Reliability & Scale Engineering; Big on Linux ~ built and led the @CentOS project once.
London & Cambridge, UK
Joined November 2008
- Tweets4.9K
- Following105
- Followers14.9K
- Likes893
Karanbir Singh 🐧 retweeted
The @fosdem cfp's are coming in - are you going ? To speak ?
Karanbir Singh 🐧 retweeted
‼️ Attackers are exploiting a critical Fortinet FortiSIEM flaw that lets them run code without logging in, Canada's Cyber Centre says.
Horizon3 released an exploit for CVE-2026-106173 on Oct 20. Version 7.5.1 fixes it.
Fortinet still lists the flaw as not known to be exploited.
Karanbir Singh 🐧 retweeted
Fantastic to see this in the BBC site. Ultimately, open source and the Linux ecosystem exists purely because of the great people in it.
bbc.co.uk/news/articles/cw30…
Karanbir Singh 🐧 retweeted
Ruby’s turn 😅
Remember the GitLab bug? Well now it moved upstream into Ruby.
Multiple 10.0 CRITICAL exploits.
Patch now 🚨
Happy Friday 🤠
ruby-lang.org/en/news/2026/1…
Karanbir Singh 🐧 retweeted
The PHP security team is advising everyone to set this config until the next patch:
session.upload_progress.enabled=0
I’ll be cutting a release shortly where serversideup/php will do this for you by default ⚡️
php.net/archive/2026.php#202…
Karanbir Singh 🐧 retweeted
In response to the eMudhra / emSign certificate security incident we've published guidance for Python users to update CA certificates: discuss.python.org/t/informa…
#security #Python #pki
discuss.python.org/t/informa…
Karanbir Singh 🐧 retweeted
Quote: "an independent security researcher reported that the keys of eight eMudhra Global TLS intermediate Certificate Authorities were cryptographically weak".
Well, yeah, they were weak. A private key should look something like this:
84ac06790886c80c48d31691fd4c0fe9
ce3207f9807f2fe571d6e4ec426d7864
4298fc53df2b92566970e757ac998c34
Instead, their keys looked like this:
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000004
Global TLS Intermediate CA incident: We’ve updated our incident page with how it happened, who is affected (one US customer ecosystem), what’s not affected, and what we’re putting in place. We will publish the root cause once our investigation is complete.
👉emudhra.com/en/post/certific…
Readers added context they thought people might want to know
eMudhra minimizes the scope by claiming only "one US customer ecosystem" is affected. In reality, 8 of its CA certificates had catastrophically weak private keys (one being simply the number 4), allowing anyone to forge trusted HTTPS certificates for any website on the internet.blog.google/security/prote…
Karanbir Singh 🐧 retweeted
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security thephp.foundation/blog/2026/…
Karanbir Singh 🐧 retweeted
Linux Kernel 7.3 Officially Released, This Is What’s New lxer.com/module/newswire/ext…
Karanbir Singh 🐧 retweeted
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
For more⬇️
ncsc.gov.uk/news/critical-se…
Karanbir Singh 🐧 retweeted
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
Karanbir Singh 🐧 retweeted
I’ve had a few people write to ask me to follow up on a (reply!) tweet I wrote that’s gotten a lot of retweets. I considered deleting it just to avoid the headache, but I think that would make people more paranoid. So let me share my thoughts.
Karanbir Singh 🐧 retweeted
Gentoo infrastructure sponsors wanted! --- Gentoo Linux is made possible by many community donations and sponsors. Unfortunately, this year several long-running sponsors were unable to continue their prior support...gentoo.org/news/2026/10/07/i…
Karanbir Singh 🐧 retweeted
The @nvidia @NVIDIARTXSpark devices are out tomorrow.
How long before we have Linux running on one ?
50%day 1
43%1 week
7%1 month
14 votes • Final results Karanbir Singh 🐧 retweeted
Fascinating read.
"AI agent spent weeks inside nested KVM, built a 14,338-line kernel exploit harness, and made Google’s live host hand back the flag."
pwn.ai/blog/kvmescape
Karanbir Singh 🐧 retweeted
Read my thoughts on @OpenAI's call for collective cyber defense published today: linkedin.com/feed/update/urn….
