Saša Blagojević retweeted
❌ Local gym keep your name and phone number
✅ Giant companies train AI on all your personal data
Did I get it right? What's the point of GDPR again?
Saša Blagojević retweeted
macOS Developers should update their /etc/ssl/cert.pem file to remove the compromised eMudhra certificate.
Apple has directions here: support.apple.com/en-us/1495…
Saša Blagojević retweeted
"an accounting issue"
Such as Greece’s use of off-balance-sheet currency swaps use to hide debt and deficits in the early 2000s.
Or Lehman Brothers Repo 105 in 2008.
Or Iceland's banking collapse that same year.
Or the South Sea Company in 1720.
Or the Mississippi Company in 1719.
Shall I continue?
Saša Blagojević retweeted
Added a new skill: /teardown
It creates a technical illustration of any object and lets you customize individual parts, colors and annotations. You can then export the result as an SVG or PNG.
npx skills add jakubkrehel/skills
Saša Blagojević retweeted
when you see an “expert” in the media talk about a topic you’re quite familiar with, it really makes you question all their other “experts” for all the other topics
Saša Blagojević retweeted
I wonder how much shareholder value needs to be lost in security breaches before we start caring about implementation details again
Saša Blagojević retweeted
wow this is bad!
ENTIRETY of PingCap database used by linkedin, flipkart, airbnb etc. has been copied and stolen due to customer credentials being stored directly in support tickets (LOL)
Attackers ran exfiltration directly on their cloud (LOL) pipeline ran for 22 days, exfiltrating data every 6 hours and NO ONE noticed. Worse, PingCap denies all of it.
Average SRE salary is $300,000 at PingCap btw
Saša Blagojević retweeted
WHAT THE FUCK IS HAPPENING TODAY
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Saša Blagojević retweeted
Hardware looks scary until you break it down into small steps. So I built an app that takes you through Arduino one circuit at a time.
Made with Opus 5.5
learn-arduino-red.vercel.app
Saša Blagojević retweeted
Many years back, I made a statement that “HTTPS is dangerous” due to significant, and obvious, problems in the design of the Certificate Authority system.
The core point I made: A small, simple mistake with a Root Certificate Authority has massive impacts throughout the system, making it highly likely that there were untold numbers of “fake” certificates which were “trusted”.
It is a “security based on trust” system, where we are asked to blindly trust dozens upon dozens of Root Certificate Authority organizations (from countries around the world) to never make a single mistake (or implement any backdoors for any government they are beholden to).
It is, quite simply, a design that appears specifically made to be abused and manipulated.
I was told that I did not understand how CA’s work.
I was mocked and ridiculed.
Well… as a wise man once said…
Who’s laughing now, Wayne?!
In April of 2025, eMudhra (an Indian Certificate Authority), published 8 intermediate CA keys which were so weak that a small child could guess the numbers in a few seconds.
One of the private keys was, literally, 4.
Just… 4.
This massive problem was not made public until October 17th of this year, when it was discovered by an anonymous guy on the Internet who goes only by “Wayne” (like “Cher”…. but… “Wayne”).
What this means in practical terms: It has been trivially simple, for the last year and a half, to create fake “secure” HTTPS certificates. (One person even created a fake HTTPS certificate for a Google.com subdomain.)
It took Mozilla 3 days, after learning about this (from “Wayne”), before they updated their certificate list (which many open source projects — including curl and Python — rely upon).
As of this moment, many systems are still vulnerable (including macOS).
Saša Blagojević retweeted
Oh, you aren’t updating your dependencies every hour? Well, too bad, you are vulnerable
Oh, you are updating your dependencies every hour? Well, too bad, you are somehow also vulnerable
Saša Blagojević retweeted
I wish the people releasing early pocs to one of the most severe RCEs in history a very fuck you
A moron has released a POC early for php2shell so here is what you need to do:
If you’re on version prior to 8.2:
Edit php.ini: session.upload_progress.enabled = Off
Then reload php-fpm and restart apache
If you’re on later version:
Update (it’ll be available in a few hours)
In any case, the mitigation for the php.ini should work either way. Not sure if it’ll cover both vulns though so keep an eye on that. I’ll be reporting on follow up activity on windows as a target.
Good luck!