Seeing reports of another round of snail mail social engineering letters from "Ledger" that try to trick you into scanning a QR code that takes you to software that steals your seed phrase.
Anyone who has been maintaining internet-facing infrastructure for the past 3 months:
xitter.cf/ThePHPF/status/2112828…
If you rely on the volunteer maintained rpms.remirepo.net we urge you to move to distro packages or building from source now, so you can immediately apply updates. The repo will not have updates today.
🚨DEFCON 1🚨
In a few hours, a critical vulnerability that affects ~70% of web sites will be disclosed. It allows an attacker to upload and execute arbitrary code.
It's probably best if you stop browsing the internet for the rest of the week.
xitter.cf/ThePHPF/status/2112633…
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Readers added context they thought people might want to know
These are server-side PHP RCE vulnerabilities for which web hosts/admins should prepare to patch per official notice; general users face no direct need to stop browsing. PHP detected on ~69% of sites with known server-side language.
php.net/archive/2026.p…
w3techs.com/technologies/d…
cert.europa.eu/publications/s…
sansec.io/research/php2s…
arstechnica.com/security/2026/…
October is Cybersecurity Awareness Month.
Remember: the less data you share with online services, the smaller your attack surface and safer you are!
Pretty amazing how it's possible to cram more courage than the entire Uvalde police department into a single man.
xitter.cf/CollinRugg/status/2111…
JUST IN: The man who stopped the school shooting in Bend, Oregon, has been identified as 36-year-old Kalub Giamanco.
Giamanco, a carpenter, was reportedly driving home for lunch when he heard gunshots.
After hearing the gunshots, Giamanco, who has a concealed carry permit, followed the suspect into the school.
He then shot and killed 16-year-old John J Griffin moments after the teen opened fire into a special education classroom.
Giamanco, who has two children of his own who attend the school, is family friends with one of the victims, a 7-year-old who uses a wheelchair and was shot in the face.
The 7-year-old survived and is in the hospital.
Three children at Silver Rail Elementary School were killed. Their ages are 5, 8, and 11.
According to Giamanco's brother, Giamanco doesn't feel like a hero because he feels guilty for not being able to save more children.
You are a hero, Kalub.
Good news: the Bitcoin Wrench Attack archive just got a lot more accurate.
Bad news: we just doubled the total number of known attacks to over 700.
Kudos to @pizza_bitcoiner for finding hundreds of new attack reports via agentic searches.
jlopp.github.io/physical-bit…
More evidence you can't trust anyone with your personal data. 9 million people had their records leaked because some fool set an admin password to "123456"
en.cryptonomist.ch/2026/10/1…
A cryptocurrency owner was kidnapped in Toronto in July by a gang of 7 men that included 3 members of the Canadian military.
winnipeg.citynews.ca/2026/10…
Turkish media is reporting that notorious scammer James Schueler, AKA @RichardHeartWin, has been arrested. 🥳
en.haberler.com/mit-caught-w…
Let's see how @RichardHeartWin's various crypto scams are reacting to the news of his arrest... 😅
No, I'm not worried that the future of self custody is in peril simply because a bunch of edge case attacks and vulnerabilities I've been warning people about finally started happening in a short time span.
This is vindication for a decade of grinding @CasaHODL
Compromised crypto hardware is nothing new. We've seen them as far back as 2018 with counterfeit Trezor One devices being sold.
@CasaHODL's security model has protected our clients against supply chain attacks since inception:
docs.casa.io/wealth-security…
