Geek. CTO @fintechins1ghts - Founder @tyche_tech - ex @madtv IT Director | developer, weirdo, geek | opinions expressed here are my own
Dubai | Nicosia | Athens
Joined August 2007
- Tweets24.4K
- Following1.3K
- Followers2.3K
- Likes7.2K
Dimitris Moutsatsos retweeted
i am tired boss ⚰️
Security release pre-alert:
We will release new versions of Node.js 22, 24, and 26 release lines on or shortly, after 2026-11-11 in order to address security vulnerabilities.
The highest severity issue fixed in this release is HIGH.
nodejs.org/en/blog/vulnerabi…
Dimitris Moutsatsos retweeted
So... do distros plan on fixing CVE-2026-98432 or are we supposed to die of anxiety?
Dimitris Moutsatsos retweeted
😂
Ten million people have watched a comedian accidentally destroy the entire TED talk industry.
He filmed the talk once at TEDxNewYork in 2014 and openly admitted he had nothing to say.
Speaking coaches charge $5,000 to teach the exact tricks he used in 6 minutes to say nothing at all.
His name is Will Stephen. He is a comedian from Late Night with Seth Meyers who was invited to give a real TED talk and used it to prove the format is a costume anyone can wear.
Every TED speaker opens with a question, tells a personal story, cites a scientist, and shows a chart. Stephen did all four in six minutes with zero content.
His entire formula fits on a napkin.
Gesture with both hands. Ask the audience a question anyone can answer. Tell a mildly embarrassing story so they say aww. Point to a stranger on a slide and call them important. Flash a chart of random numbers. Wear glasses with no lenses. The audience will think you are brilliant.
That last trick alone has probably cost the public speaking coaching industry a hundred million dollars in sessions clients should have skipped.
"If you watched me on YouTube with the sound off, you would think I was a genius."
That is Will Stephen on the TED stage, three minutes into the talk he was paid to give. He wasn't lying.
Executives pay $15,000 for a keynote coach and still open with a joke the room never laughs at. Founders rehearse their pitch for weeks and still sound like Stephen at minute four, saying "wagga wah, gabba gabba" with authority.
The talk is free on YouTube. The method is written across every TED speaker's playbook for ten years.
Stephen still writes for Seth Meyers. Almost none of the ten million viewers have stopped nodding at empty slides since.
The formula is free. The willingness to actually say something before your next keynote, pitch, or townhall is the entire edge.
Dimitris Moutsatsos retweeted
Everyday is Zeroday
BREAKING: Binance has been hacked with wallets across the Ethereum, Bitcoin, and TRON networks seeing outflows of -$5.7 billion.
The hack includes $1.45 billion worth of Bitcoin and $875 million worth of ETH.
If confirmed, this would mark the biggest hack in crypto history.
We expect more information shortly.
Dimitris Moutsatsos retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Dimitris Moutsatsos retweeted
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
Dimitris Moutsatsos retweeted
What’s happening in Paris and Milan is no surprise to anyone who has spent time around young people in Europe during the 2010s:
Virtually all of them were working on their 4th masters degree in social welfare, were unmarried, attended communist dinners every night, and regularly participated in riots.
Now the economy is suddenly transforming and they have nothing to show for it.
Dimitris Moutsatsos retweeted
We announced an agreement to acquire a nationwide low-band spectrum license portfolio that will pave the way for @Starlink to become a major mobile carrier in the US.
With this new spectrum and our Gen2 constellation, Starlink Mobile can ensure Americans have access to high-speed mobile broadband no matter where they are → spacex.com/updates#starlink-…
