Father, Husband, Software Architect, Go+HTMX+Elixir shill, Tech Enthusiast. Occasionally posting jobs.
Earth
Joined March 2011
- Tweets19.8K
- Following1.6K
- Followers2K
- Likes61.7K
Man these governments are losing their backdoors so fast
Code-Execution Flaw In UEFI Firmware Threatens Most Servers On Planet Earth ift.tt/euAVjB6
Readers added context they thought people might want to know
The headline overstates the risk; the flaw only affects EDK2-based systems actively PXE network-booting and requires local network access during that narrow window.
github.com/tianocore/edk2…
arstechnica.com/security/2026/…
news.ssbcrack.com/cve-2026-97631…
Times like this I'd like to remind you to never trust a service provider to be your sole backup. On the topic of Github, you can easily run a project like this on your NAS: github.com/abusesa/github-ba…
someone outside our GitHub org deleted one of our private repos.
no membership or invite or role. nothing in our org or enterprise audit logs gave them access. just one repo.destroy from the gh CLI.
and it's not in deleted repositories, so no restore.
@github how is this possible, what sorcery is this?
lmao, you can just tell grok bot to debloat your tv and kill all the advertisements, bloatware, listening services and it will happily tunnel through your computer, use network adb, and rip out as much as possible.
lmao 4 strikes again
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Too many people think PEMDAS means everything inside and touching parentheses first. They forgot the rule that there’s an implied multiplication on anything touching the exterior of the parentheses.
1. Parentheses interior
2. Exponentials
3. Multiplication and division, equal weight
4. Addition and subtraction equal weight
Simple.
The emudrha thing is a blessing. Use this window to grab the packets between your devices and their servers. Particularly smart tvs…
Just found a Linux and Mac zero day! If you type “sudo rm -rf /“ it deletes your entire drive if you enter your password.
These frontier labs are brining problematic in legitimate work. Grok refused to help me intercept traffic on an application to inspect the traffic, I can do it on my own I just wanted it accelerated. It’s insanity because I can pull up some other open weight model and not be told what I can and cannot do.
Good news everybody, you’re all employed through Christmas
🚨BREAKING: It's over.
Cloudflare CEO Matthew Prince told Reuters he knows of additional severe vulnerabilities in other pieces of critical software that are currently being patched, beyond the PHP flaws that disrupted government websites this week.
Prince predicts busy months ahead as AI surfaces long-hidden weaknesses in the 'fabric of the internet': 'every single week it's going to feel like the sky is falling.'
Gets unmanaged VPS and then complains they need to manage it.
Did anyone expect @GoDaddy to do right during the PHP2Shell crisis?
A client who manages their own VPS but is on vacation just got this message.
GoDaddy refuses to install the patch for them.
Despicable.
Readers added context they thought people might want to know
GoDaddy requires self-managed VPS customers to install their own patches including PHP updates per their policies while handling managed plans themselves. The message shown matches this guidance for unmanaged VPS.
godaddy.com/help/patch-my-…
godaddy.com/help/statement…
x.com/GoDaddyPro/sta…
Everybody needs to chill and just stay on top of it for now. Consider the influx of security vulnerabilities undisclosed backlog. Use the same tools that are accelerating discovery to fix it.
Frontier labs and their safeguards proving once again they cannot be trusted in a security incident.
Railway has been turbo pwned, I'm freaking out because hackers have access to decrypted ENV variables and I asked Claude to help but-
NOPE. NOT CLAUDE.
The most dangerous part of this ecosystem is @anthropic and their ridiculous moralizing.
Howard Lince III retweeted
UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: nsa.gov/Press-Room/Press-Rel…
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
all of the backdoors are being exposed! oh no!
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
