Averigua'o profesional | Fotoperiodista en San Juan 📸🇵🇷 | Eterno curioso del Cosmos 🚀| alum @uprrp 🎓| Las opiniones aquí son solo mías, no de mi patrono.
San Juan, Puerto Rico
Joined May 2010
- Tweets15K
- Following1.9K
- Followers7.8K
- Likes13.1K
Juan R. Costa retweeted
#ÚLTIMAHORA | Lula gana las elecciones presidenciales tras una remontada inédita ante Flávio Bolsonaro.
Juan R. Costa retweeted
Elon Musk claims that Ukraine allegedly violated Starlink's terms of use and used the system on combat drones.
As someone who was inside the process at the Ministry of Defense, I can say with certainty that this is not true.
In February of this year, whitelists were introduced. Stationary terminals could be registered by both military personnel and civilians.
But for any satellite terminal to work while on the move, it had to be added to a special list and connected to the military Starshield system. Otherwise, no satellite communication terminals in Ukraine would work.
In other words, using civilian Starlink for drone missions was technically impossible. All drone missions that required satellite communication could only be carried out using Starshield.
We are very grateful to the United States and SpaceX for access to critically important satellite communications. Ukraine did not violate the terms of use.
Juan R. Costa retweeted
El presidente de EE.UU., Donald Trump, afirma que "tiene derecho" a presentarse de nuevo a las elecciones presidenciales porque, sostiene, le hicieron "trampa" en los comicios de 2020, que perdió frente a Joe Biden.
efe.com/mundo/trump-reclama-…
Juan R. Costa retweeted
BREAKING: President Trump must sit for a deposition in his defamation lawsuit against the BBC by Dec. 11, a judge orders. apnews.com/article/trump-bbc…
Hoy, los hackers hacen fiesta con los sistemas del Gobierno de Puerto Rico.
¿Y el gobierno? “Bien, gracias.”
Juan R. Costa retweeted
The Prime Minister of Japan is tweeting to apply the PHP fix patch.
WTF.
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
I feel his pain with every typed word.
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Creo que el 99% de planeta no entiende lo grave de este asunto.
Aquí un link del NYT que lo explica: nytimes.com/2026/10/21/us/po…
CISA, NSA, FBI… todo el mundo dice lo mismo: apaga tu servidor hasta que puedas hacer update al PHP o corres el riesgo de intromisión total de hackers a tus bases de datos.
🚨 Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable unauthenticated #RCE and affect PHP installations serving web requests. Learn more: 🔗 go.dhs.gov/5Hi
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.
“Léelo otra vez. Tres académicos, en una revista científica seria, acaban de decir que la luz y el agua son un asunto de nacimientos”.
elcalce.com/contexto/2026/08…
Juan R. Costa retweeted
BREAKING: Two critical security flaws in PHP, the programming language behind much of the internet, are forcing governments to take websites offline, per the BBC.
The flaws were found by AI. Security firm Wiz called them the “most severe vulnerabilities ever discovered” by the technology.
Un día interesante en @AeropuertoSJU | Simulan bomba en TSA y empleado desquiciado que le disparó contra sus compañeros.
“All clear, end of exercise.”
Videos: NotiCel y suministro Aerostar.
Juan R. Costa retweeted
Mas feo esto cada día: Antes de que siquiera se condujera el proceso adjudicativo en el que “participaron” tres empresas, el Departamento de la Familia estaba buscando cómo pagarle los $38 millones a NOLA Education elnuevodia.com/noticias/gobi…
Portada del NYT:
A Billionaire Wanted a Trump Pardon. His Family Gave Alina Habba a $50 Million Deal. nytimes.com/2026/10/20/us/po…
