
CSDC, IT-Security & Cloud Computing Engineering | network solutions | #Bitcoin is the future. | love cats & my gf
Wien, รsterreich
Joined April 2015
- Tweets7.6K
- Following1.5K
- Followers341
- Likes57.1K
โข ๐ฏ๐๐๐ retweeted
What a disaster atlasum.net/blog/cve-2026-98โฆ
โข ๐ฏ๐๐๐ retweeted
๐จ NOW 53 COUNTRIES ARE TELLING THEIR CITIZENS TO STOCKPILE FOR EMERGENCY. HERE IS THE FULL LIST
๐ EUROPE (29):
๐ฆ๐น AUSTRIA: 10โ14 DAYS
๐ธ๐ฐ SLOVAKIA: 14 DAYS (POWER CUTS)
๐ฉ๐ช GERMANY: UP TO 10 DAYS
๐ธ๐ช SWEDEN: 1 WEEK
๐ณ๐ด NORWAY: 1 WEEK
๐จ๐ญ SWITZERLAND: 1 WEEK
๐ช๐ช ESTONIA: 1 WEEK
๐ธ๐ฎ SLOVENIA: 3 DAYS WATER, 30 DAYS FOOD
๐ฌ๐ง UK: 3 DAYS
๐ฉ๐ฐ DENMARK: 3 DAYS
๐ต๐ฑ POLAND: 3 DAYS
๐ฌ๐ท GREECE: 3 DAYS
๐จ๐พ CYPRUS: 3 DAYS
๐ฎ๐ธ ICELAND: 3 DAYS
๐ซ๐ท FRANCE: 72 HOURS
๐ณ๐ฑ NETHERLANDS: 72 HOURS
๐ซ๐ฎ FINLAND: 72 HOURS
๐ฑ๐ป LATVIA: 72 HOURS
๐ฑ๐น LITHUANIA: 72 HOURS
๐จ๐ฟ CZECHIA: 72 HOURS
๐ญ๐ท CROATIA: 72 HOURS
๐ง๐ช BELGIUM: 72 HOURS
๐ฑ๐บ LUXEMBOURG: 72 HOURS
๐ช๐ธ SPAIN: 72 HOURS
๐ต๐น PORTUGAL: 72 HOURS
๐ท๐ด ROMANIA: 72 HOURS
๐ง๐ฌ BULGARIA: 72 HOURS
๐ฒ๐ฉ MOLDOVA: 72 HOURS
๐ฎ๐ช IRELAND: "STOCK THE ESSENTIALS"
๐ AMERICAS (9):
๐ต๐ช PERU: 4 DAYS
๐จ๐ฆ CANADA: 72 HOURS
๐ฒ๐ฝ MEXICO: 72 HOURS
๐จ๐ด COLOMBIA: 72 HOURS
๐ช๐จ ECUADOR: 72 HOURS
๐จ๐ฑ CHILE: 48โ72 HOURS
๐บ๐ธ USA: "SEVERAL DAYS"
๐ง๐ท BRAZIL: EMERGENCY KIT
๐ฆ๐ท ARGENTINA: EMERGENCY BACKPACK
๐ ASIA (12):
๐น๐ผ TAIWAN: 7 DAYS
๐ฏ๐ต JAPAN: 3 DAYS, 1 WEEK IF POSSIBLE
๐ฎ๐ฑ ISRAEL: 3 DAYS
๐ฐ๐ฟ KAZAKHSTAN: 3 DAYS
๐น๐ท TURKEY: 72 HOURS
๐ฌ๐ช GEORGIA: 72 HOURS
๐ฎ๐ฉ INDONESIA: 72 HOURS
๐ฒ๐พ MALAYSIA: 72 HOURS
๐ฐ๐ผ KUWAIT: 2 DAYS
๐ฎ๐ณ INDIA: EMERGENCY KIT
๐ต๐ญ PHILIPPINES: GO BAG
๐ธ๐ฌ SINGAPORE: READY BAG
๐ OCEANIA + AFRICA (3):
๐ณ๐ฟ NEW ZEALAND: 3+ DAYS
๐ฟ๐ฆ SOUTH AFRICA: 3 DAYS
๐ฆ๐บ AUSTRALIA: EMERGENCY KIT
๐ช๐บ EU: EVERY CITIZEN READY FOR 72 HOURS
REASONS GIVEN: WAR. EXTREME WEATHER. CYBER ATTACKS.
WHAT DO THEY KNOW THAT WE DON'T?
