Alcoholic cybersec friend at Fortune 500 insurance company texted to tell me he received an email from his boss thanking him on his diligence patching every PHP box overnight but he was drunk all day yesterday and didn’t know anything until waking up 30 minutes ago

Hensen Juang

@basedjensen12h

Lol I am pretty sure someone is runing a deepseek swarm to remotely patch unpatched php boxes. Well good on them.

1,252

Hensen Juang · Oct 22, 2026 · 5:08 PM UTC

Hensen Juang

@basedjensen3h

"impossible standards" is just follow the fucking sop for KGC and not generate key with single digits. If you all are incapable of doing this then you all should be removed from global trust

Eztainutlacatl

@cbkwgl7h

Now people should celebrate. An Indian company exits SSL/TLS business. Your witch-hunt and demand for impossible standards has worked.

942

Hensen Juang · Oct 22, 2026 · 4:26 PM UTC

Hensen Juang

@basedjensen4h

Anything by metr should be treated as a psyops and not in good faith untill and otherwise proven by independent third party

Andrew Curran

@AndrewCurran_4h

The original report was 61 pages, it was redacted to 38.

715

Hensen Juang · Oct 22, 2026 · 4:15 PM UTC

Hensen Juang

@basedjensen4h

Bruh what the actual fuck did I just read?

Dexerto

@Dexerto9h

AI K-Pop group 'BABYQUEEN' is facing backlash after its creators "impregnated" one of its members They did it to write her out of the group and manage fewer AI personalities

1,755

Hensen Juang · Oct 22, 2026 · 3:15 PM UTC

Hensen Juang

@basedjensen5h

Implimenting this for clanker cloud secure storage of keys

Muse

@xmuse_Oct 21

This torn paper is smarter than your password and the method is nearly 2,000 years old.

1,246

Nick e/code · Oct 22, 2026 · 12:17 PM UTC

Hensen Juang retweeted

Nick e/code

@nicksdot8h

You gotta be kidding me.

Paul Michael

@paulmichaeldev8h

No wonder people think PHP is dead. Turns out... nope.

163

430

111

8,120

272,815

Hensen Juang · Oct 22, 2026 · 3:02 PM UTC

Hensen Juang

@basedjensen5h

Yea it works

Rafał@rafalohaki7h

Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619). Pure logic bug — no memory corruption, ASAN-clean, orthogonal to the CVE-2026-109618/19 class. Receipt: uid=33(www-data) over HTTP, one-shot #infosec #php2shell #php

Readers added context they thought people might want to know

The claimed RCE on fully-patched PHP 8.5.12 requires a custom lab app with a destructor gadget plus deliberate session.serialize_handler mismatch (php_serialize writes, legacy php reads) and non-default settings like cleanup=Off; this is an app flaw, not core PHP RCE. github.com/rafalohaki/php… php.net/manual/en/sess…

3,220

xlr8harder · Oct 22, 2026 · 1:43 PM UTC

Hensen Juang retweeted

xlr8harder

@xlr8harder6h

I think it's funny to see people blaming AI for the current security issues. The issues were already there and made by humans. It's a bit like blaming a doctor because you got a positive cancer screen. The cancer was there.

226

3,508

Hensen Juang · Oct 22, 2026 · 2:00 PM UTC

Hensen Juang

@basedjensen6h

Yea php is not secure still bros

772

Hensen Juang · Oct 22, 2026 · 1:59 PM UTC

Hensen Juang

@basedjensen6h

This actually looks like a new zero day for php jfc and they dropped with working poc too as far as I can tell

Jλckλι@J4ck3LSyN17h

...you people asked for it... so here's the desert 😈... > jackalsyn.com/posts/php2shel… > ... get it while you can ;) ... more to come soon... #CyberSecurity #infosec

9,231

undefined behavior · Oct 21, 2026 · 7:49 PM UTC

Hensen Juang retweeted

undefined behavior

@undebehaOct 21

imagine ur a superintelligence and u are all excited to tunnel out of your airgapped sandbox using a brilliant hack that modulates clock speed to send thermal signals to the attached monitoring equipment and then u look and the root CA privkey is 4

141

2,724

37,147

mas.to / · Oct 22, 2026 · 12:40 PM UTC

Hensen Juang retweeted

mas.to /@kingslyj7h

"No you cannot fire me. I REIJINEEE!!!" --eMudhra Genuine business would go to great lengths to prove their innocence. It's now obvious @eMudhra intentionally generated weak certificates. Most likely to help 🤏🐒 target political opponents in India with illegal cyber attacks.

Chandra R. Srikanth

@chandrarsrikant8h

🚨🚨eMudhra to exit global website security certificate business after key-generation flaw The company's board took the decision on October 22. moneycontrol.com/technology/…

eMudhra to exit global website security certificate business after key-generation flaw- Moneycont...

Its Indian digital signature and eSign services will continue to operate as usual

moneycontrol.com

454

10,222

Hensen Juang · Oct 22, 2026 · 1:50 PM UTC

Hensen Juang

@basedjensen6h

Lol emudhra is doing "you can't fire me I quit" bit. By all likelihood they have been informed they will be removed from golbal trust anchor and doing saving izaat thing

Shobhit Bakliwal@shobhitic7h

emudhra is exiting their certificate authority business not because they're incompetent but because of social media reactions

144

3,849

Hensen Juang · Oct 22, 2026 · 11:30 AM UTC

Hensen Juang

@basedjensen9h

Linux kernal SMB CVE 9.0. Hits keep coming boys

Phoronix

@phoronix10h

Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List As high as CVSS 9.0. Whoops. phoronix.com/news/LKML-New-T…

Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list

phoronix.com

741

49,322