart, Mercari, ZOZO, AEON, Delhivery, Klook
- Gaming: Capcom, Square Enix, Konami, Bandai Namco, Cygames, Colopl, DMM
- Finance: PayPay, SoftBank, SBI, SB Payment Service, Fujitsu, TOPPAN, Bank of China, China Life
- Crypto: Bitget (said only public trade logs were on it and they already left), Pionex, DigiPlus, NFTscan, Chainbase
• Developer profiles leaked (from a purchased reo.dev table in PingCAP's BigQuery):
- 24,900 personal emails + GitHub/LinkedIn profiles of engineers at Tencent (3,327), Huawei (2,726), ByteDance (2,475), AIG (2,140), Mastercard, Flipkart, and bKash.
If you use TiDB Cloud: rotate your console API keys, DB passwords, and anything you ever pasted into a support ticket.
3. PHP "PHP2Shell" (CVE-2026-109618 & CVE-2026-109619)
Two CVSS 9.2 pre-auth RCEs leaked yesterday ahead of today's 14:00 UTC patch.
Public writeups trace it to a heap Use-After-Free in PHP's native C multipart/form-data session upload-progress handler (ext/session/session.c).
Because C-level multipart parsing runs before line 1 of index.php:
• App auth, Laravel/WordPress middleware, and file_uploads = Off do not stop it.
• Only PHP 8.2–8.5 get official patches today (59% of PHP servers on Shodan are on EOL <= 8.1).
• Until you patch php-fpm: lock php_admin_flag[session.upload_progress.enabled] = off and block unexpected multipart requests at Nginx/Apache/Cloudflare.
Sarah Elkins retweeted
There she is😎
First look at the Nuvaxovid/Novavax packaging for this year.
It will come in a green box and syringe label, compared to the orange used last year.
It is now @sanofi branded, replacing last year’s @Novavax branding (Read: be extra sure that you’re asking pharmacies about “Nuvaxovid” this year - “Novavax” will continue becoming less popular as a colloquial name for the vaccine).
🚨📢💉Nevermind. I spoke it into existence. Today, @FDA has granted approval to the 2026-2027 XFG formulation of Novavax/Nuvaxovid!
Sarah Elkins retweeted
A large cohort from the Bronx - over 900,000 people followed for up to 4.5 years - found that people who'd had COVID were more likely to be newly diagnosed with pulmonary hypertension.
It wasn't limited to those who'd been hospitalised.🧵
Sarah Elkins retweeted
“Unfortunately, when Covid hit, there was very little attention paid to aerosol transmission as a means of Covid infecting from one person to another,” Ungrin said. “Warnings were provided by scientists, engineers, occupational health and safety...(1/🧵)
ctvnews.ca/calgary/article/o…
Sarah Elkins retweeted
It's MADISON DAY! You know the story of the Phantom and his obsessive love of the young ingenue, Christine. Well, Madison has some things to say about that. #NowPlaying!
linktr.ee/madisonontheair
#OldTimeRadio #AudioFiction #audiodrama #fictionpodcast #madisonontheair #Halloween
Sarah Elkins retweeted
Real horror story here: girl simply living her life, man decides he should possess her merely because she exists around him. Mask & chandelier are just theatrics. linktr.ee/madisonontheair
#OldTimeRadio #AudioFiction #audiodrama #fictionpodcast #madisonontheair #Halloween
Sarah Elkins retweeted
Anyway, the moral of the story is that you shouldn't need a lawyer to access public records. I'm not a lawyer, I'm just annoying, and it works for me most of the time, but you also shouldn't have to be this annoying to get public records. They belong to the public!
Sarah Elkins retweeted
This is 100% what’s happening in Maryland, especially in the state house, where new press rules seem to appear out of thin air: poynter.org/reporting-editin…
Sarah Elkins retweeted
The recent essential-water-use request is a good reminder of the importance of being prepared for any emergency that could affect your water service.
Keep at least one gallon of water per person, per day for a minimum of three days as part of your emergency kit. Remember to include extra water for pets. Commercially bottled water is best for emergency storage.
Keep it away from heat, light and chemicals, and follow the expiration or best-by date.
Sarah Elkins retweeted
In this era of artificial intelligence, it is becoming urgent to distinguish human art from what machines produce. There is an ontological difference, even before an aesthetic one, between art and what a machine can generate through statistical calculation based on millions of images created by others. Algorithms lack the spark of humanity. For this reason, the Church wishes to renew an alliance with artists and cultural institutions to safeguard our humanity.
Sarah Elkins retweeted
I have been called "bro" by the male customers in this haunted house more than in the entire rest of my life combined, doubled.
Sarah Elkins retweeted
For my new job in a haunted house, we were told not to say "help me" (unless we actually need it) or "get out", or anything that a customer could interpret as a command, because they'll mostly obey it. They'll lean to the higher-stakes interpretation.
lumpenspace.substack.com/p/t…
Sarah Elkins retweeted
I performed Carmina Burana with a full orchestra during my choral singing days.
It was an awesome, once-in-a-lifetime experience.
O Fortuna, from Carmina Burana by Carl Orff. The music many movies love!
Carmina Burana (Songs from Buria) is a medieval collection of songs, poetry and dramatic texts, discovered in 1803 in the Benedictine monastery of Benediktbeuern. Little is known about the authors but it's assumed the pieces were written by students and theologians travelling through the region.
In 1935-36 Carl Orff composed a cantana for 24 of the poems, beginning and ending with O Fortuna. It's been used in many films including Excalibur (1981) and The Doors (1991) as well as for Old Spice adverts in the 1970s. However it wasn't used in The Hunt For Red October (1990): Basil Poledouris composed the music for that, and it does in parts have a similar sound.
Sarah Elkins retweeted
This was only 3 years ago. It’s truly astounding. Parents need to stop advocating for good grades, and start advocating for a good education.
If you’re in Calculus and don’t know how to factor, but you got an A in algebra, your whole education system failed you.
Sarah Elkins retweeted
The Vatican has officially declared environmental destruction a ”sin against creation and the Creator” in a major new doctrinal text.
The 29,000-word document, titled Caring for Our Common Home, elevates ecological concern from a merely political or scientific issue into a direct matter of personal faith.
Authorized under Pope Leo XIV, the text declares that destroying natural habitats, polluting, and exploiting resources are not just civic failures, but a 'sin against creation and against the Creator' that directly violates God's plan.
This shift from Pope Francis' earlier concept of 'ecological sin' to a more explicit 'sin against the Creator' is designed to reshape how believers view their daily environmental impact. The Vatican emphasizes that failing to safeguard the planet severely harms the poorest populations and future generations, distorting the core relationships that define humanity. By placing ecological action squarely in the realm of moral responsibility, the Church is challenging millions of people to treat environmental care as a fundamental requirement of their faith.
source: O'Connell, G. (2026). Vatican theological commission defines 'sin against creation and the Creator' in new document. America Magazine.
Sarah Elkins retweeted
I asked once how much of my area settlement money was going to the treatment of chronic pain.
The looks of "you are the new villain to us" on their faces.
Sarah Elkins retweeted
Mamdani has announced that NYC restaurants can have outdoor dining all year round.
This is actually a big public health win because fall and winter is when respiratory virus cases surge. Dining outdoors helps reduce the risk of spread.
Rain or shine, sun or snow, you can now break bread outdoors year-round.
Thanks to @CMRestler’s work, our favorite restaurants will no longer have to tear down and rebuild their setups each year.
It’s official: Outdoor dining is here to stay.