FOLLOW ME FOR EVERY NEW COUNTRY THAT JOINS ๐
๐จ GOVERNMENTS ARE TELLING CITIZENS TO STOCKPILE FOR EMERGENCY
๐ฌ๐ง UK: 3 DAYS
๐ฏ๐ต JAPAN: 3 DAYS
And they are not alone:
๐ง๐ช Belgium: 72 HOURS
๐ฎ๐ช Ireland: โBe Emergency Readyโ
๐ซ๐ท France: 72 HOURS
๐ฉ๐ช Germany: 3 to 10 DAYS
๐ณ๐ฑ Netherlands: 72 HOURS
๐ต๐ฑ Poland: 3 DAYS
๐ธ๐ช Sweden: 1 WEEK
๐ณ๐ด Norway: 1 WEEK
๐ซ๐ฎ Finland: 72 HOURS
๐ฉ๐ฐ Denmark: 3 DAYS
๐ช๐ช Estonia: 1 WEEK
๐ฑ๐ป Latvia: 72 HOURS
๐ฑ๐น Lithuania: 72 HOURS
๐จ๐ญ Switzerland: 1 WEEK
๐น๐ผ Taiwan: 7 DAYS
๐ช๐บ EU: 72 HOURS
17 countries + the EU.
What do they know that we donโt?
Follow me so you donโt miss what comes next ๐
Readers added context they thought people might want to know
The viral list compiles routine longstanding preparedness recommendations for disasters rather than new synchronized warnings from governments.
gov.uk/government/newโฆ
afad.gov.tr/afet-ve-acil-dโฆ
commission.europa.eu/topics/prepareโฆ
โข ๐ฏ๐๐๐ retweeted
Under pressure from Israeli prime minister Benjamin Netanyahu, the Trump administration may be within days of launching a nuclear strike on Iran. The target would be Pickax Mountain in central Iran, where Israeli intelligence claims the Iranian government has restarted its nuclear enrichment program. No conventional weapon in the American arsenal can penetrate 300 feet of solid granite to destroy the tunnels where enrichment is supposedly taking place. The only military option is a nuclear strike. Netanyahu has been pushing hard for one. โBibi calls Trump about it every day,โ says an informed observer.
Netanyahu is cornered and desperate. After last weekโs election results, he canโt form a government unless Trump intervenes directly in Israeli politics and brokers a deal with other parties that gives Netanyahu 61 seats in the Knesset. Otherwise, he is out as prime minister and on his way to ignominy, investigations and possibly jail. Netanyahu must stay close to Trump. He needs this war.
To that end, heโs applied maximum pressure to his closest allies in the administration, including Secretary of Defense Pete Hegseth and CENTCOM commander Brad Cooper. Both oppose a negotiated settlement to the war theyโve so grievously mismanaged; both are pushing to restart major combat operations. Secretary of State Marco Rubio and CIA director John Ratcliffe are also following Netanyahuโs lead, as are leaders of the Democratic Party. In a recent meeting on the subject, former president Barack Obama said he opposes the current Iran peace deal being drafted in Doha.
The rest of Americaโs longtime allies in the Middle East are terrified by the prospect of more war. On September 27th, Netanyahu flew secretly to Abu Dhabi to enlist the UAE in his lobbying effort for a final attack on Iran. The Emiratis refused. After eight months of conflict, Gulf economies are teetering. So are global energy and fertilizer markets. They wonโt recover soon. Globally, there are a total of about 850 supertankers used to transport oil from producers to the rest of the world. In October alone, 11 of them were badly damaged in Hormuz. At this pace, a global depression is imminent. A nuclear strike would radically accelerate the destruction. Fallout from a ground explosion at Pickax Mountain would contaminate the Persian Gulf, poisoning the water supply for 100 million people.
And those are just some of the immediate consequences for the region. The rest of the world is every bit as exposed. No country other than the United States has ever used a nuclear weapon in war. Some would like to. An American nuclear attack on Iran would set a new precedent. The Russians have already told at least two other governments that an American nuclear strike on Iran would free them to use nuclear weapons against Ukraine. Pakistan and India would be tempted to do the same against each other, as would North Korea against Seoul. After the first nuclear strike, World War Three is inevitable. That war would be short and final.
Weโve been sleepwalking toward this moment for months. Since February, the administration has quietly rewritten Americaโs nuclear doctrine to make first use of so-called โbattlefield nukesโ easier and therefore more likely. No one in Washington in either party seems bothered by this. Now weโre on the brink of it.
Close observers say Trump is likely to decide by next weekend whether or not to use nuclear weapons. That would be November 7, six days from now. To his credit, heโs hesitating. At the moment, Trump is listening to his vice president, JD Vance, and to his envoy and friend Steve Witkoff, both of whom argue a deal with Iran can be made.
Theyโre right, though it wonโt be simple. The Iranians are famously frustrating to negotiate with under any circumstances, and elements of that government have become more radical since Ayatollah Ali Khamenei and his family were killed in February. After decades of isolation, even relatively moderate Iranian leaders seem confused by how decisions are made in the West. (There is a widespread belief in Tehran, for example, that the United States government controls Israel.) But overall, people who have spoken to decision-makers in Iran say there is consensus there that more war is bad for everyone and a deal is worth making.
One group that hasnโt been consulted so far is the global population โ the hundreds of millions of people who will be killed along with their children if Trump is pushed by Netanyahu into launching a nuclear strike next week. Now would be the time for them to speak up.
โข ๐ฏ๐๐๐ retweeted
โผ๏ธ Ubuntu and Red Hat still have no fix for a Linux kernel flaw that Anthropic says its unreleased AI model turned into a remote root exploit.
The bug, CVE-2026-98432, is a use-after-free in the IPv4 TCP handshake, rated 9.8 out of 10.
The exploit needs no credentials and targets servers with a multipath TCP listener, which Go 1.24 and later open by default.
The fix reached stable kernels on 11 October and Debian has shipped it. Ubuntu still marks every release from 16.04 to 26.10 vulnerable.
Red Hat now rates it Critical but has no patched kernel for RHEL 8, 9 or 10.
Anthropic has not released the exploit. By its count, it takes 48 minutes to leak a kernel pointer and five more to run commands as root.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineerโs laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the companyโs funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annouโฆ
โข ๐ฏ๐๐๐ retweeted
๐ด CVE-2026-98432 | Linux Kernel โ Critical UAF
Linux รงekirdeฤinde TCP/IPv4 baฤlantฤฑ iลleme sรผrecini etkileyen, uzaktan istismar potansiyeline sahip bir Use-After-Free (UAF) aรงฤฑฤฤฑ tespit edildi.
โ CVSS 3.1: 9.8 (Critical)
โ Aฤ รผzerinden istismar
โ Kimlik doฤrulama gerektirmiyor
โ Bellek gรผvenliฤi ve sistem kullanฤฑlabilirliฤi riski
Sistem yรถneticileri, linux daฤฤฑtฤฑmlarฤฑnฤฑn gรผvenlik duyurularฤฑnฤฑ takip ederek yamalฤฑ sรผrรผmlere geรงmelidir.
ubuntu.com/security/CVE-2026โฆ
โข ๐ฏ๐๐๐ retweeted
today we launched ChatGPT. try talking with it here:
chat.openai.com
โข ๐ฏ๐๐๐ retweeted
Israelische Wรคhler entscheiden, wer in Zukunft Palรคstinenser bombardieren wird der-postillon.com/2026/10/knโฆ
โข ๐ฏ๐๐๐ retweeted
hOw Do We FiND tHe VulnErAbLE PhP SerViCeS??!!?!!
seriously?
nmap -sV --reason -A -vvv -p80,443,8080,8000,8443 --script http-headers,http-server-header,http-generator 10.0.1.1/24
look for X-Powered-By: PHP/version
this isn't hard guys.
Imagine running PHP and Go on the backend, Node.js on the frontend, NGINX as the reverse proxy, Linux as the server, an HTTPS certificate from eMudhra
And also deploying everything via GitLab
โ๏ธ
โข ๐ฏ๐๐๐ retweeted
GitLab has patched a critical security flaw with a CVSS score of 10.0, the highest possible severity.
The vulnerability, CVE-2026-110264, could allow an unauthenticated attacker to execute arbitrary code on self-managed GitLab servers.
It affects GitLab versions dating back to 7.0, released in 2014.
GitLab says there is currently no evidence that the flaw has been exploited, but recommends updating to a patched version as soon as possible.
โข ๐ฏ๐๐๐ retweeted
As if PHP2Shell wasn't enough for one day... now GitLab. ๐
๐จ CRITICAL GITLAB ALERT (CVSS 10.0)
CVE-2026-110264 could allow unauthenticated RCE on self-managed GitLab servers.
โ ๏ธ Potentially affects 12 years of releases, dating back to 2014.
Patches available. Update immediately!
docs.gitlab.com/releases/patโฆ
#gitlab #cybersecurity
โข ๐ฏ๐๐๐ retweeted
๐จ CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/crโฆ
โข ๐ฏ๐๐๐ retweeted
๐จ UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
โ ๏ธ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just because you've patched.
#php4shell #php #cybersecurity
nitter.gq/_annieversary/status/2โฆ
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793โฆ
โข ๐ฏ๐๐๐ retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
โข ๐ฏ๐๐๐ retweeted
chat. chat... its not funny anymore
PHP Patch is out!!
PHP 8.5.12: 31c0ea7d7f github.com/php/php-src/commiโฆ
PHP 8.4.27: 506e87fa7d github.com/php/php-src/commiโฆ
PHP 8.3.36: 3c832b523e github.com/php/php-src/commiโฆ
PHP 8.2.35: 01a40e89fb github.com/php/php-src/commiโฆ
The two advisories with the full details:
GHSA-w8hw-w9fx-j79w (CVE-2026-109618) github.com/php/php-src/securโฆ
GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) github.com/php/php-src/securโฆ
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793โฆ
โข ๐ฏ๐๐๐ retweeted
โผ๏ธBREAKING: PHP has released its fix for the two leaked flaws, which can let attackers run code on servers without logging in.
"There are no complete mitigations, updating is the only safe choice," PHP says.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
PHP says Apache with mod_php is most at risk, with a demonstrated exploit that fires before any application code runs.
PHP 8.1 and older get no official update, though PHP has published source backports for 7.4, 8.0 and 8.1.



























